APD/GBA (Belgium) - 79/2025
From GDPRhub
| APD/GBA - 79/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(2) GDPR Article 12(1) GDPR Article 14(1) GDPR Article 14(2) GDPR Article 24 GDPR Article 35(1) GDPR Article 6(1)(b) Directive 95/46/EC Article 6(1)(c) Directive 95/46/EC |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 22.12.2020 |
| Decided: | 24.04.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | Service Public fédéral Finances |
| National Case Number/Name: | 79/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | cci |
The DPA assessed the FATCA agreement and held that it is not compatible with the GDPR. It reprimanded the Public Federal Service of Finances over several GDPR violations and ordered it to bring its disclosures under FATCA into compliance.
English Summary
Facts
The Foreign Account Tax Compliance Act (FATCA) is a US law that requires foreign financial institutions to provide the US tax authority with information about the foreign bank accounts of US citizens.
In order to enact FATCA outside the US jurisdiction, the US signed a number of international agreements with other Countries (“FATCA agreements”), including Belgium[1]. In turn, Belgium implemented the FATCA agreement in its national law[2] with the Law of December 16, 2015.
Under the FATCA agreement and its implementation, financial institutions forwarded data about account holders to the Public Federal Service of Finances of Belgium (the controller). In turn, the controller forwarded the data to the US Internal Revenue Service (IRS). So, this disclosure required the transfer of personal data outside the EU/EEA and to the US.
The data subject was a Belgium resident with a dual Belgian and American nationality (and therefore subject to FATCA). In 2020 a Belgian bank informed the data subject that it had disclosed his personal data to the controller, for further disclosure to the IRS. The data included his name, address, tax identification number, date of birth, account balance, account number, and other information relating to his bank assets.
In 2022 the data subject filed a complaint against the controller, challenging the disclosure of his data to the IRS and questioning the legality of the FATCA agreement under EU data protection law. He put forward several demands:
- he requested a halt to the disclosure of his data based on the FATCA agreement;
- he required the bank to erase all the personal data it collected based on the FATCA agreement;
- he required that the bank take all necessary steps to obtain the erasure of his data from the IRS. Failing that, he required the bank to limit the processing of his personal data under Article 18 GDPR.
The Association Accidental Americans of Belgium[3] non-profit also filed a similar complaint for the benefit of all its members. The DPA joined the two complaints.
In 2023 the Belgian DPA upheld the complaints and ordered a ban on the transfer of tax data of “accidental” US citizens residing in Belgium to the US.
The controller appealed the decision. In June 2023 the Court of Appeal of Brussels provisionally suspended the DPA’s decision on grounds that a ban on data transfers could prevent Belgium from upholding its commitments under international law and damage the country’s reputation. In December the same Court annulled the decision over lack of motivation and referred the case back to the DPA for a new decision.
Holding
The DPA reprimanded the controller for violating Articles 14(1), 14(2), 12(1), 35(1), 5,(2), and 24 GDPR. The DPA also ordered the controller to bring the disclosures into compliance with the GDPR within one year. The DPA refrained from suspending the disclosures, in view of the fact that the processing operation were part of an international commitment by the Belgium.
On the FATCA agreement's compliance with data protection law
The DPA held that the FATCA agreement did not comply with the GDPR. The DPA also concluded that the FATCA agreement was not covered by the GDPR exemption under Article 96 because it did not comply with the Data Protection Directive.
EU data protection law and international agreements: Article 96 GDPR
The DPA started by assessing the material and temporal applicability of Article 96 GDPR. This Article concerns the effects of “international agreements involving the transfer of personal data to third countries or international organisations (…)”, concluded before the adoption of the GDPR. Under Article 96 GDPR, such agreements stay in force until amended, replaced or revoked, provided that they complied with pre-GDPR Union law (in this case, the Data Protection Directive).
Materially, the DPA considered that Article 96 GDPR only applies to the content of an international agreement and therefore does not prevent the Articles of the GDPR from applying. For example, the FATCA agreement does not contain provision about the information obligation nor the accountability obligation of the controller, which does not necessarily imply that the controller has no information obligation or should not respect the accountability principle.
From a temporal point of view, the DPA considered that Article 96 GDPR, read in the light of Recital 171, GDPR is a transitional provision protecting pre-existing international agreements until they are renegociated to comply with the GDPR. The Member States and the Union had a transitional period of two years to renegotiate any agreements incompatible with the GDPR, between the GDPR's adoption and its entry into force. The DPA therefore claims that Article 96 GDPR is not indefinitely applicable.
In this regard, the DPA also referred to Articles 4(3) of the Treaty on the European Union (TEU) and Article 351 of the Treaty on the Functioning of the European Union (TFEU), as well as the case law of the Court of Justice relative to Article 351 TFEU. The DPA stressed that Member States are under an obligation to remove any incompatibilities between international and Union law by re-negotiating international agreements incompatible with Union law.
For these reasons, the DPA concluded that Article 96 GDPR should be interpreted restrictively and that the FATCA agreement was not in its scope of application, meaning it could not benefit from the exemption.
The violation of purpose limitation
In order to assess whether the controller could invoke Art. 96 to begin with, the DPA examined whether the FATCA agreement complied with two core principles of the Data Protection Directive: purpose limitation (Article 6(1)(b)) and data minimization (Article 6(1)(c))[4].
The DPA held that the FATCA agreement did not comply with the principle of purpose limitation. In the DPA’s view, the stated purposes of the agreement (the improvement of international tax, and the implementation of obligations arising from the US "FATCA" law) were lawful but too generic. Similarly, the DPA held that a number of purpose limitation provisions in the FATCA agreement (specifically, Clauses 3(7) and 8) and the Law of December 16, 2015 were too generic.
The violation of data minimization
The DPA then assessed whether data disclosures under FATCA complied with the principle of data minimization.
The DPA observed that the FATCA agreement mandates the disclosure of the data of all American citizens residing in Belgium, based on the sole criterion of citizenship. This included individuals with an outcome below the taxable threshold under the US’ non-resident tax regime, and owners of accounts at a low risk for tax fraud.
The DPA held that personal data of these individuals, were irrelevant to combating tax fraud. Therefore, the disclosure of such data violated the principle of data minimization. In this regard, the DPA referred to both GDPR and pre-GDPR era CJEU case law.
The DPA also pointed out that under the FATCA agreement, banks could optionally exempt themselves from reporting data for accounts under US$50,000. This optional exemption proved that data about such accounts were not relevant to FATCA begin with, and further proved the violation of the principle of data minimization.
Finally, the DPA dealt with an argument related to a ruling from the Belgian Constitutional court. In 2017 the Court dismissed an action for the annulment of Law of December 16, 2015 and stated that the collection of data, required by the law, was proportionate and legitimate under Article 8 of the European Convention of Human Rights (which protects the right to privacy). On this basis, the controller claimed that the agreement complied with data minimization. Under Belgian law, the Court's findings on questions on law were binding on other courts and the DPA.
However, the DPA pointed out that the ruling was about Law of December 16, 2015 rather than the FATCA agreement. Therefore, the ruling did not deal with proportionality of the agreement itself and did not bind the DPA’s own assessment of the matter. Furthermore, the DPA claimed that even if the Court’s finding had been relevant, the DPA could nonetheless depart from them, based on the primacy of Union law (including CJEU case law).
On the unlawful transfer of personal data
The disclosure of data under the FATCA agreement required the transfer of personal data to the United States. Therefore, Chapter V of the GDPR applied and the controller needed a mechanism to legally transfer data under the GDPR.
In the absence of an adequacy decision from the EU Commission, the controller invoked two Articles of Chapter V GDPR: 46(2)(a) and 49(1). So, the DPA assessed whether the controller could rely on those provisions.
On Article 46(2)(a) GDPR
Article 46(2)(a) allows transfers of data to third countries based on “a legally binding and enforceable instrument between public authorities or bodies”.
The DPA interpreted Article 46 in the sense that the safeguards mentioned in paragraph (1), must be appropriate and must appear in the legally binding instrument invoked under paragraph (2)(a). In other words, the DPA held Article 46(2)(a) is not an authorization for unsafe data transfers as long as they are required by international agreements or similar legal instruments. Rather, Article 46 implictly requires the legal instrument, referred to in paragraph 2(a), to include appropriate safeguards for the data subject. In this regard, the DPA referenced the case law of the Court of Justice[5] as well as guidance from the EDPS[6] and the Article 29 Working Party.
The DPA held that the FATCA agreement did not include such safeguards, for a number of reasons.
Among other issues, the FATCA agreement:
- did not comply with the principles of purpose limitation and data minimization, as the DPA already found;
- includeded no commitments to storage limitation and transparency;
- contained no mention of data subject rights and of redress mechanisms for data subjects;
- included no system for independent overview.
Ultimately, the DPA held that the controller failed to demonstrate that appropriate safeguards were in place, and that it could invoke Article 46(2)(a) GDPR for transferring data.
On Article 49(1)(d) GDPR
The DPA also examined Article 49(1)(d) GDPR, which allows data transfers “necessary for important reasons of public interest”.
In line with EDPB Guidance, the DPA held that derogations under Article 49 must be interpreted restrictively and cannot justify systematic, large-scale transfers of data such as those required by the FATCA agreement. Furthermore, the DPA stressed that Article 49 includes a criterion of necessity. This criterion was not mean in the case at hand because the FATCA agreement itself did not comply with the data minimization principle.
For this reason, the DPA held that the controller could not rely on Article 49(1)(d) GDPR, either.
Other findings
Lack of transparency
In the case at hand, the controller did not inform the data subject of the processing of his data. Only the bank did so (as required by Law of December 16, 2015). For this reason, the DPA held that the controller failed to inform the data subject, in violation of Article 14 GDPR.
The DPA also held that the exemption under Article 14(5) did not apply because the information provided by the bank was less extensive that the information listed by Article 14 GDPR. Therefore, the data subject did not already have the information required under the Article.
Lack of a data protection impact assessment
The controller did not carry out a data processing impact assessment (DPIA) for the transfer of personal data to the IRS under the FATCA agreement. During the procedure, the controller argued that the processing did not entail a high risk to the right and freedoms of data subjects, and that a DPIA was therefore not needed.
Contrary to the controller’s arguments, the DPA held that the processing was high risk and required a DPIA.
In particular, the DPA held that the processing met many of the criteria for high-risk operations found in Recital 75 GDPR and EDPS guidance[7]. The DPA further noted that the application of strict standards for technical security (as in the case at hand), is not reason enough to exclude that the processing of personal data is high risk. The DPA also held that the transfer of personal data outside the EU/EEA, further increased the risk of the processing.
For these reasons, the DPA held that the controller should have carried out a DPIA and failed to do so, in breach of Article 35(1) GDPR.
On the violation of accountability
The DPA held that the controller violated the accountability principle by failing to accurately assess the risk of the processing of personal data, by failing to implement technical and organizational measures to ensure compliance by the GDPR, and by failing to document its compliance. The DPA also clarified that the controller was not exempt from its accountability obligations based on its role as an intermediary in a flow of data resulting from international law.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/96
Litigation Division
Decision on the merits 79/2025 of April 24, 2025
Case number: DOS-2021-00068
Subject: Complaint regarding the transfer by the Federal Public Service (FPS) Finance of personal data
to the U.S. tax authorities (IRS) pursuant to the "FATCA" agreement
The Litigation Division of the Data Protection Authority, composed of Mr. Yves
Poullet, President, and Messrs. Christophe Boeraeve and Jelle Stassijns, members, taking over
the case in this composition following the judgment of the Market Court of December 20, 2023
(2023/AR/801); 1
Having regard to the judgment of the Market Court of December 20, 2023 (2023/AR/801);
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR";
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter "LCA");
Having regard to the Rules of Procedure (hereinafter "RoI") of the Data Protection Authority as
approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Journal
2
on 15 January 2019;
Having regard to the documents in the case file;
1The decision of the Court of Procurement is published here: https://www.autoriteprotectiondonnees.be/publications/arret-du-20-decembre-
2023-de-la-cour-des-marches-ar-801.pdf
2The new internal regulations of the Data Protection Authority (DPA), following the amendments made by the Law of December 25, 2023, amending the Law of December 3, 2017, establishing the Data Protection Authority (LCA), entered into force on June 1, 2024. In accordance with Article 56 of the Law of December 25, 2023, the following applies only to complaints, mediation cases, requests, inspections, and proceedings before the Litigation Chamber initiated from that date:
https://www.autoriteprotectiondonnees.be/publications/reglement-d-ordre-interieur-de-l-autorite-de-protection-des-
donnees.pdf Cases initiated before June 1, 2024, as in this case, are subject to the provisions of the Anti-Corruption Act (LCA) as amended by the Law of December 25, 2023, and the internal regulations as they existed prior to that date. Decision on the merits 79/2025 — 2/96
Took the following decision concerning:
The complainants: Mr. X, hereinafter "the first complainant";
The non-profit Accidental Americans Association of Belgium (AAAB), whose
registered office is located at Clos Albert Crommelynck, 4 Box 7, 1160 Brussels,
Hereinafter referred to as "the second plaintiff";
Hereinafter referred to collectively as "the plaintiffs";
Both represented by Mr. Vincent Wellens and Mr. Maxime
Vanderstraeten, lawyers, whose office is located at Chaussée de la Hulpe,
120, 1000 Brussels.
