A recent decision by the Court of Justice of the European Union (CJEU) could pave the way to challenge the US Foreign Account Tax Compliance Act’s (Fatca) validity in the EU.
The ruling stated that the 2016 EU-US Privacy Shield arrangement is not valid under European law.
It was drafted by the European Commission (EC) and set out that firms based in the US could self-certify that personal data they received from EU sources would be in line with European data protection laws and, from 2018, with the General Data Protection Regulation (GDPR).
But Austrian privacy activist Max Schrems argued that Facebook’s sharing of information from its Irish operations to the US could not comply with EU regulation, because the United States’ legal system does not provide sufficient protection to personal data.
The CJEU upheld Schrems’ complaint and rejected the EC’s argument that US data privacy rules are adequate.
Setting precedents
The ruling could open the door for American citizens living in the EU, who are subject to Fatca.
The law requires people with a US passport, and their foreign financial institutions, to report information to the Internal Revenue Service (IRS).
The Act’s validity in the EU has been the subject of several legal challenges in France, the UK and even at the European Commission.
Filippo Noseda, the Mishcon de Reya lawyer looking after the UK lawsuit against HM Revenue & Customs’ compliance with Fatca, told International Adviser: “For almost five years now we have been raising the same concerns that were at the heart of the Schrems case, notably the lack of appropriate data protection safeguards for transfers of data collected in the EU.
“As our correspondence shows, until now the national data protection authorities, and even the European Data Protection Board (EDPB), failed to consider our concerns, prompting a UK MEP to accuse the EDPB of being ‘Kafkaesque’.
“The Schrems judgment is a game changer and we have already written to the UK Information Commissioner’s Office and the EDPB urging them to take immediate action against the violation of basic EU data protection principles,“ he added.
Noseda’s client, a US-born British citizen known as ‘Jenny’, lost her complaint against HMRC in June 2020, but he believes the CJEU’s ruling could provide favourable ground for her case to be successful in the UK.
