Service Public fédéral Finances – Complaint Upheld (Belgium, 2025)

The Foreign Account Tax Compliance Act (FATCA) is a US law that requires foreign financial institutions to provide the US tax authority with information about the foreign bank accounts of US citizens. In order to enact FATCA outside the US jurisdiction, the US signed a number of international agreements with other Countries (“FATCA agreements”), including BelgiumAgreement between the Government of the Kingdom of Belgium and the Government of the United States of America to improve International tax compliance and to implement Fatca, April 23 2014.. In turn, Belgium implemented the FATCA agreement in its national lawBelgian Law of December 16, 2015. with the Law of December 16, 2015. Under the FATCA agreement and its implementation, financial institutions forwarded data about account holders to the Public Federal Service of Finances of Belgium (the controller). In turn, the controller forwarded the data to the US Internal Revenue Service (IRS). So, this disclosure required the transfer of personal data outside the EU/EEA and to the US. The data subject was a Belgium resident with a dual Belgian and American nationality (and therefore subject to FATCA). In 2020 a Belgian bank informed the data subject that it had disclosed his personal data to the controller, for further disclosure to the IRS. The data included his name, address, tax identification number, date of birth, account balance, account number, and other information relating to his bank assets. In 2022 the data subject filed a complaint against the controller, challenging the disclosure of his data to the IRS and questioning the legality of the FATCA agreement under EU data protection law. He put forward several demands: * he requested a halt to the disclosure of his data based on the FATCA agreement; * he required the bank to erase all the personal data it collected based on the FATCA agreement; * he required that the bank take all necessary steps to obtain the erasure of his data from the IRS. Failing that, he required the bank to limit the processing of his personal data under Article 18 GDPR. The Association Accidental Americans of BelgiumThe term "accidental American" has no legal definition. The data subject defines accidental Americans as individuals who, like himself, are US nationals despite having no significant ties with the US. non-profit also filed a similar complaint for the benefit of all its members. The DPA joined the two complaints. In 2023 the Belgian DPA upheld the complaints and ordered a ban on the transfer of tax data of “accidental” US citizens residing in Belgium to the US. The controller appealed the decision. In June 2023 the Court of Appeal of Brussels provisionally suspended the DPA’s decision on grounds that a ban on data transfers could prevent Belgium from upholding its commitments under international law and damage the country’s reputation. In December the same Court annulled the decision over lack of motivation and referred the case back to the DPA for a new decision. The DPA reprimanded the controller for violating Articles 14(1), 14(2), 12(1), 35(1), 5,(2), and 24 GDPR. The DPA also ordered the controller to bring the disclosures into compliance with the GDPR within one year. The DPA refrained from suspending the disclosures, in view of the fact that the processing operation were part of an international commitment by the Belgium. = The DPA held that the FATCA agreement did not comply with the GDPR. The DPA also concluded that the FATCA agreement was not covered by the GDPR exemption under Article 96 because it did not comply with the Data Protection Directive. == The DPA started by assessing the material and temporal applicability of Article 96 GDPR. This Article concerns the effects of “international agreements involving the transfer of personal data to third countries or international organisations (…)”, concluded before the adoption of the GDPR. Under Article 96 GDPR, such agreements stay in force until amended, replaced or revoked, provided that they complied with pre-GDPR Union law (in this case, the Data Protection Directive). Materially, the DPA considered that Article 96 GDPR only applies to the content of an international agreement and therefore does not prevent the Articles of the GDPR from applying. For example, the FATCA agreement does not contain provision about the information obligation nor the accountability obligation of the controller, which does not necessarily imply that the controller has no information obligation or should not respect the accountability principle. From a temporal point of view, the DPA considered that Article 96 GDPR, read in the light of Recital 171, GDPR is a transitional provision protecting pre-existing international agreements until they are renegociated to comply with the GDPR. The Member States and the Union had a transitional period of two years to renegotiate any agreements incompatible with the GDPR, between the GDPR's adoption and its entry into force. The DPA therefore claims that Article 96 GDPR is not indefinitely applicable. In this regard, the DPA also referred to Articles 4(3) of the Treaty on the European Union (TEU) and Article 351 of the Treaty on the Functioning of the European Union (TFEU), as well as the case law of the Court of Justice relative to Article 351 TFEU. The DPA stressed that Member States are under an obligation to remove any incompatibilities between international and Union law by re-negotiating international agreements incompatible with Union law. For these reasons, the DPA concluded that Article 96 GDPR should be interpreted restrictively and that the FATCA agreement was not in its scope of application, meaning it could not benefit from the exemption. == In order to assess whether the controller could invoke Art. 96 to begin with, the DPA examined whether the FATCA agreement complied with two core principles of the Data Protection Directive: purpose limitation (Article 6(1)(b)) and data minimization (Article 6(1)(c))These principles are close equivalents to their GDPR counterparts in Article 5: see Article 5(1)(b) and (c).. The DPA held that the FATCA agreement did not comply with the principle of purpose limitation. In the DPA’s view, the stated purposes of the agreement (the improvement of international tax, and the implementation of obligations arising from the US "FATCA" law) were lawful but too generic. Similarly, the DPA held that a number of purpose limitation provisions in the FATCA agreement (specifically, Clauses 3(7) and 8) and the Law of December 16, 2015 were too generic. == The DPA then assessed whether data disclosures under FATCA complied with the principle of data minimization. The DPA observed that the FATCA agreement mandates the disclosure of the data of all American citizens residing in Belgium, based on the sole criterion of citizenship. This included individuals with an outcome below the taxable threshold under the US’ non-resident tax regime, and owners of accounts at a low risk for tax fraud. The DPA held that personal data of these individuals, were irrelevant to combating tax fraud. Therefore, the disclosure of such data violated the principle of data minimization. In this regard, the DPA referred to both GDPR and pre-GDPR era CJEU case law. The DPA also pointed out that under the FATCA agreement, banks could optionally exempt themselves from reporting data for accounts under US$50,000. This optional exemption proved that data about such accounts were not relevant to FATCA begin with, and further proved the violation of the principle of data minimization. Finally, the DPA dealt with an argument related to a ruling from the Belgian Constitutional court. In 2017 the Court dismissed an action for the annulment of Law of December 16, 2015 and stated that the collection of data, required by the law, was proportionate and legitimate under Article 8 of the European Convention of Human Rights (which protects the right to privacy). On this basis, the controller claimed that the agreement complied with data minimization. Under Belgian law, the Court's findings on questions on law were binding on other courts and the DPA. However, the DPA pointed out that the ruling was about Law of December 16, 2015 rather than the FATCA agreement. Therefore, the ruling did not deal with proportionality of the agreement itself and did not bind the DPA’s own assessment of the matter. Furthermore, the DPA claimed that even if the Court’s finding had been relevant, the DPA could nonetheless depart from them, based on the primacy of Union law (including CJEU case law). = The disclosure of data under the FATCA agreement required the transfer of personal data to the United States. Therefore, Chapter V of the GDPR applied and the controller needed a mechanism to legally transfer data under the GDPR. In the absence of an adequacy decision from the EU Commission, the controller invoked two Articles of Chapter V GDPR: 46(2)(a) and 49(1). So, the DPA assessed whether the controller could rely on those provisions. == Article 46(2)(a) allows transfers of data to third countries based on “a legally binding and enforceable instrument between public authorities or bodies”. The DPA interpreted Article 46 in the sense that the safeguards mentioned in paragraph (1), must be appropriate and must appear in the legally binding instrument invoked under paragraph (2)(a). In other words, the DPA held Article 46(2)(a) is not an authorization for unsafe data transfers as long as they are required by international agreements or similar legal instruments. Rather, Article 46 implictly requires the legal instrument, referred to in paragraph 2(a), to include appropriate safeguards for the data subject. In this regard, the DPA referenced the case law of the Court of JusticeCJEU, Case C-311/18, Facebook Ireland and Schrems, 16 July 2020 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=118939 here]). as well as guidance from the EDPSEDPS, Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation (EU) 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, 15 December 2020 (Version 2.0), available [https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202002_art46guidelines_internationaltransferspublicbodies_v2_en.pdf here]. and the Article 29 Working Party. The DPA held that the FATCA agreement did not include such safeguards, for a number of reasons. Among other issues, the FATCA agreement: * did not comply with the principles of purpose limitation and data minimization, as the DPA already found; * includeded no commitments to storage limitation and transparency; * contained no mention of data subject rights and of redress mechanisms for data subjects; * included no system for independent overview. Ultimately, the DPA held that the controller failed to demonstrate that appropriate safeguards were in place, and that it could invoke Article 46(2)(a) GDPR for transferring data. == The DPA also examined Article 49(1)(d) GDPR, which allows data transfers “necessary for important reasons of public interest”. In line with EDPB Guidance, the DPA held that derogations under Article 49 must be interpreted restrictively and cannot justify systematic, large-scale transfers of data such as those required by the FATCA agreement. Furthermore, the DPA stressed that Article 49 includes a criterion of necessity. This criterion was not mean in the case at hand because the FATCA agreement itself did not comply with the data minimization principle. For this reason, the DPA held that the controller could not rely on Article 49(1)(d) GDPR, either. = == In the case at hand, the controller did not inform the data subject of the processing of his data. Only the bank did so (as required by Law of December 16, 2015). For this reason, the DPA held that the controller failed to inform the data subject, in violation of Article 14 GDPR. The DPA also held that the exemption under Article 14(5) did not apply because the information provided by the bank was less extensive that the information listed by Article 14 GDPR. Therefore, the data subject did not already have the information required under the Article. == The controller did not carry out a data processing impact assessment (DPIA) for the transfer of personal data to the IRS under the FATCA agreement. During the procedure, the controller argued that the processing did not entail a high risk to the right and freedoms of data subjects, and that a DPIA was therefore not needed. Contrary to the controller’s arguments, the DPA held that the processing was high risk and required a DPIA. In particular, the DPA held that the processing met many of the criteria for high-risk operations found in Recital 75 GDPR and EDPS guidanceWP29, ‘Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679‘, 17/EN WP 248 rev.01, As last Revised and Adopted on 4 October 2017 (available [https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47711 here]).. The DPA further noted that the application of strict standards for technical security (as in the case at hand), is not reason enough to exclude that the processing of personal data is high risk. The DPA also held that the transfer of personal data outside the EU/EEA, further increased the risk of the processing. For these reasons, the DPA held that the controller should have carried out a DPIA and failed to do so, in breach of Article 35(1) GDPR. == The DPA held that the controller violated the accountability principle by failing to accurately assess the risk of the processing of personal data, by failing to implement technical and organizational measures to ensure compliance by the GDPR, and by failing to document its compliance. The DPA also clarified that the controller was not exempt from its accountability obligations based on its role as an intermediary in a flow of data resulting from international law.