The defendant: The Federal Public Service Finance (FPS Finance), whose registered office is located
at Boulevard du Roi Albert II, 33, 1030 Brussels,
Hereinafter referred to as "the defendant";
Represented by Mr. Jean-Marc Van Gyseghem, lawyer, whose office is
located at Boulevard de Waterloo, 34, 1000 Brussels. Decision on the Merits 79/2025 — 3/96
Table of Contents
I. Facts and Background to the Proceedings.............................................................................................................................5
I.1. Relevant Facts.......................................................................................................................................................5
I.2. Background to the Proceedings Leading to the Overturned Decision 61/2023..................................11
I.2.1. Admissibility of the Complaint.........................................................................................................................11
I.2.2. Subject Matter of the Complaint............................................................................................................................12
I.2.3. Investigation by the Inspection Service (IS)...............................................................................................13
I.2.4. Supplementary Investigation by the Inspection Service (IS).....................................................................15
I.2.5. Examination of the Merits by the Litigation Chamber.....................................................................16
I.2.6. Hearing of the parties on 10 January 2023 ..................................................................................19
I.3. Decision 61/2023..........................................................................................................................................19
I.4. The appeal against Decision 61/2023 before the Procurement Court.............................................20
I.5. The Procurement Court's judgments of 28 June and 20 December 2023..................................21
I.6. Background to the resumption procedure leading to this decision..................................23
I.6.1. The decision of 20 March 2024 on the composition of the case................................................23
I.6.2. Resumption of the examination on the merits............................................................................24
I.6.3. The invitation to the hearing and the hearing of the parties...............................................................27
II. Reasons.................................................................................................................................................................................29
II.1. Regarding the Jurisdiction of the Litigation Chamber of the APD.....................................................29
II.2. Regarding the Composition of the Litigation Chamber..................................................................31
II.3. Regarding the Absence of Financial Institutions from the Proceedings..................................................36
II.4. Regarding the Defendant's Status as Data Controller..................................................40
II.5. Regarding Article 96 of the GDPR........................................................................................................................43
II.6. Regarding the Claims Raised............................................................................................................................54
II.6.1. Can the Defendant Rely on Article 96 of the GDPR?....................................................55
II.6.1.1. Introduction.........................................................................................................................................55
II.6.1.2. Regarding the principle of purpose ......................................................................................................57
II.6.1.3. Regarding the principle of proportionality ................................................................................61
II.6.1.4. Other safeguards for the benefit of data subjects .................................................68 Decision on the merits 79/2025 — 4/96
II.6.1.5. Conclusion on compliance with EU law applicable on 24 May 2016 ......69
II.6.2. Transfers to the IRS and compliance with the GDPR ..................................................................69
II.6.2.1. Principles ...........................................................................................................................................69
II.6.2.2. Application of Articles 46.1 and 46.2. a) of the GDPR ................................................70
II.6.2.3. Conclusion ...........................................................................................................................................75
II.6.2.4. Regarding Article 49 of the GDPR..................................................................................................77
II.6.3. Regarding compliance with the information obligation..................................................................78
II.6.4. Regarding failure to comply with the obligation to carry out a DPIA.............................................84
II.6.5. Regarding failure to comply with Article 20 of the LTD..................................................................89
II.6.6. Regarding failure to ensure accountability..................................................................................90
III. Corrective measures and sanctions................................................................................................................91
IV. Publication of the decision.................................................................................................................................93 Decision on the merits 79/2025 — 5/96
I. Facts and background to the proceedings
1. On December 22, 2020, the complainants filed a complaint with the Data Protection Authority (DPA) against the defendant. The complaint alleges the unlawful transfer of personal data relating to the first complainant and to Belgian Americans (whose interests the second complainant represents) by the defendant to the US tax authorities in the context of the application of the intergovernmental agreement "FATCA" between the Belgian State and the United States, as well as other breaches of the GDPR attributable to the defendant in this context.2. The facts giving rise to the complaint are detailed below in points 3 to 19 (Section I.1). They are
followed by the background to the proceedings leading to Decision 61/2023 of the Chamber
Claim annulled by the Market Court on December 20, 2023, in points 20 to 59 (Section
I.2.), and then by the background to the resumption of the case leading to the present
decision in points 60 to 94 (Sections I.3 to I.6).
I.1. Relevant Facts
3. The first complainant resides in Belgium and holds dual Belgian and American nationality. With regard to the latter nationality, the first plaintiff describes himself as what is commonly called an "accidental American" because he only has American nationality
due to his birth at Stanford University in the United States without having maintained any significant ties
with that country. The Litigation Chamber immediately clarifies that the concept of
"accidental American" is not defined in law, as emphasized by the Market Court
3
in its interlocutory judgment of June 28, 2023. The plaintiffs, for their part, state that for
the purposes of the proceedings, this concept covers members of the AAAB.
4. The second plaintiff is a non-profit association under Belgian law (ASBL) composed
of accidental Americans whose purpose is to defend and represent the interests of
persons of Belgian-American nationality - such as the first plaintiff - who reside outside
the United States and maintain no significant ties with that country. The purpose of the association is
described in Article 4 of its articles of association dated September 28, 2019:
"The purpose of the association is to defend the interests of individuals of American nationality
residing outside the United States, against the harmful effects of the extraterritorial nature
of American legislation." The association pursues its purpose through all means available, and
in particular through:
3 This judgment is published here: https://www.autoriteprotectiondonnees.be/publications/cour-dappel-arret-provisoire-du-28-juin-
2023-2023-ar-801.pdf Decision on the merits 79/2025 — 6/96
- advocacy actions with the Belgian and American public authorities
and with European institutions
- the creation of communication materials
- the organization of events
- collaboration with law professors to provide legal information
for members
- legal action to defend the interests of persons of Belgian and American nationality
The means listed above are indicative and not exhaustive. 5. Due to his U.S. nationality, the first plaintiff is subject to the control of the U.S. tax authorities under the U.S. tax system. This system is based on the principle of nationality-based taxation and treats accidental Americans like any other taxpayer established on U.S. soil or engaged in activities related to that country, the fact that his residence is not established in the United States being irrelevant.
Only certain exceptions apply to non-residents on U.S. soil.
6. To facilitate the collection of relevant information by the U.S. Internal Revenue Service (hereinafter IRS) for the possible taxation of Americans residing abroad (including accidental Americans such as the first plaintiff) and to address the risk of tax evasion, the U.S. government has entered into intergovernmental agreements with various states around the world. These agreements provide for the
communication of data relating to these Americans residing abroad by
national financial institutions (hereinafter "financial institutions" or "banks")
to the national tax administration (such as the defendant), the latter then being required
to transfer this data to the IRS.
7. It is in this context that the "Agreement between the Government of the Kingdom
of Belgium and the Government of the United States of America to improve International tax
compliance and to implement FATCA" comes into play, signed by representatives of the governments of
the Kingdom of Belgium and the United States of America on April 23, 2014. This agreement is
commonly and hereinafter referred to as the "FATCA" Agreement. It implements the American Foreign
Account Tax Compliance Act, from which the acronym "FATCA" is derived. A comparable bilateral intergovernmental agreement (IGC) has also been signed with various countries around the world, including the member states of the European Union (hereinafter referred to as the EU). 4This intergovernmental agreement (FATCA) signed with Belgium was the subject of a consent law on December 22, 2016. Decision on the merits 79/2025 — 7/96
8. The Belgian Law of December 16, 2015, regulating the communication of information relating to financial accounts by Belgian financial institutions and the FPSFinance, within the framework of an automatic exchange of information at the international level and for tax purposes (hereinafter "the Law of December 16, 2015"), invoked by the defendants in several respects, falls within the more general context of the exchange of tax data between states, including, but not limited to, exchanges with the US IRS pursuant to the aforementioned FATCA agreement.
9. The purpose of this legislation, as defined in Article 1, is to regulate the obligations of
Belgian financial institutions and the defendant with regard to information
that must be communicated to a competent authority of another jurisdiction within the framework
of an automatic exchange of financial account information, an exchange
organized in accordance with the commitments made by the Belgian State and resulting from the following texts:
- Council Directive 2014/107/EU of 9 December 2014 amending Directive
2011/16/EU as regards the mandatory automatic exchange of information
in the field of taxation;
- The Joint OECD/Council of Europe Convention of 25 January 1988 on
Mutual Assistance in Tax Matters (the Multilateral Convention or "the OECD Convention");
- A bilateral double taxation convention for the prevention of double taxation on income taxes;
- A bilateral treaty for the exchange of tax information (such as the "FATCA" agreement).
10. The Law of December 16, 2015, entered into force on January 10, 2016, with regard to information
for the United States (Article 20).
11. On April 22, 2020, the first complainant received a letter from Bank Z, with which he
holds bank accounts. The subject line of this letter was: "Confirmation of your status as a
US person under the FATCA agreement and for other regulatory purposes." The complainant was
asked to confirm that he is neither a US national nor a resident of the
United States for the purposes of enforcing Z's obligations under the
applicable regulations on automatic data exchange. The complainant is
requested to complete a specific form issued by the US authorities for this purpose. The
letter states that the objectives pursued by the US legislation are, on the one hand,
5
Council Directive 2014/107/EU of 9 December 2014 amending Directive 2011/16/EU as regards mandatory automatic exchange of information in the field of taxation, OJ 2014 L 359/1.
6
The Law of 16 December 2015 was published in the Belgian Official Journal on 31 December 2015. Article 20 of the Law provides that it enters into force 10 days after its publication with regard to information intended for the United States. Decision on the merits 79/2025 — 8/96
to identify all accounts held by US citizens and/or residents with
non-US financial institutions and, on the other hand, to exercise better control
over the income and proceeds of securities held by Americans. The letter specifies that if
the signed and completed document is not returned, the law requires the bank to consider the
first complainant as a "US Person" by default: consequently, their contact details
as well as information on their assets, income, and gross income will continue to be
reported to the relevant tax authorities. Finally, the letter specifies that if the first
complainant is a US national or resides in the United States, they must visit
the branch to complete the necessary formalities. 12. On May 12, 2020, the first plaintiff was informed by his bank, Z, that since he held
several bank accounts in Belgium in 2019, these accounts were subject to the obligation to
report to the defendant in accordance with the legal obligations incumbent on
banking institutions with which tax residents of a country other than Belgium
hold, as is his case, one or more bank accounts. Z thus indicates to the first
plaintiff that it is required to report the following information to the defendant: the name, address,
jurisdiction of residence, tax identification number (TIN) or date of
birth of each person to be reported, the account number(s), the
account balance or value as of December 31 (special case: if the account is
closed, a zero amount is reported), interest, dividends, proceeds from sales,
redemptions, or reimbursements from financial audits, and other income generated by the
financial assets held in the account. In addition to the list of data cited above and
information on the principle of the automatic exchange of financial information to which Z
claims to be subject, the first complainant is referred to the defendant for any questions
as follows: "For further information on the automatic exchange of
financial information, you can consult the website of the FPS Finance or
the OECD. You can also call us at XXX." Bank Z has attached
to this letter the first complainant's data, which will be specifically communicated to the
defendant in fulfillment of this reporting obligation.
