ASBL AA and B v. Direct Tax Administration (ACD) – Court Ruling (Luxembourg, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Luxembourg court ruled that a bank could share a customer's financial data with U.S. authorities without their consent. This is important because it shows how financial information can be shared across borders, even if the person objects. It reminds businesses to be aware of international data-sharing laws.
What happened
The court upheld a bank's decision to share a customer's financial data with U.S. authorities.
Who was affected
The complainant, a French and American citizen, was affected by the data sharing.
What the authority found
The court found that the bank's actions were necessary under Luxembourg law and did not violate GDPR.
Why this matters
This ruling illustrates the complexities of international data sharing and the limits of individual control over personal data. Businesses should understand their obligations under both local and international laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal authorities. Afterwards, by latest the 30th September 2020, the Luxembourg fiscal authorities will share this information with the US fiscal authorities. The complainant, a French and American citizen connected to the association for the protection of civil rights ASBL, turned to the Luxembourg direct Tax Office (hereinafter: ACD), explaining that the data to be transferred on the basis of the FATCA concern identification, financial and economic data, i.e. personal data as defined in the GDPR. Thus, the complainant requested the ACD to erase the personal data and immediately discontinue the exchange of information between the ACD and the American fiscal authorities. The director of the ACD rejected this request, stating that the ASBL is not a data subject and the processing of the personal data of the complainant was necessary to respect the Luxembourg FATCA Agreement law to which the ACD is subject, Thus, in their view the request to restrict processing is not justified. The complainant turned to the Luxembourg Administrative Tribunal, which rejected the injunctive request to suspend the information sharing with the US fiscal authorities. The Tribunal also declared itself entitled neither to decide on the decision of the ACD, nor to invalidate it. As to the merit, the Tribunal found the request for invalidation unfounded, rejecting the request for a reimbursement and ordering the complainant to pay the costs. The ACD challenged the receivability of appeal. In relation to the GDPR-related questions, the court held the following. * Whether the GDPR was applicable to the data transfer With regards to the applicability of the GDPR and the law of the 1st August 2018 about the organisation of the Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection supervisory aut
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for ASBL AA and B v. Direct Tax Administration (ACD) in LU
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
12 December 2024
Authority
DPA CourAdministrative
About this data
Cite as: Cookie Fines. ASBL AA and B v. Direct Tax Administration (ACD) - Luxembourg (2024). Retrieved from cookiefines.eu
Last updated: