European Court to Examine GDPR Compatibility of US Tax Law Data Transfers
A Belgian case making its way to the European Court of Justice (ECJ) could have important implications for transfers of EU residents' banking data to the U.S. under the Foreign Account Tax Compliance Act of 2010 (FATCA), Mayer Brown attorneys said in a Jan. 6 analysis.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
FATCA and other U.S. tax laws imposed on Americans living outside the country have long raised privacy and other issues, Democrats Abroad said in an email Monday.
The case arose from a complaint by a person with dual Belgian and U.S. citizenship and the Association of Accidental Americans, who challenged the compatibility of FATCA-mandated personal data transfers with the GDPR, Mayer Brown data protection attorneys Ana Hadnes Bruder, Oliver Yaros and four colleagues wrote.
Under FATCA, non-U.S. financial institutions such as banks, investment managers and broker-dealers are required to report information about accounts held by U.S. individuals, including citizens, to the U.S. Internal Revenue Service, the lawyers said. The reporting regime was enacted to fight U.S. tax evasion through offshore accounts.
Failure to comply with FATCA can lead to a 30% U.S. withholding tax on payments received from investments in U.S. securities, the lawyers said.
Like many EU countries, Belgium implemented FATCA via a bilateral agreement with the U.S. known as an intergovernmental agreement, the analysis said. Most such agreements shift implementation and enforcement responsibilities to local tax authorities.
In 2023, the Belgian DPA found that transfers of personal data of Belgian “accidental Americans” from Belgium's Federal Public Service Finance (FPS Finance) to U.S. tax authorities under the intergovernmental FATCA agreement were unlawful and barred them, it noted in a Dec. 4 statement. It held that the data processing operations violated several provisions of the GDPR.
FPS Finance appealed the decision to the Market Court, which annulled it and sent the case back to the DPA for a new ruling, which was adopted in April 2025 and which FPS Finance also contested, the watchdog said. FPS argued that Belgium's intergovernmental agreement with the U.S. should be upheld because it was signed before the GDPR was adopted in 2016 and took effect in 2018, the law firm analysis noted.
The Belgian court asked the ECJ for a preliminary ruling on, among other things, whether data transfers required under FATCA and implemented by bilateral agreements between EU nations and the U.S. comply with the GDPR, the DPA said.
The Association of Accidental Americans -- which represents people with U.S. citizenship but without a meaningful connection to the country -- argued that FATCA results in mass, indiscriminate transfers of bank data to the U.S. without any suspicion of wrongdoing or tax evasion, breaching GDPR principles such as data minimization, the lawyers said.
The Belgian court asked the ECJ for a ruling on whether collecting and retaining tax data without a time limit and without evidence of tax evasion is GDPR-compatible, they said. Another question is whether FATCA aligns with the EU-U.S. Data Privacy Framework.
The Belgian court questions the relevance and sufficiency of the DPF, Bruder emailed us Monday. FATCA operates as a mandatory, government-to-government exchange mechanism rather than a commercial transfer framework of the type that the DPF was designed to address, she said.
Even if the DPF were considered applicable, the court expressed concern that FATCA data might be accessible to U.S. authorities beyond strict tax purposes, and EU subjects have limited practical means of redress, Bruder said.
"The referral is less about reopening the validity of the DPF and more about whether FATCA’s structure and operation can realistically be squared with the GDPR’s transfer rules, even in a post-DPF landscape."
An ECJ ruling against FATCA-style transfers could affect all EU-U.S. automatic tax-information exchanges, the attorneys wrote. EU governments might have to renegotiate their intergovernmental agreements, or such accords might no longer have any effect, leaving financial institutions in EU jurisdictions directly subject to FATCA rather than intergovernmental pacts.
The Belgian court's referral to the ECJ "marks a pivotal moment for the intersection of international tax enforcement and EU data-protection law," the law firm wrote. "The questions raised go to the heart of the GDPR's extraterritorial reach, the limits of pre-GDPR agreements, and the ongoing transfer of sensitive financial data to US authorities."
Rebecca Lammers, chair of Democrats Abroad's Global Taxation Task Force, said in an email that "the application of U.S. tax laws to Americans living outside the United States has raised longstanding questions about proportionality, privacy, and fundamental taxpayer rights."
"We are confident that the competent authorities will reassess how these laws are implemented and [will] strike an appropriate balance between effective tax administration and the rights of individual taxpayers."