13. In a third letter dated May 18, 2020, Bank Z contacted the first complainant again and (a) this time explained the principle of the FATCA agreement in general terms, (b)
listed the data to be communicated in this context, and (c) indicated that since the complainant
held one or more accounts subject to the reporting obligation in 2019, it was required
to communicate them to the competent tax authority. Bank Z stated that for
further information on the FATCA agreement, the first complainant could call their bank at the
telephone number provided. 14. On December 22, 2020, the same day he filed a complaint with the DPA with the second complainant (complaint no. 1 - point 1), the first complainant requested that the defendant (Decision on the merits 79/2025 — 9/96) erase the personal data it had obtained from the banks pursuant to
the "FATCA" agreement, pursuant to Article 17.1.d) of the GDPR. The first complainant
also requested that the defendant take the necessary measures to obtain this
erasure from the IRS or, failing that, to restrict their processing pursuant to
Article 18.1.b) of the GDPR. In any event, the first complainant requests the immediate cessation
of the exchanges of information between the defendant and the IRS that take place each year on the
basis of the "FATCA" agreement. This transfer involving his personal data
disregards several key principles of the right to personal data protection as applicable in Belgium and more generally within the EU. The second
complainant makes the same request on his behalf for the benefit, in accordance with its statutory purpose, of Belgian accidental Americans.
15. More specifically, the complainants base their request on the following grounds: the unlawfulness of the
transfer of personal data to the IRS under the "FATCA" agreement (in violation of Articles 45, 46, and 49 of the GDPR); failure to comply with the principles of purpose limitation (Article 5.1.b) of the GDPR), proportionality or data minimization (Article 5.1.c) of the GDPR), and limited retention (Article 5.1.e) of the GDPR); Failure to comply with the principle
of transparency (Articles 12 to 14 of the GDPR) and a failure to comply with the obligation to conduct a
data protection impact assessment (hereinafter referred to as the DPIA - Article 35 of the GDPR). This
letter details each of the alleged grievances. Since these also form the basis of the complaint
filed with the DPA, they will be explained below when the Litigation Chamber discusses
the respective points of view of the parties, including that of the complainants (paragraph 82).
16. In its response letter of March 30, 2021, the defendant refuses to grant the complainants'
request, arguing that the alleged unlawfulness is unfounded. The defendant thus states that the legal basis for the transfer it is making lies
in the FATCA agreement and the Law of December 16, 2015. The defendant also invokes
Article 96 of the GDPR and concludes in support of this that, failing the plaintiffs to
demonstrate how the FATCA agreement violated EU law prior to May 24, 2016, i.e.
Directive 95/46/EC, their claims are without foundation. The defendant
also refutes all the other claims made against it.
17. Following this response from the defendant, only the first plaintiff renewed his
request on July 9, 2021, emphasizing that the said data transfers from the defendant
8
to the IRS are also illegal under Directive 95/46/EC.
7Article 96 of the GDPR: "International agreements involving the transfer of personal data to third countries or international organizations concluded by Member States before 24 May 2016 and which comply with Union law as applicable before that date shall remain in force until amended, replaced, or revoked."
8Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281/31. Decision on the merits 79/2025 — 10/96
18. By a decision dated October 4, 2021, the defendant refused to grant the claims of the
first complainant, rejecting the arguments put forward by the latter with regard to the alleged breaches of both the GDPR and Directive 95/46/EC. In this decision, the
defendant, relying on the interpretation of Article 96 of the GDPR by the French Council of State
in a judgment of July 19, 2019 (to which the Litigation Chamber will return in paragraph 165),
states that for the application of this Article 96, it is necessary to first verify the compliance of
the "FATCA" agreement with the GDPR and, in the absence of compliance, to examine whether this agreement
complies with EU law as of May 24, 2016. This interpretation is at odds with the content of its
letter of March 30, 2021, cited above (paragraph 17). For a clear understanding of the remainder of the
decision, the Litigation Chamber specifies that the defendant also considers, according to
its decision, that "in this case, the condition of a basis based on an important reason
of public interest - within the meaning of Article 49.1.d) of the GDPR or Article 26.1.d) 10 of Directive
95/46/EC - is indeed met since the basis for the lawfulness of the disputed processing is based on an
international agreement [i.e., the "FATCA" agreement] and the law of December 16, 2015."
19. An action for annulment before the Council of State (hereinafter "EC") was filed against
the defendant's administrative decision. At the request of the Litigation Chamber,
the parties indicated in their submissions and during the hearing on January 10, 2023, that this appeal was still pending. They specified that the defendant had
in particular argued that the EC is awaiting the outcome of the proceedings before the DPA before making a ruling. The
plaintiff, for his part, requested that the EC refer preliminary questions to the Court of Justice of the European Union (hereinafter "CJEU") regarding the legal basis of the transfers
made pursuant to the "FATCA" agreement, and regarding the admissibility of the mobilization of Article
49.1. d) of the GDPR or, where applicable, its equivalent in Directive 95/46/EC in the event
of application of Article 96 of the GDPR, as well as with respect to compliance with the principles of transparency,
purpose, minimization, and limited retention as enshrined in the relevant articles
of the GDPR or their equivalents in Directive 95/46/EC if application of Article
96 of the GDPR were to be retained.
9
Article 49.1. d) of the GDPR: "In the absence of an adequacy decision under Article 45(3) or appropriate safeguards under Article 46, including binding corporate rules, a transfer or set of transfers of personal data to a third country or an international organization may only take place under one of the following conditions: (…) (d) the transfer is necessary for important reasons of public interest."
10Article 26.1. (d) (Derogations) of Directive 95/46/EC: "By way of derogation from Article 25 and subject to contrary provisions of their national law governing specific cases, Member States shall provide that a transfer of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2) may be carried out, provided that: (…) (d) the transfer is necessary or legally required to safeguard an important public interest." Decision on the merits 79/2025 — 11/96
I.2. Background to the procedure leading to the annulled decision 61/2023
20. As mentioned in point 1 above, the complainants filed a complaint with the DPA on December 22, 2020 (complaint no. 1).
I.2.1. Admissibility of the Complaint
21. On March 22, 2021, complaint no. 1, insofar as it was filed by the first complainant, was
declared admissible by the Front Line Service (hereinafter SPL) of the APD on the basis of
Articles 58 and 60 of the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter LCA), and the complaint was forwarded to the Litigation Chamber pursuant
to Article 62.1 of the LCA. 22. Complaint No. 1, insofar as it was filed by the second complainant, was declared inadmissible on February 12, 2021, by the SPL of the APD on the grounds that the second complainant did not meet the conditions set out in Articles 220.2.3 and 4 of the Law of July 30, 2018 relating to the protection of individuals with regard to the processing of personal data (hereinafter "LTD"). 11
23. The Litigation Chamber immediately specifies that on July 9, 2021, the second complainant will file a new complaint (Complaint No. 2). This consists of a reformulation of her Complaint No. 1 of December 22, 2020. In it, the second complainant further explains her interest in taking action. It thus states that it is acting in its own name, in accordance with its statutory purpose, and
not in the name or on behalf of one or more Belgian Americans. The second
12
complainant therefore states that it is not acting in a representative capacity within the meaning of Article 80.1 of the GDPR.
The conditions for the application of this article, as implemented by Article 220.2. 3° and 4° of the LTD, should therefore not be met, in its view. The second complainant relies,
on Article 58 of the LCA, which stipulates that "any person may file a complaint."
Article 220 of the LTD: § 1. The data subject has the right to request a body, organization, or non-profit association to file a complaint on their behalf and to pursue administrative or judicial remedies on their behalf either with the competent supervisory authority or with the courts as provided for by specific laws, the Judicial Code, and the Code of Criminal Procedure. § 2. In disputes referred to in paragraph 1, a non-profit body, organization, or association must:
- 1° be validly constituted in accordance with Belgian law;
- 2° have legal personality;
- 3° have statutory objectives of public interest;
- 4° have been active in the field of protecting the rights and freedoms of data subjects within the framework of the protection of personal data for at least three years.
§ 3. The non-profit body, organization, or association shall provide proof, by presenting its activity reports or any other document, that its activity has been effective for at least three years, that it corresponds to its corporate purpose, and that this activity is related to the protection of personal data.
Article 80.1. of the GDPR "Representation of data subjects": The data subject has the right to mandate a non-profit body, organization, or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects in the context of the protection of their personal data, to lodge a complaint on their behalf, to exercise on their behalf the rights referred to in Articles 77, 78, and 79, and to exercise on their behalf the right to obtain redress referred to in Article 82 where provided for by the law of a Member State. Decision on the merits 79/2025 — 12/96
or a written, dated, and signed request to the Data Protection Authority." The
second defendant considers itself entitled to file a complaint with the APD on this basis,
all the more so since the purpose of its complaint is consistent with its statutory purpose. It
also claims that in its decision-making practice, the APD, in support of Decision 30/2020
of the Litigation Chamber, for example, recognized that the legal interest in bringing proceedings is broad and that the
possibility of filing a complaint is not restricted to the individuals concerned and
that a complaint may be filed by associations by virtue of their specific corporate purpose.
24. On October 5, 2021, this complaint no. 2 will be declared admissible by the APD's SPL on the basis
of Articles 58 and 60 of the LCA. This complaint will be forwarded to the Litigation Chamber pursuant
to Article 62.1 of the LCA.
25. In light of the above, the Litigation Division specifies that, under the terms of this
decision, the use of the term "the complaint" refers to the two complaints filed (Nos. 1 and 2),
which will also be joined by the Litigation Division (point 43).
I.2.2. The Purpose of the Complaint
26. The complaint filed by the plaintiffs seeks, primarily, to obtain, pursuant to Article
58.2.f) and j) of the GDPR, the prohibition, or even suspension, of the transfer of data (those
relating to the first plaintiff and, subsequently, those of all Belgian accidental Americans whose
interests the second plaintiff is representing) by the defendant to the IRS pursuant to
the "FATCA" agreement and the Law of December 16, 2015.
27. In their submissions in reply, the plaintiffs add that they request, as a
alternative, that the Litigation Chamber order, pursuant to Article 58.2. f) and j) of the
GDPR that the transfer of account balance data by the defendant to the IRS
in the context of the application of the "FATCA" agreement be prohibited, or even suspended, with regard
to both the first plaintiff and the Belgian Americans whose interests the second
plaintiff is defending.
14
28. During the hearing held before the Litigation Chamber, the plaintiffs
clarified that the use of the terms "prohibition, or even suspension" is based on the
exact wording of Article 58.2. f) and j) of the GDPR and does not imply a request for a
temporary suspension of the transfers, but rather their outright cessation for the future.
13The Litigation Chamber refers in this regard to the note it adopted regarding the complainant's position
https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-position-du-plainignant-dans-la-procedure-au-
sein-de-la-chambre-contentieuse.pdf, in particular point B (at the end) on page 2. It also refers to its decision 24/2022
and the references cited therein.
14
See point B of the minutes of the hearing of 10 January 2023. Decision on the merits 79/2025 — 13/96
I.2.3. The Inspection Service (IS) Investigation
29. On April 20, 2021, the Litigation Division decided to request an investigation from the Inspection
Service (hereinafter IS), pursuant to Articles 63(2) and 94(1) of the LCA. On the same date,
in accordance with Article 96.1 of the LCA, the Litigation Division's request to conduct
an investigation was forwarded to the IS.
30. On May 26, 2021, the IS investigation was closed, the report was attached to the file, and the latter was
forwarded by the Inspector General to the President of the Litigation Division (Article 91.1-2 of the
LAC).
31. According to its report, the IS concluded that there was, in its words, "no apparent
violation of the GDPR" (page 5 of the report).
