{"id":101560,"date":"2025-12-05T09:37:39","date_gmt":"2025-12-05T08:37:39","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101560"},"modified":"2025-12-09T18:14:04","modified_gmt":"2025-12-09T17:14:04","slug":"does-the-transfer-of-financial-data-to-the-us-under-fatca-violate-the-gdpr","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/is-de-doorgifte-van-financiele-gegevens-naar-de-vs-onder-fatca-in-strijd-met-de-gdpr\/","title":{"rendered":"Does the transfer of financial data to the US under FATCA violate the GDPR?"},"content":{"rendered":"

The Brussels Market Court has decised in a ruling<\/a> of 26 November 26 2025, to refer thirteen questions for a preliminary ruling to the Court of Justice of the European Union (CJEU). The key question is whether the automatic, mass exchange of bank data of Belgian citizens (the so-called \u201cAccidental Americans\u201d) with the US Internal Revenue Service (IRS) is compatible with European data protection rules. Until the European Court provides an answer, the final ruling on the legality of these transfers remains suspended.<\/p>\n\n\n\n

The facts and legal context<\/h2>\n\n\n\n

This case has its origins in the fight against tax evasion by the United States. In 2014, Belgium, like many other countries, concluded an intergovernmental agreement with the US to implement the American Foreign Account Tax Compliance Act<\/em> (FATCA)<\/a>. This agreement was transposed into Belgian law by the Act of December 16, 2015<\/a>.<\/p>\n\n\n\n

Based on these regulations, Belgian financial institutions are required to report information on clients who are US citizens or US tax residents to the FPS Finance. The FPS Finance<\/a> then automatically passes this information (such as balances, interest, and dividends) on to the US Internal Revenue Service<\/em> (IRS).<\/p>\n\n\n\n

This system particularly affects \u201cAccidental Americans\u201d: individuals who have American nationality by virtue of being born in the US, but often no longer have any connection with the country and have never worked or lived there<\/sup>.<\/p>\n\n\n\n

The ball started rolling when the Accidental Americans Association of Belgium (AAAB) and an individual complainant lodged a complaint with the Belgian Data Protection Authority (DPA) alleging that this massive data transfer violated data protection law.<\/p>\n\n\n\n

The procedure has become quite complex:<\/p>\n\n\n\n

    \n
  1. Decision 61\/2023 (DPA)<\/a>:<\/strong> The DPA Litigation Chamber initially ruled that the transfers were unlawful and prohibited them.<\/li>\n\n\n\n
  2. Annulment:<\/strong> The Market Court overturned this decision on December 20, 2023, due to a lack of justification and referred the case back to the DPA.<\/li>\n\n\n\n
  3. Decision 79\/2025 (DPA)<\/a>:<\/strong> On April 24, 2025, the Litigation Chamber, in a different composition, again ruled that the processing was in violation of the General Data Protection Regulation (GDPR)<\/a> (including principles of purpose limitation, minimization, and transfer to third countries) and issued a reprimand and order to comply.<\/li>\n<\/ol>\n\n\n\n

    The Belgian State (FPS Finance) lodged another appeal against this latest decision with the Court of Appeal, which led to the current interim ruling<\/sup>.<\/p>\n\n\n\n

    The ruling of the Market Court: 13 questions to the Court of Justice<\/h2>\n\n\n\n

    In its ruling of November 26, 2025, the Market Court ruled that it did not have sufficient information to make a final ruling on the validity of the GDPR violations identified by the DPA. Given the complexity and EU law nature of the case, the Court suspended the proceedings and referred 13 questions to the CJEU for a preliminary ruling.<\/sup><\/sup><\/sup><\/sup>.<\/p>\n\n\n\n

    These questions can be divided into three broad categories:<\/p>\n\n\n\n

    1. Compatibility with the \u2018old\u2019 law (Directive 95\/46\/EC)<\/strong> <\/p>\n\n\n\n

    The Court asks whether an agreement such as FATCA, concluded before the entry into force of the GDPR, was compatible with the then applicable Directive 95\/46\/EC<\/a> and the Charter of Fundamental Rights<\/a>. Specifically, it is asked whether the mass, undifferentiated transfer of data without specific suspicion of fraud is proportionate and whether the purposes are sufficiently specific.<\/p>\n\n\n\n

    2. The interpretation of Article 96 GDPR (The Grandfather Clause)<\/strong> <\/p>\n\n\n\n

    Article 96 of the GDPR stipulates that international agreements concluded before May 24, 2016, remain in force if they complied with EU law at the time. The Market Court wants to know:<\/p>\n\n\n\n