International transfers in the limelight again with Belgian decision on FATCA data transfers to the US

On 24 April 2025, the Belgian Data Protection Authority (DPA) ruled (once again) that transfers of personal data by the Belgian Federal Public Service Finance (FPSF) to the US tax authority under the US Foreign Account Tax Compliance Act (FATCA) are not compatible with the EU General Data Protection Regulation (GDPR). This comes after the DPA reached the same conclusion in a decision handed down in May 2023 (the 2023 Decision). The 2023 Decision, however, had been appealed to, and subsequently annulled by, the Market Court in Brussels in December 2023, after it concluded that the DPA failed to give sufficient reasoning for its 2023 Decision. 

Background

FATCA was introduced under the Obama administration to ensure compliance with US tax obligations by facilitating the transfer of data on Americans living abroad. In 2014, Belgium entered into an intergovernmental agreement with the US in relation to FATCA (the FATCA Agreement). 

The case against FPSF was brought by the Accidental Americans Association of Belgium (AAAB) and an individual with dual Belgian-American nationality, who was born in the US but has no other ties to the country (i.e., an “accidental American”). The claimants argued that the personal data transfers under the FATCA Agreement violated the GDPR articles governing international data transfers and failed to comply with GDPR principles such as purpose limitation, data minimisation and transparency. They also argued that the DPA had not conducted a data protection impact assessment (DPIA). 

In response, FPSF sought to rely on Article 96 of the GDPR, arguing that the FATCA Agreement was entered into before the GDPR came into force and complied with EU law at the time, and therefore remains in force until it is amended, replaced or revoked.

The DPA’s decision

The DPA concluded that there was no relevant adequacy decision for the US, no Article 46 compliant appropriate safeguards in place (such as standard contractual clauses) and no Article 49 derogation applied. In particular, it stated that the derogation for transfers that are “necessary for important reasons of public interest” only applied where there is a “spirit of reciprocity” and where the transfers are not on a large and systematic scale. 

In addition, the DPA rejected the FPSF’s argument in relation to Article 96, emphasising that such an interpretation of a “transitional” provision would be contrary to EU law. In any event, the DPA’s view was that the FATCA Agreement did not comply with EU law at the time it was agreed (in particular the purpose limitation and data minimisation principles). The DPA also concluded that FPSF should have undertaken a DPIA. 

The DPA therefore ordered FPSF to make the transfers GDPR-compliant within one year, to undertake a DPIA and to include clear and accessible information about data transfers under the FATCA Agreement on its website. Interestingly, in 2023, the DPA had instead ordered FPSF to stop its transfers immediately. 

Comment and broader context

Member States have been discussing the GDPR compliance of such international tax data transfers for several years now and were invited by the European Data Protection Board to review them in 2021. The DPA explicitly criticises the lack of action in this regard, and notes that this becomes less acceptable as more time passes. 

In addition, this decision comes at a time when international transfers have in been in the spotlight again, albeit in a more general context. For example, in the EU, the Irish Data Protection Commission fined TikTok €530 million and ordered corrective measures in relation to transfers of EEA user data to China. In the US, the Department of Justice recently brought in a rule (issued under the previous administration) prohibiting and restricting transfers of bulk sensitive US personal data to specific countries ‘of concern’, such as China and Russia. Whilst these rules are often prompted by national security concerns rather than privacy ones, it potentially signals a more stringent approach to data security and international data transfers by some countries.

If FPSF appeal the decision and a subsequent referral is made to the CJEU, this could add to the current uncertainty and political tensions that underpin much of the current debate around global flows of data.