32. In support of Article 96 of the GDPR (point 20 of the report), the IS notes, following its review
of the compliance of the "FATCA" agreement and the Law of December 16, 2015, with the regulatory framework
for data protection as applicable before May 24, 2016, that is, according to its
terms, with Directive 95/46/EC as transposed under the Law of December 8, 1992
on the protection of privacy with regard to the processing of personal data (hereinafter "LVP"), the following elements:
15
- On December 17, 2014, the Commission for the Protection of Privacy (hereinafter "CPVP") issued a favorable opinion 61/2014, subject to strict conditions precedent
on the first draft of the future Law of December 16, 2015. The CPVP then ruled favorably in its Opinion 28/2015 of July 1, 2015, on the
second draft law, which implemented the comments and conditions set out in its
Opinion 61/2014.
- Pursuant to its Deliberation AF 52/2016 of December 15, 2016, the Sectoral Committee
for the Federal Authority (hereinafter "SCAF") of the CPVP authorized the defendant to
transmit to the IRS the financial information on the reportable accounts of
US taxpayers submitted to it by financial institutions under the
"FATCA" agreement. The SI emphasizes that the SCAF, on this occasion, assessed
the admissibility of the tax purposes of the processing as well as the proportionality of the
data and the security of the processing. The SCAF had also ordered, in accordance with the
principle of transparency, the defendant to inform the public by means of a text
15The Commission for the Protection of Privacy (CPVP) was the Belgian data protection authority within the meaning of Article
28 of Directive 95/46/EC. The Data Protection Authority (DPA) succeeded it on May 25, 2018, in accordance with Article 3 of the LCA. 16
Article 36bis of the LVP provided that any electronic communication of personal data by a federal public service or by a public body with legal personality under federal authority requires authorization in principle from the Sectoral Committee for the Federal Authority (CSAF), unless the communication has already been authorized in principle by another sectoral committee created within the CPVP. The CSAF's mission is to verify whether the communication complies with legal and regulatory provisions. Decision on the merits 79/2025 — 14/96
accessible and understandable on its website regarding the circumstances in which personal data (including financial data) may be transmitted to the IRS. The IS notes in this regard that a web page dedicated to "FATCA" is available on the defendant's website. Finally, the SI recalls that pursuant to
17
Article 111 of the LCA, authorizations granted by the sectoral committees of the
CPVP (such as the CSAF) before the entry into force of this law retain, in principle, their
legal validity. 18
33. Finally, the SI rejects the applicability of the CJEU's Schrems II ruling. It notes that this ruling invalidates
the Privacy Shield, which concerned the transfer of personal data to the United States for
commercial purposes (and not for tax purposes as in this case). The SI also refers to
20
Article 17 of the Law of December 16, 2015, which, in particular, establishes the obligation of
confidentiality with regard to the information exchanged and its limited use. This
article refers both to the FATCA agreement and to the agreements to which the latter itself refers,
i.e., the OECD Convention already cited.34. Following its investigation, the IS concludes that, in light of the above considerations and
21
in accordance with Article 64.2 of the LCA, it is not appropriate to pursue its investigation further
and that it does not find, as already mentioned (point 32), any "apparent violation of the GDPR."
Article 111 of the LCA: "Without prejudice to the supervisory powers of the Data Protection Authority (DPA), the authorizations granted by the sectoral committees of the Commission for the Protection of Privacy (CPVP) before the entry into force of this law shall retain their legal validity." After the entry into force of this law, adherence to a general authorization granted by resolution of a sectoral committee is only possible if the applicant sends a written and signed commitment to the Data Protection Authority, in which they confirm their adherence to the terms of the resolution in question, without prejudice to the supervisory powers that the Data Protection Authority may exercise after receipt of this commitment.
Unless otherwise provided by law, pending authorization applications submitted before the entry into force of the law are processed by the data protection officer of the institutions involved in the data exchange.
18 The Litigation Chamber will not rule generally on the validity of these authorizations. It will examine the relevance of the application invoked by the defendant in the specific context of the complaint leading to this decision.
19Judgment of the CJEU of 16 July 2020, C-311/18, Facebook Ireland and Schrems (Schrems II), ECLI:EU:C:2020:559.
20
Article 17 of the Law of 16 December 2015: § 1. Information transferred to a reporting jurisdiction is subject to the confidentiality obligations and other protective measures provided for by the tax treaty that allows the automatic exchange of information between Belgium and that jurisdiction and by the administrative agreement that organizes this exchange, including provisions limiting the use of the information exchanged. § 2. However, notwithstanding the provisions of a tax treaty, the Belgian competent authority: - may authorize, generally and subject to reciprocity, a jurisdiction to which the information is transferred to use it as evidence before criminal courts when such information contributes to the initiation of criminal proceedings for tax fraud; - subject to the first indent, may not authorize a jurisdiction to which the information is transferred to use it for purposes other than the assessment or collection of the taxes referred to in the treaty, proceedings or prosecutions relating to such taxes, decisions on appeals relating to such taxes, or the control of the foregoing; and - may not authorize a jurisdiction to which the information is transferred to disclose it to a third jurisdiction.
Article 64.2 of the LCA: In exercising the powers referred to in this chapter, the Inspector General and the inspectors shall ensure that the means they use are appropriate and necessary. Decision on the merits 79/2025 — 15/96
I.2.4. The additional investigation by the Inspection Service (IS)
35. On June 24, 2021, the Litigation Chamber requested, pursuant to Article 96.2 of the LCA,
that an additional investigation be conducted by the IS. 36. Upon review of the report of May 26, 2021 (points 32 et seq.), the Litigation Chamber notes a lack of information regarding certain elements raised by the complainants in support of their complaint, including:
- The existence or absence of appropriate safeguards in place with regard to transfers to the United States;
- The existence or absence of further processing for other purposes and the existence or absence of safeguards, if applicable;
- The data retention period, taking into account any further processing, if applicable;
- The precise data communicated and the volume of such data per data subject, as well as the number of data subjects in Belgium;
- The existence or absence of a reciprocity clause and, if applicable, its practical implementation;
- The question of whether a DIA within the meaning of Article 35 of the GDPR has been (or will be) carried out, in what form, and on what date;
- The question of whether the first complainant has filed other appeals with the same or similar subject matter before other bodies (judicial, administrative) since filing their complaint and, if so, what their outcome was. 37. On July 9, 2021, during the investigation, the complainants requested that the IS temporarily suspend
the transfer of data from the "FATCA" reporting for 2020 to
the IRS as a provisional measure taken on the basis of the LCA, until the Litigation
Chamber had made a final decision, and at least until September 30, 2021. The
complainants argued that the transfers complained of, from the moment they took place, risked
causing them serious, immediate, and difficult-to-repair harm. 38. On August 10, 2021, the SI responded to the complainants that the issuance of interim measures is one of the investigative powers granted to it by the LCA and that it is not an obligation but rather a possibility left to its discretion and complete autonomy. The SI also reiterated that, in accordance with Article 64.2 of the LCA, it ensures that useful and appropriate means are used for the purposes of the investigation. It added that it does not receive instructions from anyone regarding the investigative measures to be implemented, thereby rejecting the complainants' request. Decision on the merits 79/2025 — 16/96
39. On September 14, 2021, the IS's supplementary investigation was closed, the report was attached to the
file, which was forwarded by the Inspector General to the President of the Litigation Chamber (Art. 91.1 and 91.2 of the LCA).
40. According to its supplementary report, the Internal Revenue Service notes that there is no evidence
indicating a lack of guarantees regarding the protection of transferred data or a
non-reciprocity of exchanges. The Internal Revenue Service states that it can only note the fairly robust legal framework (these terms being those of the report) governing the transfer of tax data of US nationals by the defendant to the IRS. In this regard, it refers to the description
of the guarantees surrounding said transfers, a description provided by the defendant's Data Protection Officer (hereinafter "DPO"), to the parliamentary proceedings on the Act
22 23
assenting to the "FATCA" agreement, as well as to Articles 3.7 and 3.8 of the agreement itself. The SI also refers to the aforementioned decision of July 19, 2019, of the French Council of State, referred to by
the French sister association of the second complainant, in which the argument based on
24
non-compliance with Article 46 of the GDPR was dismissed. The SI report also reproduces
the evidence provided by the defendant to justify the absence of a DPIA.
I.2.5. Substantive Review by the Litigation Division
41. On January 20, 2022, the Litigation Division decided, pursuant to Article 95.1 1° and Article
98 of the LCA, that complaints No. 1 and No. 2 may be dealt with on the merits. 42. On the same date, the parties were informed by registered mail of the provisions set out in Articles 95.2 and 98 of the LCA. The Litigation Chamber decided, under the terms of this letter, to join complaints No. 1 and No. 2, which relate to the same processing of personal data (data related to the same facts).
Article 3.7. of the FATCA agreement: “All information exchanged shall be subject to the confidentiality and other protections
provided forin theConvention, including theprovisionslimitingtheuseof theinformationexchanged.”
to the Convention on Mutual Administrative Assistance in Tax matters of January 25, 1988.
23Article 3.8. of the “FATCA” agreement: “Following the entry into force of this Agreement, each Competent Authority shall provide
writtennotificationtotheotherCompetentAuthoritywhenitissatisfiedthatthejurisdictionoftheotherCompetentAuthority
has in place (i) appropriate safeguards to ensure that the information received pursuant to this Agreement shall remain
confidential and be used solely for tax purposes, and (ii) the infrastructure for an effective exchange relationship (including
established processes for ensuring timely, accurate, and confidential information exchanges, effective and reliable
communications and demonstrated capabilities to promptly resolve questions and concerns about exchanges orrequests for exchanges and to administer the provisions of Article 5 of this Agreement). The Competent Authority shall endeavor in good faith to meet, prior to September 2015, to establish that each jurisdiction has such safeguards and infrastructure in place.
24
The French Council of State had been petitioned by the French Association of Accidental Americans to annul
for abuse of power the decisions by which its requests for repeal of a decree and its ministerial order organizing the collection and transfer of personal data to the American authorities had been rejected. In its ruling, the French Council of State concluded that, in light of the specific guarantees provided by the FATCA agreement of November 14, 2013 (agreement concluded with France) surrounding the disputed processing and the level of protection provided by the legislation applicable in the United States regarding personal data used to establish the tax situation of taxpayers (the French Council of State refers to the US Federal Data Protection Act of 1974 and the Federal Tax Code), the argument based on infringement of Article 46 of the GDPR and Articles 7 and 8 of the EU Charter of Fundamental Rights must be dismissed (paragraphs 23 et seq. of the ruling). French Council of State, judgment of July 19, 2019, No. 424216
ECLI:FR:CEASS:2019:424216.20190719: https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038801233?isSuggest=true Decision on the merits 79/2025 — 17/96
brought against the defendant and raise the same complaints against it. The
Litigation Division therefore considers them to be so closely linked that it is
in its interest to investigate and decide them simultaneously in order to ensure the
consistency of its decisions.
43. In the same letter, the Litigation Division grants the parties the following deadlines to
come to a conclusion: March 17 and May 16, 2022 for the defendant and April 15, 2022 for the plaintiffs.
44. In support of the complaint and the IS reports, the Litigation Division also identifies the
claims on which it invites the parties to present their arguments:
- The unlawfulness of the data transfers to the IRS by the defendant with regard to Articles
45 and 49 of the GDPR and the lack of a legal basis;
- Failure to comply with the principles of purpose limitation, proportionality, and data
minimization (Article 5.1 b) and c) of the GDPR) as well as a breach of the
principle of data retention limitation (Article 5.1 e) of the GDPR);
- Failure to comply with the principle of transparency and the obligation to provide information (Articles 5.1.
a), 12, and 14 of the GDPR);
- Failure to comply with Article 16 of the GDPR (right of rectification) in that the defendant's procedures did not provide for the data subjects to obtain a correction of their status under the "FATCA" legislation;
- Failure to comply with the obligation to carry out a DPIA within the meaning of Article 35 of the GDPR;
- Failure to comply with Articles 5.2. and 24 of the GDPR, combined with the breaches cited above;
- Failure to comply with Article 20 of the Law of July 30, 2018 (LTD).
45. The Litigation Chamber also invites the parties to submit their submissions on Article 96 of the GDPR, invoked by the defendant in its letter of October 4, 2021 (point 19).
46. On January 31 and February 8, 2022, the defendant requested a copy of the file (Art. 95.2, 3°
LCA), which was sent to it on February 9, 2022.
