The press release of the Belgian Protection Authority from May 24, 2023 provides:
The Belgian Data protection authority today declared unlawful, and decided to prohibit, the transfers of personal data of Belgian “Accidental Americans” by the Belgian Federal Public Service Finance (FPS Finance) to the US tax authorities under the intergovernmental FATCA agreement. According to the Belgian DPA, the data processing carried out under this agreement does not comply with all the principles of the GDPR, including the rules on data transfers outside the EU. It also asks the FPS Finance to alert the competent legislator of the shortcomings identified by the DPA.Belgian DPA prohibits the transfer of tax data of Belgian “Accidental Americans” to the USA
It is interesting that the term “Accidental Americans” is used in the release. The individual who filed the complaint is a dual Belgian and American citizenship and from the “Accidental Americans Association of Belgium.” The official website of the DBA provides the summary in part as follows:
Conclusions of the Litigation Chamber
The Litigation Chamber concludes that the transfers of data of Americans residing in Belgium to an authority located in a country outside the EU (which cannot offer an adequate level of data protection) are unlawful. For this reason, the Belgian DPA prohibits the FPS Finance from processing the complainants’ data and asks it to alert the competent legislator of this prohibition and of the shortcomings found.
The Belgian DPA also orders the FPS Finance to inform in a complete and accessible manner the data subjects of the data processing carried out as part of the FATCA agreement and of its modalities. It also asks to carry out a “DPIA” which is an analysis of the risks associated with this data processing.
The parties can appeal this decision.
Hielke Hijmans, Chairman of the Litigation Chamber, concludes: “Ordering the cessation of data flows to the United States under the FATCA agreement may seem harsh, but once we find that they do not comply with the applicable law, we are obliged to stop these data flows. This principle has been confirmed in the rulings known as the “Schrems rulings”.
The full decision in French can be reviewed here –