GDPR tests FATCA - Game over?

feuprivaIn a decision of 20 December 2023, the Market Court overturned and annulled the decision of the Belgian Data Protection Authority on the basis of an insufficient justification and motivation . The court refers the case back to the Data Protection Authority, in another composition, to reassess the case, with motivation, on the merits, taking into account the considerations of the Market Court.

FATCA and IGAs

On 23 April 2014, Belgium entered into a Model 1 IGA with the United States. Belgium was relatively late in signing its IGA, even though it had been engaged in discussions since 2012. The Agreement and a Supplemental Agreement were ratified by Act of 22 December 2016 but the legislation arranging for practical implementation was already in place.

FATCA is essentially a domestic tax enforcement measure with extraterritorial effects. It aims to gather information on offshore accounts of U.S. persons. For Belgian banks and financial institutions, failure to comply would mean that U.S. financial institutions and other U.S. withholding agents would be required to withhold 30 percent on certain U.S. source payments made to such Belgian banks and financial institutions.

The international reach of FATCA raised concerns and criticism in countries like Belgium that have banking secrecy rules and data privacy rules. The EU Privacy rules regulate the exchange of personal data, including with foreign tax authorities. The directive requires there to be a local statutory basis for the use of the relevant client’s information in order for it to be exchanged. For Belgium, U.S. domestic legislation does not meet that requirement.

At the request of France, Germany, Italy, Spain, and the United Kingdom, the U.S. government revisited their position and explored an intergovernmental approach to FATCA, supporting the overall aim to combat tax evasion, while reducing risks and burdens on financial institutions. In order to avoid legal restrictions for financial institutions, the U.S. developed and proposed Intergovernmental Agreements (IGAs).

When France, Germany, Italy, Spain and the United Kingdom announced that they had been collaborating on the development of a “Model Intergovernmental Agreement to Improve Tax Compliance and Implement FATCA” and that they intended to conclude Model 1 IGAs to implement FATCA, like many other countries Belgium was encouraged to start negotiations with the United States.

On 8 November 2012, the U.S. Treasury announced that it was engaged with more than fifty countries and jurisdictions, including Belgium, to improve international tax compliance and implement the information reporting and withholding tax provisions of FATCA.

Such negotiations did not require any prior legislative or executive action in order to enter the IGA. An international agreement must be ratified by the federal Parliament, and the regional parliaments, a posteriori. There was no apparent opposition or objection from industry or the taxpayers.

On 23 April 2014, Belgium and the United States signed a bilateral IGA to implement FATCA based on the Model 1 IGA.

The Belgium IGA

The Belgium IGA is a reciprocal Model 1 IGA in which Belgium commits to report information on the accounts of U.S. taxpayers to the IRS through automatic exchange of financial information, and the United States undertakes to reciprocate with financial information on the accounts of Belgian taxpayers to the Belgian tax authorities.

It is to be noted that the Belgium IGA is more or less a carbon copy of the June 2014 Model IGA. The only major deviations are the funds that qualify as Exempt Beneficial Owners and the excluded accounts.

For the Treaty-Qualified Retirement Fund, the IGA refers to the definition in Subparagraph 1(k) of Article 3 of the 2006 U.S.-Belgium Income Tax Treaty with the proviso that the fund must be entitled to benefits under the treaty on income that it derives from sources within the United States (or would be entitled to such benefits if it derived any such income). The IGA also lists Belgian Savings Funds. These are collective investment funds established through a so-called collective savings account as part of a tax-favored pension savings scheme.

On 29 September 2015, Belgium and the United States signed a Supplemental Agreement to the IGA, changing the terms of termination of the IGA to prevent the agreement from ending the following day. Instead, they opted for a fixed period of twelve months following the entry into force of the agreement. Both agreements were be ratified by Act of 22 December 2016 but the legislation arranging for practical implementation was already in place.

Furthermore, on 24 November 2015, the Competent Authorities of both States signed a Competent Authority Arrangement.

The IGA also contains a most-favored nation clause under the heading “Consistency in the Application of FATCA to Partner Jurisdictions.” Should the United States provide a more favorable rule under Article 4 or Annex I of the IGA to another Partner Jurisdiction under a signed bilateral agreement, pursuant to which the other Partner Jurisdiction commits to undertake the same obligations as Belgium and to be subject to the same terms and conditions, then the United States will grant Belgium the benefit of such more favorable rules. The United States shall notify Belgium of any of these more favorable terms, and such terms will apply automatically as if they were specified in the Belgium IGA with effect from the signing of the other agreement. However, Belgium reserved the right to decline the application of these more favorable terms, for example, if such terms required modifications of other elements of the IGA and Belgium decided such changes were not advantageous.

Legislation implementing FATCA.

On 20 July 2016, the federal government approved a draft bill on the ratification of the IGA and the supplemental arrangement. The draft bill was submitted to the Council of State for examination and submitted to Parliament shortly thereafter. The IGA and the supplemental agreement were to enter into force on the date of Belgium’s written notification confirming that Belgium has completed the necessary internal procedures, sent through diplomatic channels to the United States.