47. On March 16, 2022, the Litigation Chamber received the defendant's submissions in response.
48. On March 30, 2022, the Litigation Chamber sent an additional request to the
parties regarding the appeal filed by the second plaintiff with the (Belgian) EC regarding
the issue of accidental data transfers from Americans to the United States. (point 19) Without prejudice to the respective jurisdictions of the EC and the DPA, the Litigation Division requests the second complainant to provide information in its future submissions in reply or in a separate document of its choosing, on the subject matter of this appeal to the EC and, if possible, on the timetable for its appeal. The Litigation Division specifies that this information is intended to enable it to assess whether (the outcome of) this appeal is likely to have an impact on the proceedings currently pending before the DPA and/or on its future decision.
49. On April 15, 2022, the Litigation Division received the submissions in reply from the complainants.
50. On May 16, 2022, the Litigation Division received the summary submissions of the defendant.
51. On August 17, 2022, as an exception, the Litigation Chamber authorized the parties to make additional submissions regarding the defendant's reference to the Constitutional Court's decision of March 9, 2017, in its aforementioned summary submissions.
52. On August 17, 2022, the parties were informed that the hearing would take place on September 13.
This hearing was subsequently postponed to November 7, 2022, and then to January 10, 2023.
53. On August 31, 2022, the Litigation Chamber received the plaintiffs' additional submissions regarding the Constitutional Court's decision of March 9, 2017, cited above.
54. On September 21, 2022, the Litigation Chamber received the defendant's additional submissions regarding the same decision. 55. On September 23, 2022, the complainants submitted to the Litigation Chamber 2 documents that they described as "new evidence" in the case. These documents are, in particular,
an opinion dated August 23, 2022, from the Slovak Data Protection Authority (and its
unofficial French translation) relating to the FATCA agreement, concluding that one party's FATCA agreement was non-compliant with the GDPR, as well as the updated report "FATCA legislation and its application at international and EU level – an update" of September 2022
commissioned by the European Parliament.
56. This resulted in an exchange of letters between the parties regarding the admissibility of these documents,
sent outside the deadlines set for the filing of their respective submissions and evidence. 57. On October 3, 2022, the Litigation Division informed the parties that it would give them the
opportunity to comment on these documents at the start of the hearing.
25. According to the complaint form, the complainants were asked to inform the APD of the existence of any complaints filed with other bodies. Since this appeal to the Council of State had not yet been filed at the time the complaint was filed with the APD, the second complainant was asked to inform the Litigation Division about this. Decision on the merits 79/2025 — 19/96
I.2.6. Hearing of the parties on January 10, 2023
58. On January 10, 2023, the parties were heard by the Litigation Division. During
the hearing, and as reflected in the minutes, the Litigation Division indicated
that it was authorized to examine all relevant documents. No document
was excluded from the proceedings provided that the exercise of the defense rights with regard to them
was made possible, either during the hearing or, if necessary, thereafter. The parties
will not return to this point.
59. On January 27, 2023, the minutes of the hearing were submitted to the parties. The Litigation
Division received no comments from the parties on these minutes, with the parties
expressly informing the Litigation Division—on January 29, 2023 (for the plaintiffs) and February 3, 2023 (for the defendant)
respectively—that these minutes reflected
the discussions that took place during the hearing.
I.3. Decision 61/2023
60. On May 24, 2023, the Litigation Chamber, composed of Mr. Hielke Hijmans,
President, Mr. Yves Poullet, and Mr. Christophe Boeraeve, members, adopted
Decision 61/2023.
61. Pursuant to this decision, the Litigation Chamber decides:
- Pursuant to Article 100.1(8) of the LCA, to prohibit the processing by the defendant
of the personal data of the first plaintiff and the Belgian accidental Americans
in accordance with the "FATCA" agreement and the Law of December 16, 2015 regulating the
communication of financial account information by Belgian financial institutions
and the FPS Finance within the framework of an automatic exchange of
information at the international level and for tax purposes.
- Pursuant to Article 100.1, 5° of the LCA, to issue a reprimand to the
defendant with regard to Article 14.1-2 in conjunction with Article 12.1 of the GDPR
accompanied by a compliance order pursuant to Article 100.1, 9° of the LCA
consisting of providing GDPR-compliant information on its website;
- Pursuant to Article 100.1, 5° of the LCA, to issue a reprimand to the
defendant with regard to the violation of Article 35.1 of the GDPR, accompanied by a
compliance order pursuant to Article 100.1, 9° of the LCA
consisting of carrying out a DPIA within the meaning of Article 35 of the GDPR;
- The supporting documents attesting to the ordered compliance measures must be
submitted to the Litigation Chamber within 3 months of the notified decision;
Decision on the merits 79/2025 — 20/96
- Pursuant to Article 100.1, 5° of the LCA, to issue a reprimand to the
defendant for the violation of Articles 5.2 and 24 of the GDPR.
I.4. Appeal against Decision 61/2023 before the Procurement Court
62. By application dated June 14, 2023, the defendant filed an action for suspension and
annulment of Decision 61/2023 with the Procurement Court. The APD is the defendant
in this appeal. 63. On June 27, 2023, the plaintiffs filed an application for voluntary intervention.
64. In its defense before the Market Court, the APD developed various grounds, in support of which it requested the Court to declare the defendant's appeal admissible but unfounded.
65. It also invited the Court, insofar as it has any doubts about any of the points raised, to refer the following questions to the CJEU for a preliminary ruling:
- 1°) "Can national legislation approving an international agreement between a Member State and a third country constitute a 'public interest' within the meaning of Article 26, §1,
d) of Directive 95/46/EC if that third country does not guarantee effective reciprocity?";
- 2°) "Does the transfer of personal data to the tax authority of a
third country under national legislation approving an international agreement between
the Member State in question and that third country violate Article 6, §1, b) of Directive
95/46/EC to the extent that the purposes of the processing of personal data, as set out in the agreement in question, are expressed in
vague terms, such as "compliance with international tax rules" or "implementation of obligations under the US "FATCA" law aimed at combating
tax evasion by US nationals?";
- 3°) "Does the transfer of personal data to the tax authority of a
third country under national legislation approving an international agreement between
the Member State in question and that third country violate Article 6, §1, b) of Directive
95/46/EC to the extent that the third country has not implemented adequate safeguards
to prevent the data in question from being used for purposes other than those
stipulated in the agreement?" - 4°) "Does the transfer of personal data to the tax authority of a
third state under national legislation approving an international agreement between
the Member State in question and that third state violate Article 6, paragraph 1, c) of Directive 95/46/EC
to the extent that the national legislation and the international agreement in question do not
contain provisions and criteria that establish an explicit link between the substantive Decision 79/2025 — 21/96
communication of personal data concerning financial accounts and
possible tax fraud or evasion?" - 5°) "Does the transfer of personal data to the tax authority of a
third country under national legislation approving an international agreement between
the Member State in question and that third country violate Article 6, paragraph 1, e) of Directive 95/46/EC
to the extent that there are no adequate safeguards in place to preventThe
data in question are not retained longer than necessary to
fulfill the intended purposes once the data are transferred to the tax authority
of that third state?
- 6°) "In the event of an international agreement between a Member State and a third state
concerning the transfer of personal data to the tax authority of that third state,
must the "sufficient guarantees" within the meaning of Article 26, §2 of Directive
95/46/EC be included in the international agreement itself?";
- 7°) "Can Article 96 of Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), taken alone
or in conjunction with Article 4(3) of the Treaty on European Union and/or
Article 351 of the Treaty on the Functioning of the European Union, be interpreted
as meaning that Member States are obliged to use their best efforts to
amend, replace, or revoke international treaties to which they are party that
do not comply with the provisions of this regulation?
- If so, can a Member State that, in 2023, has not made its
best efforts to amend, replace, or revoke an international treaty to which
it is a party, which does not comply with the provisions of Regulation (EU) 2016/679,
rely on Article 96 of that regulation to justify conduct incompatible with
that regulation?
I.5. The Procurement Court's judgments of June 28 and December 20, 2023
66. On June 28, 2023, the Procurement Court delivered an interlocutory judgment (2023/AR/801)
in which it suspended the execution of Decision 61/2023 of the Litigation Chamber with immediate effect, until it rules on the merits of the action for annulment brought.
26Pursuant to Article 108.1, paragraph 2 of the LCA, the decisions of the Litigation Chamber are, with some exceptions, provisionally enforceable: "Except for the exceptions provided for by law or unless the Litigation Chamber decides otherwise
by a specially reasoned decision, the decision is provisionally enforceable, notwithstanding any appeal. The decision to erase data in accordance with Article 100, § 1, 10°, is not provisionally enforceable." Decision on the merits 79/2025 — 22/96
67. On December 20, 2023, the Procurement Court issued a judgment (2023/AR/801) in which
it annulled decision 63/2021 of the Disputes Chamber and ruled that the
case was referred back to the Disputes Chamber "in a different composition" for it to rule
again, with reasons, on the merits, taking into account the considerations
developed in its judgment.
68. With regard to these considerations, the Procurement Court criticized the Disputes Chamber
for not having provided sufficient reasons for its decision, in violation of Articles 2 and 3 of the Law of
July 29, 1991 on the formal justification of administrative acts. More specifically, the
Court of Procurement states that this requirement for reasons was not met since
"there is no indication that the said decision took into account the reports of the General Inspectorate and the specific analysis carried out by that department; it does not provide reasons for
departing from the findings made therein with regard to the lawfulness of the data processing
by the FPS Finance" (paragraph 35 of the judgment). The Court thus explains that
the Litigation Chamber's sovereign assessment must be accompanied by a duty to
provide enhanced reasons when it departs from the findings of the Information System. Since the Litigation
Chamber has requested an investigation report, the parties involved can legitimately
expect that this report will be taken into account by the Litigation
Chamber in its assessment. Consequently, the Litigation Chamber must provide reasons
for not following the findings or conclusions of the SI (paragraph 30 of the judgment).
69. The Market Court specifically points out the following:
- As for compliance with the principle of finality, the decision is based solely (§ 164) on a
passage from the Article 29 Working Party's WP 234 report and on a legal article
written by the President of the Litigation Chamber himself on the subject of an analysis by the
CJEU, i.e., on general and theoretical references. In doing so, Decision 61/2023
disregards the specific analysis carried out by the Internal Audit Office, which noted (1) that the CPP had
in its two opinions been able to assess the legitimacy of the tax purposes and the
necessity of the transfer of data to third countries due to an important public interest
of Belgium and in view of the reciprocity of exchanges; (2) that the CSAF had
similarly authorized the defendant to transmit the requested data to the IRS and
was able to assess, on this occasion, the admissibility of the tax purposes of the processing, the
proportionality of the data processed, and the security of the processing; and (3) that
pursuant to Article 111(1) of the LCA, the authorizations granted by the sectoral committees of the CPP retain, in principle, their legal validity. - In its examination of the principles of necessity and minimization, the Court also points out
the overly general nature of the European sources (opinion of Group 29,
study of the European Parliament) used by the Litigation Chamber. It concludes that
the latter failed to take into account the analysis carried out by the IS, which noted that both Decision on the merits 79/2025 — 23/96
CPVP and the SCAF had favorably assessed the necessity and proportionality
of the data transfers. The Court is also of the opinion that the decision also fails
in view of the specific answers provided by the defendant's DPO to
questions 6, 7, and 8 in the IS's supplementary report, specifically relating
to the specific assessment of the principle of data minimization. - Finally, regarding the rules governing the transfer of data to the IRS, the Market Court notes that with regard to the "appropriate safeguards" provided for in Article 46.2(a) of the GDPR, Decision 61/2023 considers that these must be included in the international agreement itself and examines them in light of EDPB Guidelines 02/2020. In doing so, the Court notes that the Litigation Chamber
fails to take into account the safeguards identified by the SI, in particular in its supplementary report, arising from the fact that:
o Article 3.7 of the FATCA agreement refers to the "confidentiality obligations and other safeguards" provided for by the OECD Multilateral Convention (Articles 21 and 22 – page 3/22 of the SI supplementary report;
o Article 3.8 of the FATCA agreement provides that each competent authority
must notify the other in writing when it is satisfied that the latter has implemented appropriate safeguards (page 3/22 of the SI supplementary report);
o The responses provided by the DPO of the FPS Finance to questions 1 to 4 posed
by the SI regarding the safeguards implemented, and in particular the notification
made by the Belgian tax authorities to the US tax authorities regarding the implementation
of guarantees (answer to question 2).
70. As for any questions referred for a preliminary ruling, the Court states in the operative part of its judgment that
"at this stage, there is no need to refer questions to the Court of Justice for a preliminary ruling"
(page 52 of the judgment).
I.6. Background to the resumption of proceedings leading to the present decision
I.6.1. The decision of 20 March 2024 on the composition
71. Following the Market Court's judgment of 20 December 2023, the President of the Litigation Chamber, H. Hijmans, 27, decided on 20 March 2024 to entrust the resumption of proceedings
in this case to a bench composed of the following three members: Yves Poullet as
President of the bench, Christophe Boeraeve, and Jelle Stassijns.
27The Litigation Chamber refers to the president appointed by the House of Representatives pursuant to Chapter 3 of the LCA, more specifically Article 39. Decision on the merits 79/2025 — 24/96
72. This decision is based on Article 43 of the RoI of the APD 28, which empowers the
president of the Litigation Chamber to allocate cases among its members and to
decide whether, in a given case, the Litigation Chamber shall sit with three members.
73. This decision is justified as follows:
- "fundamental principles of personal data protection are
at stake, such that the case must be heard by a bench composed of three members":
Note that the term "fundamental principles of personal data protection" refers specifically to Article 43 of the RoI;
- the language of the proceedings in this case is French: in accordance with the
principles of good administration and in the spirit of the legislation relating to the use of
languages, it is preferable that the majority of the bench, including its president, be
part of the French-speaking linguistic role of the Litigation Chamber;
- one of the French-speaking members has – or may be perceived as having – a conflict
29
of interest within the meaning of Article 58 of the Rules of Procedure of the APD.74. In support of these elements, President H. Hijmans concludes that the renewal of the composition of the Disputes Division can, of necessity, only be partial.
I.6.2. Resumption of the examination of the merits
75. On May 30, 2024, the Disputes Division notified the parties of the resumption of the examination of the merits of the complaint and sent them an invitation to submit submissions regarding the grievances listed below. She reiterates the consolidation of complaints No. 1 and No. 2, which she effected
by her letter of January 20, 2022. The final schedule for the exchange of arguments between the parties
is set, after modification by email of June 11, 2024, as follows: August 7 and October 4, 2024,
for the defendant and September 5, 2024, for the plaintiffs.
28
Art. 43 of the RoI: The cases referred to the Litigation Division are allocated by its president among the members of the Litigation Division. The member assigned the case sits alone. The Litigation Division sits with three members if the president so decides. He makes this decision taking into account the nature of the complaint and the violation of the fundamental principles of personal data protection. In view of the circumstances described in the preceding paragraph, the member to whom a case is assigned may, however, request the President to sit with three members. The President shall ensure assistance by appointing officials from the APD administration, who are part of the secretariat of the Litigation Chamber.
Article 58 of the Royal Decree states that the President of the Litigation Chamber has the authority to decide whether a member of the Litigation Chamber has a conflict of interest. Conflict of interest is further defined as follows: "A conflict of interest arises when the impartial and objective exercise of the function/mandate or compliance with the principles of fair competition, non-discrimination, and equal treatment is compromised due to a shared interest with a person or body mentioned in the file to be examined."
30
This email follows a request by the defendant to modify the deadlines. However, the Litigation Chamber did not grant the defendant's request to organize only one round of submissions, beginning with the plaintiffs and closing with the defendant. Decision on the merits 79/2025 — 25/96
76. The complaints against which the parties are invited to defend themselves are identical to those formulated
by the Litigation Chamber in its letter of January 20, 2022 (points 41 et seq.), with the exception
of the complaint alleging non-compliance with Article 20 of the LTD, in respect of which the Litigation
Chamber invites the parties to defend themselves "insofar as this complaint is maintained by the
complainants, the latter having abandoned it during the exchange of submissions leading
to Decision 61/2023 of the Litigation Chamber, annulled by the Market Court."
77. The Litigation Chamber also invites the parties to clarify the applicability of
Article 96 of the GDPR and the existence of appropriate safeguards in place
with regard to data transfers to the IRS, indicating the precise provisions
on which they are based, whether they are based on provisions of Directive
95/46/EC, the GDPR, or other texts applicable at the time of the alleged facts or
currently.
78. Finally, the Litigation Chamber specifically invites the parties to take into account in
their respective arguments the considerations made by the Market Court in its
annulment judgment of December 20, 2023 with regard to the findings made by the SI, in particular
those highlighted by the Court in paragraph 34 of its judgment.
79. On May 30, 2024, the plaintiffs notified the Litigation Division that they wished to be heard
following the exchange of submissions pursuant to Article 98 of the LCA
in conjunction with Articles 48 to 54 of the RoI of the APD.
80. On August 5, 2024, the Litigation Division received the defendant's main submissions.
81. On September 3, 2024, the Litigation Division informed the parties of the decision taken
on March 20, 2024, by Mr. Hielke Hijmans regarding the renewed composition of the
Litigation Division, referred to in point 72.
82. On September 5, 2024, the Litigation Division received the plaintiffs' submissions.
- The plaintiffs note that the Disputes Chamber is differently composed
as requested by the Market Court in its judgment of December 20, 2023.
- The plaintiffs state that the banks are not parties to the case (see the defendant's criticism in this regard below) not "due to a conflict of interest with the plaintiff's counsel" but because they are not the financial institutions that are
data controllers with regard to the processing consisting of transferring personal data to the IRS.
- As for Article 96 of the GDPR, the complainants consider that the conditions for its application are not met and that none of the texts put forward by the defendant
in an attempt to demonstrate that the FATCA agreement complies with EU law (Decision on the merits 79/2025 — 26/96
applicable on May 24, 2016) withstands analysis, nor, in particular, the primacy that should be given to the case law of the CJEU in its judgment C-175/22.
- The complainants consider that the FATCA agreement does not contain the minimum guarantees
required by Article 46.2. a) of the GDPR. They also emphasize that, in light of
Article 49.1(d), initially invoked by the defendant, it can be applied
in this case. - The plaintiffs also argue that the defendant is not fulfilling its
information obligation, in violation of Article 14 of the GDPR and the principle of
transparency.
- The plaintiffs consider that the defendant violated
Article 35 of the GDPR by not carrying out a DPIA.
- The plaintiffs also consider that Articles 5.2 and 24 of the GDPR were violated
in this case.
83. On October 4, 2024, the Litigation Chamber received the defendant's additional submissions,
serving as summary submissions. The defendant having filed second
additional submissions serving as summary submissions, the summary of its arguments
is set out below in point 86.
84. On October 18, 2024, the Litigation Division addressed the parties, noting that the defendant's
additional and summary submissions contained a number of requests addressed directly to the plaintiffs and their counsel. In order to
have a ready-made file, the Litigation Division decided to grant the plaintiffs a
final deadline of November 4, 2024, to respond. It added that if the plaintiffs
were to respond, the defendant would be granted an equal period for a final reply.
85. On November 4, 2024, the plaintiffs filed additional submissions.
86. On November 19, 2024, the Litigation Division received the defendant's second
additional submissions serving as summary submissions.
- The defendant contests the "different composition" of the Litigation Chamber
as requested by the Market Court in its judgment of December 20, 2023.
- The defendant requests that the case be stayed pending the intervention
of the financial institutions in the proceedings. According to the defendant, their absence constitutes a violation
of the principle of equality enshrined in Articles 10 and 11 of the Constitution, since neither the
defendant nor the APD are authorized to compel them to intervene in the case, even though
31The defendant requests the production of specific documents (see below). It also requests that the plaintiffs' counsel withdraw their representations given their conflict of interest. Decision on the merits 79/2025 — 27/96
even though they play an essential role in the processing chain leading to the disputed transfers to the IRS.
- The defendant requests the production by the plaintiffs of the CNIL's decision of
May 23, 2022, by which the latter closed a complaint similar to the one leading
to this decision. As will be explained in paragraph 91, this document was produced on
November 29, 2024, by the plaintiffs.
- The defendant considers that the conditions of Article 96 of the GDPR are met and
that the "FATCA" agreement, read in conjunction with the Law of December 16, 2015, from which it is
inseparable, complies with EU law applicable on May 24, 2016. The disputed transfers
to the IRS, for which it does not deny that it is the data controller, are therefore
not tainted by any unlawfulness and may proceed. - The defendant argues that, without prejudice to the application of Article 96 of the GDPR,
the "FATCA" agreement complies with the GDPR and that, based on it and the Law of December 16, 2015, transfers to the IRS are lawful.
- The defendant denies any failure to comply with the information obligation that, according to it, is imposed on banks. It nevertheless adequately informs the data subjects
via its website.
- The defendant is of the opinion that it was not required to carry out a DPIA given
the preliminary analysis it had conducted.
- The defendant considers that it has not violated the principle of accountability enshrined
in Articles 5.2 and 24 of the GDPR.
I.6.3. Invitation to the hearing and hearing of the parties
87. On November 28, 2024, the parties were informed that the hearing was scheduled for December 11,
2024.
88. The Litigation Division stated in its invitation letter that it had granted the complainants' request for a hearing and had therefore summoned the parties. The Litigation Chamber
therefore does not grant the defendant's request in point 75
of its second additional submissions, which constitute summary submissions, to dismiss the
plaintiffs' request to be heard on the grounds that such a hearing would be pointless since
the Litigation Chamber remains composed of two members, including the acting
president, who attended the hearing on January 10, 2023, as part of the phase of the
proceedings that led to Decision 61/2023.
89. The Litigation Chamber adds that, on the date of dispatch and given the state of the file, it
also does not grant the defendant's request to stay the case pending the intervention of the financial institutions
Decision on the merits 79/2025 — 28/96
also made in the operative part of its
second additional submissions, which constitute summary submissions. The Litigation Chamber
notes that as of the date of the invitation, the financial institutions were neither parties nor intervened in the proceedings.
90. Finally, regarding the defendant's request to stay the case pending
production by the plaintiffs of the decision rendered by the President of the CNIL on May 23,
2022, the Litigation Chamber notes that in response to the request made to them to this effect by the defendant in its additional and summary submissions of October 2,
2024, the plaintiffs stated that they did not hold this decision nor were they its
recipients. The Litigation Chamber notes more broadly that the documents requested
by the defendant in its submissions were not produced by the plaintiffs
at the end of the supplementary schedule for the exchange of submissions provided for this purpose. Without granting, on the date of its submission and given the status of the file, the defendant's request for a stay of proceedings on this ground, the Litigation Division granted the complainants a final deadline for the production of documents until December 5, 2024,
considering that it must have all the documents potentially relevant to the resolution of the dispute (or at least cannot be deprived of them).
91. On November 29, 2024, the complainants produced the decision of the President of the CNIL dated May 23, 2022.
92. On December 11, 2024, the parties were heard by the Litigation Division. At the end of
the hearing, the Litigation Division decided to continue the case pending
the production by the defendant of the "Notification of adequacy of data
safeguards and infrastructure" document signed by both the defendant and the IRS. Indeed, the said
document submitted to the defendant's case file only bore the signature of the Belgian
authorities dated January 10, 2017. The Litigation Division indicated that the case would be taken
under deliberation once the document is received.
93. On December 17, 2024, the defendant produced the copy signed by both parties (the IRS
on the one hand and the defendant on the other) of the "Notification of adequacy of data
safeguards and infrastructure" referred to above.
94. On December 24, 2024, the minutes of the hearing are submitted to the parties. The parties
both notify the Litigation Chamber (respectively on January 20, 2025 for
32This decision declares the closure by the French National Commission for Information Technology and Civil Liberties (CNIL), the French data protection authority, of the complaint filed by the French Association of Accidental Americans seeking the suspension of automatic transfers of tax data between France and the United States pursuant to the international agreement concluded on November 14, 2013, between the Government of the French Republic and the Government of the United States of America (the "FATCA agreement"). The CNIL states that the French Council of State has already ruled on the issue in a ruling dated July 19, 2019 (see above note 24), in which it concluded that the "FATCA" agreement is compatible with the GDPR. The CNIL states that
after having studied the arguments of the complaint, it appears to him that nothing authorizes him to challenge the position established by the French Supreme Administrative Court. Decision on the merits 79/2025 — 29/96
the defendant and January 23, 2025 for the complainants) that these minutes of the hearing
require no comment from them.