The necessary legislation came with the Act of 16 December 2015, which introduced the Belgian rules that will allow the Belgian tax administration to comply with three international instruments: the IGA, the OECD Multilateral Competent Authority Agreement on Automatic Exchange of Information, and EU Directive 2014/107/EU.

The act provides the framework that obliges Belgian qualifying financial institutions and insurance companies to identify and verify account holders and their accounts, to exchange information automatically, to retain the information and to protect the privacy of the personal data of the account holder.

One important feature is that the retention period for the financial data, as well as the period during which the Belgian tax authorities can investigate the communication of information, is one year longer than the standard period under the tax code. Moreover, the act obliges financial institutions and insurance companies to erase the data after this period.

The publication of this legislation gave the Belgian tax authorities the green light to report to the IRS under the IGA. The deadline for the Belgian tax authorities to report to the IRS was moved from 30 September 2015, to 30 September 2016. With respect to the obligations of the financial institutions and the insurance companies under the IGA, the act entered into force as of 10 January 2016.

The IGA and the GDPR

An “accidental American”, a person with dual Belgian and American citizenship, had asked the Belgian tax authorities to delete the information his banks had given them in view of transferring them to the IRS. The Belgian tax authorities refused whereupon the plaintiff submitted an appeal against this decision with the Council of State. The Council of State stalled the proceedings because the individual had filed a complaint with the Belgian Data protection authority (DPA).

The Belgian Data protection authority (DPA).

At the end of 2020, the DPA had received a complaint from this Accidental American and from the “Accidental Americans Association of Belgium”. They argued that the exchange of information with the IRS under the intergovernmental FATCA agreement does not comply with all the principles of the GDPR and should be stopped. The Ministry of Finance invoked an exception in Article 96 of the GDPR, according to which international agreements existing before the implementation of the GDPR may nevertheless remain in force, provided that they comply with the law applicable at the time they were concluded.

On May 24, 2023, the Belgian DPA declared the transfers of personal data of Belgian Accidental Americans by the Belgian Ministry of Finance to the US tax authorities under the intergovernmental FATCA agreement unlawful and decided to prohibit them.

The DPA found that the data processing carried out under this agreement did not comply with all the principles of the GDPR, including the rules on data transfers outside the EU. The DPA also asked the Finance Ministry to alert the competent legislator of the shortcomings identified by the DPA.

The Litigation Chamber of the DPA noted that the generalized and undifferentiated transfer of tax data provided for in the agreement does not respect the principle of purpose limitation (the agreement does not contain exact objectives for the transfer of data); nor the principle of proportionality and data minimisation (only data strictly necessary for the purposes sought, in this case combatting tax fraud, can be processed).

The Litigation Chamber also noted that the "stand still” effect of article 96 GDPR is limited in scope and that article 96 has to be read in a restrictive way. The Litigation Chamber also finds that the FATCA agreement does not contain appropriate safeguards to ensure that exported personal data is afforded a similar level of protection as data within the EU.

The Market Court

The Belgian State appealed this decision before the Market Court of the Brussels Court of Appeal. The Market Court grants applicants an effective remedy and a fair trial before a tribunal against most decisions of regulatory authorities in the broad sense of the term as guaranteed by Article 47 of the EU Charter of Fundamental Rights.

The Market Court suspended the decision of the DPA in an interim decision of 28 June 202 allowing the Belgian tax authorities to continue to exchange information with the IRS.

In its decision of 20 December 2023 (not yet published), the Market Court overturned and annulled the decision of the DPA on the basis of an insufficient justification and motivation of the Litigation Chamber’s Decision 61/2023 of 24 May 2023. It is noteworthy that the court refers the case back to the Litigation Chamber, in another composition, to reassess the case, with motivation, on the merits, taking into account the considerations of the Market Court.

The DPA has confirmed that it is re-examining the complaint.

Going forward

The procedures started by the Association of Accidental Americans in Luxembourg, France and Belgium will require the tax authorities to question the degree of privacy protection they have to give to the information they share with the IRS.

More recently, the UK High Court of Justice recently handed down a procedural decision that has raised eyebrows across that portion of the world affected by the FATCA. The case opposes a UK taxpayer against HM Revenue & Customs. It asks whether the intergovernmental agreement between the US and UK governments, which requires HMRC to provide bulk data transfers to the IRS, runs afoul of the EU’s general data protection regulation.

In its decision of 8 March in Webster v. HM Revenue & Customs, the High Court of Justice held that HMRC may proceed with an abuse of process defense because its argument has “sufficient substance, reality and prospect to make it unfair to dispose of it on an interlocutory basis on this application.” HMRC’s argument that Jennifer Webster seeks to strike relates to the disclosure of her funder’s identity — anonymity being a condition in the funding agreement — because it “goes to the ‘true’ nature” of her claim.

It is not over yet.