II. Grounds
II.1. Regarding the jurisdiction of the Litigation Chamber of the DPA
95. The GDPR has, in particular, entrusted EU data protection authorities ("supervisory authorities") with the task of handling complaints submitted to them (Article 57.1.f) of the GDPR).
96. When handling complaints, data protection authorities must contribute to the consistent application of the GDPR throughout the EU.
97. In this case, the one-stop shop mechanism provided for in Article 56 of the GDPR does not apply, given Article 55.2 of the GDPR, which provides that "where processing
is carried out by public authorities or private bodies acting on the basis of
points (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases, Article 56 shall not apply."
98. The complaint submitted for review by the Litigation Chamber concerns the
communication (transfer) (i.e., processing within the meaning of Article 4.2 of the GDPR) of personal data
(within the meaning of Article 4.1 of the GDPR) by a Belgian public authority (the
defendant) to a foreign public authority (the IRS) pursuant to the "FATCA" agreement
and the Belgian Law of December 16, 2015.
99. Thus, when it comes to assessing the compliance of a bilateral intergovernmental agreement
with data protection rules, even if this agreement is similar in its
content to other bilateral "FATCA" agreements signed by the United States with other
EU Member States, the DPA has sole jurisdiction pursuant to Article 55 of the GDPR
and Article 4 of the LCA. The same applies to any other EU data protection authority referred to the same matter.
100. Contrary to what is provided for when the one-stop-shop mechanism applies, in this case, the
EU data protection authorities do not have the right to review the
draft decision of the DPA (Article 60.1-3 of the GDPR). In the event of divergent views regarding
the application of the GDPR, no relevant and reasoned objection within the meaning of Article 60.4 of the GDPR may be raised by another data protection authority against
the draft decision of the DPA, and no binding decision 33 taken pursuant to
Article 65.1 of the GDPR: In order to ensure the correct and consistent application of this Regulation in individual cases, the
Board [read: European Data Protection Board – EDPB] shall adopt a binding decision in the following cases:
Substantive Decision 79/2025 — 30/96
Article 65 of the GDPR by the European Data Protection Board (hereinafter
"EDPB") shall not be issued in the event of disagreement between data protection authorities
regarding the application of the GDPR to the individual case. This observation applies to the DPA's decision
but also to decisions that have been taken or will be taken in the future by
other EU data protection authorities on this same issue.
101. The EDPB's powers also include issuing opinions on the basis of
Article 64-2 of the GDPR. However, the request for such an opinion must relate to a question
of general application and not to a specific case/processing.
102. The inapplicability of the one-stop shop mechanism and the EDPB's lack of jurisdiction
to decide the question of the compliance of the "FATCA" agreement with the applicable data protection
regulations in the EU does not, however, exempt
the DPA, quite the contrary, from applying the GDPR as consistently as possible.
103. To this end, the Litigation Chamber will pay the utmost regard to the relevant judgments of the
CJEU. 104. The Litigation Chamber will also take the utmost account of the relevant Guidelines
and opinions adopted and made public by both the Working Party 29 and the EDPB, of which
it was/is a member and in whose adoption it participated as an (administrative) data
protection authority. With regard to the EDPB, it is clear from the tasks entrusted to it under Article 70 of the GDPR that it has an essential role to play with regard
to the consistent application of the rules laid down by the GDPR with regard to transborder data
flows, particularly through the adoption of Guidelines (see also recital
139). 35 Admittedly, the EDPB Guidelines are not legally binding, at least not for their addressees. However, they are binding on the data protection authorities that adopted them, which may not depart from them without a clear reason, without creating legal uncertainty for their recipients, both for data subjects and for data controllers who have complied with them (depending on the position of the data protection authorities under whose supervision, without prejudice to the jurisdiction of the courts, these...)
(a) where, in the case referred to in Article 60(4), a relevant supervisory authority has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not pursued the objection or has rejected the objection on the grounds that it is not relevant or not reasoned. The binding decision concerns all the issues that are the subject of the the relevant and reasoned objection, including whether there is a violation of this Regulation;
34Article 64.2 of the GDPR: Any supervisory authority, the Chair of the Board [read the European Data Protection Board – EDPS], or the Commission may request that any matter of general application or producing effects in several Member States be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority fails to comply with the obligations relating to mutual assistance under Article 61 or the obligations relating to joint operations under Article 62.
35See in this regard, in addition to the reference to its role in advising the European Commission regarding the level of protection in third countries, subparagraphs c), i), j) and s) of Article 70 of the GDPR, as well as Article 64 e) and f) of the GDPR, which all specifically relate to the role of the EDPB with regard to such flows. Decision on the merits 79/2025 — 31/96
controllers are subject). The Litigation Chamber must therefore invoke them when it considers them relevant to the complaint before it here. The same applies to the opinions of Group 29. 36
105. The Litigation Chamber adds that it is aware that other data protection authorities
as well as other administrative courts, appeal bodies of said data protection authorities, where applicable, have already ruled, in varying ways,
on the same issue of the transfer of personal data to the IRS in
execution of "FATCA" agreements. Since each data protection authority
remains exclusively competent, it assesses, in complete independence, the merits of
the complaint submitted to it and is not bound by the positions taken by its European
counterparts solely on the grounds that the latter have previously received similar
complaints. As already mentioned, consistency must nevertheless be sought.
106. In this regard, and even though it will rely on the judgments of the CJEU and the Guidelines
adopted by the European data protection authorities under the aegis of the Group
29 and the EDPB, the Litigation Chamber adds, to the extent necessary, that it is not
authorized to refer preliminary questions to the CJEU (Article 267 TFEU) even if it were
to consider, as it did in its first decision, that an interpretation of a provision of the GDPR adopted by the
CJEU is necessary for the resolution of the dispute before it
and to avoid divergent applications of the GDPR in the light of similar complaints.
II.2. Regarding the composition of the Litigation Chamber
107. As explained in paragraph 71, the President of the Litigation Chamber, H. Hijmans,
adopted a decision on 20 March 2024 regarding the composition of the Litigation Chamber
for the resumption of the case, on the basis of Article 43 of the RoI.
36
Article 30.1(a) of Directive 95/46/EC entrusted the Article 29 Working Party (Working Party 29) with the task of examining any question
concerning the implementation of national provisions adopted pursuant to this Directive, with a view to contributing to their uniform implementation. Pursuant to Article 30.1(b), Working Party 29 was responsible for providing an opinion to the European Commission on the level of protection in third countries. 37The Litigation Division communicated the decision of March 20, 2024, to the parties on September 3, 2024. The Litigation Division considers that it cannot be criticized for not having communicated this decision until that date. It is not required to communicate the composition of its bench to the parties in advance, and the document was included in the procedural file, which the parties could request, as indicated in the Litigation Division's letter of May 30, 2024. In any event, assuming, quod non, that it would have been required to do so, the failure to communicate this decision to the parties by May 30, 2024, has no impact on its validity. Decision on the merits 79/2025 — 32/96
108. This decision was taken by President H. Hijmans in accordance with Article 43 of the Royal Decree, the 38th LCA referring in Article 33.2 to the Royal Decree for all matters relating to the composition of the Litigation Chamber.
109. As for this composition, the Litigation Chamber notes that the defendant is of the opinion
that the two members who had already sat at the time of the adoption of Decision 61/2023 have a conflict of interest, that they comprise the majority of the renewed bench, and that one of them (Mr. Y.
Poullet) is now also chairing it, which is all the more questionable. The
defendant adds that the appointment of the President is also a privilege of the
House of Representatives. In summary, the defendant considers that this composition, which
includes only one new member, does not meet the condition of a "Litigation Chamber differently composed" set out by the Procurement Court in its judgment of December 20, 2023, and is also contrary to the principle of impartiality.
110. In the operative part of its second additional submissions, which constitute summary submissions, the
defendant thus requests the Litigation Chamber to "declare that Mr.
Yves Poullet has not demonstrated the powers he claims, that the Litigation Chamber
does not comply with the Procurement Court's judgment of December 20, 2023, in that it is not differently composed, and that Mr. Yves Poullet must withdraw." It requests that
the case be "re-settled with a Litigation Chamber differently constituted."
111. As for the complainant, he concludes that the Litigation Chamber is indeed "differently
composed" in accordance with the Market Court's request and defers to the
jurisdiction of the Litigation Chamber in this regard.
112. As stated in the decision of March 20, 2024 (paragraphs 71 et seq.), the composition of
the Litigation Chamber for the resumption of this case is based on a number of
considerations, which are explained below.
113. Regarding the decision to have a three-member panel: GDPR compliance of transfers of personal data carried out by a public administration pursuant to an intergovernmental agreement governing the automatic exchange of information in tax matters concluded with the United States is an important issue, as it concerns the protection of personal data transferred to a country outside the European Union and which is also in a context linked to the public interest of the State, as the Court of Markets emphasized in its judgment of June 28, 2023. This issue, as provided for in Article 43 of the RoI cited above, justified the initial three-member panel. The first decision
having been adopted with such a seat, it did not appear appropriate to the President (H. Hijmans)
Article 33 of the LCA: 1. (…) The President or one of the members of the Litigation Chamber shall hold a session as a sole member unless the President of the Litigation Chamber decides to sit with three members in accordance with the provisions of the Rules of Procedure. § 2. For all other matters, the Rules of Procedure shall specify everything concerning the composition of the Litigation Chamber during sessions and its working methods. Decision on the merits 79/2025 — 33/96
of the Litigation Chamber to reduce its seat to a single member. This composition of
39
3 members is in line with the practice of the Litigation Chamber (based on its Rules of Procedure
as just recalled), which is, with rare exceptions, to hear cases on their merits, i.e., those that present significant stakes and require the exchange of submissions, with
40
a bench of 3 members.
114. Even assuming that the Litigation Chamber had deviated from its practice and opted for a
single-member bench, this member would necessarily have had to belong to the French-speaking
language role of the Litigation Chamber, since the language of the proceedings in this case was
French (see below). Two scenarios would then have arisen: (1) since the only French-speaking member who was not sitting at the time of the adoption of Decision 61/2023 had a conflict of interest or could be perceived as such (see below), one of the two French-speaking members who had already sat would have sat alone; or (2) since President H. Hijmans was the only member of the Litigation Chamber considered bilingual or not belonging exclusively to one linguistic role or the other, the only alternative would have been to retain President H. Hijmans sitting alone. These options would therefore not have complied with the condition set by the Market Court of a "differently composed Litigation Chamber," since in either case, the member sitting alone would have already been sitting at the time of the adoption of Decision 61/2023. 115. As for the language of these proceedings, it is not disputed that it is French.
The complaint was filed in French (the documents submitted in support of it, including
the correspondence exchanged with the defendant, were also in French) and this resulted
in correspondence from the Litigation Chamber in French, an investigation by the IS in French,
and submissions filed by each party in French. The parties
also spoke in French during the hearings, and Decision 61/2023 was
adopted in French as well.
116. Regarding the decision to maintain a bench composed predominantly of 42 French-speaking members (i.e., 2 out of 3), the Litigation Chamber, in compliance with the principle of legal certainty, followed the practice to which it had adhered until then and to which it
39This practice is known to the public since the decisions of the Litigation Chamber are published on its website, and decisions on the merits can also be selected based on search criteria based on the type of decision.40
Decisions on the merits are those which, unlike those adopted pursuant to Article 95.1 of the LCA, involve the parties in an exchange of submissions and which may impose the corrective measures and sanctions identified in Article 100.1 of the LCA, i.e., all the corrective measures and sanctions provided for by the GDPR, including a processing ban, a reprimand, or a fine, whereas pursuant to Article 95.1 of the LCA, the corrective measures and sanctions that may be imposed are limited.
41
Article 40.1, paragraph 1 of the LCA: "The management committee shall have as many French-speaking as Dutch-speaking members, with the exception of the President of the Litigation Chamber." 42
Article 40.1, paragraph 4 of the LCA: "The six members of the Litigation Chamber shall be appointed in equal numbers by language role, and at least one member must have a working knowledge of German." These six members (three belonging to the French-speaking language role, three to the Dutch-speaking role) do not include the presiding judge. Decision on the merits 79/2025 — 34/96
43
had publicly committed to this in its Note on Language Policy.
This practice consists of assigning the case to a bench composed predominantly of members
belonging to the language role of the language of the case in the case of a three-member bench, the
presiding judge being considered—as already mentioned—as not belonging
specifically to either or both of these roles. The Litigation Division made this
Note public on its website from January 1, 2021, to December 17, 2024. 44. At the time
of the decision of March 20, 2024, relating to the renewed composition of the Litigation
Division in this case, this note had therefore been publicly available for more than
three years already. The President of the Litigation Division (H. Hijmans) applied its
content reproduced below, considering that there was no evidence justifying
departure from it. 45
117. The application of the RoI on this point thus offers, in the event of proceedings in French
as in this case, the following possibilities:
- either the Litigation Division is composed of President H. Hijmans (bilingual), a French-speaking
member, and a third member either French-speaking or Dutch-speaking
(option 1);
43
https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-politique-linguistique-de-la-chambre-
litigation.pdf
44This note has today been removed from the APD website taking into account judgment 144/2024 of the Constitutional Court of
November 28, 2024 (roll number 8110: In zake: de prejudiciële vragen betreffende article 57 van de wet van 3 december 2017 «
tot oprichting van de Gegevensbeschermingsautoriteit”, gestureld door het Hof van Beroep te Brussel.
45See the judgment of the Market Court of March 19, 2025 (2024/AR/ 1690): In this judgment, the Market Court criticizes
in the House Dissatisfied with not having followed her own policy note that she had published on her website. In this
senslaCourcrit“die(readdebestredenbeslissing)derhalvenietinlijtismetdeeigenbeleidsnotadiedeGBAophaarwebsite
vermeldt” (Free translation: this decision is therefore not in accordance with the first policy note that APD published on its website
web). The Court adds “Aansluiting kan hier worden gezocht bij rechtspraak van de Raad van State die stelt dat de
rechtszekerheidsbeginsel vereist dat een administratieve overheid (zoals de GBA) neet zonder objectieve en redelijke
verantoording mag afwijken van haareigen beleidslijnen die zij bij de toepassingvan de Regulations Act” (point 22)
(Free translation: here, one can align with the case law of the Council of State, which stipulates that the principle of legal certainty requires that an administrative authority (such as the DPA) cannot deviate from its own policies in the application of regulations without objective and reasonable justification). Decision on the merits 79/2025 — 35/96
- either the Litigation Chamber is composed, in the absence of President H. Hijmans, of
two French-speaking members and a third member, either French-speaking or
Dutch-speaking (option 2).
118. The application of these two scenarios led in this case, given the conflict of interest
(or the perception of such a conflict) on the part of the third French-speaking member of the
Litigation Chamber, the only one not to have sat at the time of the adoption of Decision 61/2023
(paragraphs 73 and 122), to the following options:
- a Litigation Chamber composed of President H. Hijmans, who had already sat in
Decision 61/2023, a French-speaking member who had already sat in Decision 61/2023
and a third new member: or a seat composed of two members who had already
sat, including President H. Hijmans (option 1);
- a Litigation Chamber composed of two French-speaking members who had already
served in Decision 61/2023 and a third new member, necessarily Dutch-speaking, with any third French-speaking member being excluded due to a conflict
of interest: or, as in Option 1, a bench composed of two members who had already
served, but without President H. Hijmans (Option 2).
119. In the absence of any specific provision to this effect, President H. Hijmans chose to
withdraw. This decision, apart from being within his discretionary power, is no more
objectionable than the decision to continue sitting. Therefore, Option 2 was adopted, which led, as would have been the case in Option 1, to a
necessarily partial renewal of the composition of the bench of the Litigation
Chamber.
120. Regarding Mr. Y. Poullet's capacity as President in the renewed composition, the Disputes Chamber is of the opinion that, following the defendant's criticism,
that the function of President is the privilege of the House of Representatives, the composition of the Chamber should always include President H. Hijmans. This position
is untenable, as the President may be unable to act or be absent, situations which are, moreover,
provided for by both the RoI6 and the Language Policy Note cited above.
121. As for the fact that it is indeed a member who previously sat who now presides
over the bench (Mr. Y. Poullet), the Disputes Chamber has also followed its
Note on Language Policy. It follows that the presidency of the bench
falls either to the bilingual President H. Hijmans, or, in his absence, to a member belonging
46
See Article 44 of the RoI. : "In the event of absence or incapacity, the President of the Litigation Chamber shall be replaced,
when required to sit, by another member designated for this purpose."
47 The excerpt from the Language Policy Note of the Litigation Chamber cited in point 117 above explicitly states: "If the President is not sitting, (…). Decision on the merits 79/2025 — 36/96
to the language list in which the case is being heard. Since the language of the proceedings in
this case is French, the presidency of the renewed seat therefore falls to a French-speaking
member – who has already sat for the reasons just explained in this regard.
122. As for the conflict of interest of the only French-speaking member who did not sit on the
adoption of Decision 61/2023, the Litigation Chamber specifies that this prerogative
to dismiss one of the members of the Litigation Chamber on grounds of conflict of interest
is vested in the President of the Litigation Chamber (Article 58 of the aforementioned RoI).
123. In conclusion, since the Litigation Chamber only has two French-speaking members
who could potentially sit on the bench - those who had already sat on the adoption of Decision
61/2023 - President H. Hijmans had no choice, in accordance with the provisions of the LCA, the RoI
and the Litigation Chamber's Language Policy Note, but to appoint them, as they were essential for the Litigation Chamber
to be "otherwise composed" of three members, including two French-speaking members, the language of
the proceedings being French. A third member, necessarily Dutch-speaking, has been added to the bench.
124. As stated in the decision of March 20, 2024, it follows that the change in the seat
49
of the Litigation Chamber adopting this decision is necessarily partial
and that it cannot be criticized for not having complied with the Procurement Court's request
for a "Litigation Chamber with a different composition."
125. The Litigation Chamber adds that in any event, and without prejudice to the
above, when they sit as a group of three, the members - against whom in this case no concrete complaint of a
lack of impartiality is raised - adopt a collective decision. This collegiality
meets the Procurement Court's requirement to base the decision on strong reasons, and
nowhere is it provided that the presiding judge has the casting vote.126. Therefore, in support of the foregoing, there is no reason to grant the defendant's request to reschedule the case with a differently constituted Disputes Division, nor to grant the request that Mr. Yves Poullet withdraw.
II.3. Regarding the absence of financial institutions from the proceedings
127. The defendant criticizes "the absence of intervening parties in the case" (section 6.2 of its
second additional submissions, which constitute summary submissions), thereby targeting the
48The extract from the Disputes Division's Language Policy Note cited in paragraph 116 above explicitly states: "If the President is not sitting, he or she shall be replaced – as a member sitting alone – by a member from the linguistic role in which the case is being heard."
49In a judgment of February 22, 2023 (2022/AR/,889), the Markets Court already considered that the complete renewal of the seat of the Litigation Chamber could not be carried out given the limited number of members belonging to one or other linguistic role. Decision on the merits 79/2025 — 37/96
financial institutions. As already mentioned (paragraph 86), the defendant even requests
that the Litigation Chamber suspend the examination of the complaint pending the filing of the case against the latter. 128. Given their role in the processing chain leading to the transfer of data
to the IRS, the defendant considers that "it was up to the plaintiffs to direct their complaints
against the financial institutions" (point 12 of the second additional submissions
serving as summary submissions), while acknowledging that the procedure before the APD does
not provide for forced intervention "so that only the plaintiffs can
direct their complaints to the parties they arbitrarily choose." The
defendant adds that this situation deprives it of the ability to exercise its rights of defense
in the same way as the plaintiffs, who can choose their target by
depriving them of the opportunity to appeal to the cause of other parties. According to the defendant,
there is therefore a violation of Articles 10 and 11 of the Constitution. 129. As for the plaintiffs, they conclude that the financial institutions are not parties to the case,
not "because of a conflict of interest with the plaintiffs' counsel," as the defendant claims
(paragraphs 136-137), but because the financial institutions
are not responsible for the complained-about processing consisting of transferring the data to the IRS.
130. As explained in paragraphs 87 et seq., the Litigation Division, in its letter of invitation
to the hearing of November 28, 2024, and given the status of the case at that date, did not grant the
defendant's request for a stay. Noting that the financial institutions
were neither parties nor interveners in the case, the Litigation Division summoned the
parties, heard them, and took the case under advisement.
131. The Litigation Division cannot require either party to intervene in the proceedings. Under current legislation, no compulsory intervention mechanism comparable to that used by ordinary courts is provided for in its procedure (which, with certain exceptions that do not apply here, such as the calculation of certain time limits, is not subject to the Judicial Code). The Litigation Division also notes that the Internal Security Institution (IS), from which it requested an investigation, did not extend the scope of its investigation by implicating financial institutions, as it is authorized to do, in accordance with Article 72 of the LCA (Loi de la Financière de la Financière). The failure to implicate financial institutions is therefore an independent choice made by the IS, which cannot be attributed to the Litigation Division. The Litigation Chamber also lacks jurisdiction to hear
complaints alleging a violation of Articles 10 and 11 of the Constitution invoked by the
defendant and thus exercise constitutional review of its procedure as
50. To the extent necessary, the Litigation Chamber adds that it cannot require a new ex officio investigation to be
conducted by the IS, including financial institutions. Decision on the merits 79/2025 — 38/96
provided for by the legislature in light of these provisions. This review falls outside its substantive jurisdiction,
defined by the LCA and the GDPR. 132. The Litigation Division is of the opinion that the inclusion of the defendant alone as a party to the proceedings,
to the exclusion of the financial institutions, does not in any event preclude the
relevance of examining the complaint and taking a decision against it
at the end of these proceedings, which were conducted in accordance with the principles
of impartiality, independence, and adversarial proceedings and which are not affected by the absence
of the banks in the proceedings.
133. In the following section devoted to the defendant's status as data controller (Section II.4), the Litigation Division demonstrates that the defendant is bound
by its own obligations as data controller with regard to the
processing it carries out, namely the transfer of personal data to the IRS (a status of data controller that the defendant explicitly acknowledges elsewhere). The fact
that banks are also bound by a number of obligations arising in turn
from their role as data controllers with regard to the collection of data and its transmission to the defendant does not ipso facto exempt or diminish the
defendant's own responsibilities. If this were legitimately the case, the
Litigation Chamber takes this into account in its decision. 51
134. More generally, it is not the responsibility of the DPA to implicate all the parties
related to a given issue. The Litigation Chamber recalls that the Public Procurement Court, which
hears appeals of its decisions, does not sanction the procedural choice of the complainant or
the authority not to involve all related parties and not to request an
IS investigation for all parties. On the other hand, the Market Court considers that
prosecutions and sanctions must be directed against a party recognized as
the data controller, which is the case of the defendant in this case.
135. In a judgment of December 13, 2024, the Administrative Court of the Grand Duchy of Luxembourg,
hearing an appeal against a decision adopted by the Direct Tax Administration (ACD), also relating to the sending of personal data to the IRS in
application of the FATCA agreement and the relevant Luxembourg legislation, states
in the same vein the following:52
51 See, in this regard, the reasoning of the Litigation Chamber with regard to the information obligation in Title II.6.3. The Litigation Chamber takes into account, in accordance with the GDPR (Article 14), the extent to which the data subject may have already received the information, in this case from financial institutions. 52
This decision follows an appeal against a judgment rendered by the Administrative Court of the Grand Duchy of Luxembourg on September 29, 2023, in which the said court declared itself incompetent to hear the subsidiary appeal for review against a decision of the Director of the Direct Tax Administration (ACD) of March 22, 2021, dismissing a request to halt the automatic exchange of information between the tax administration of the Grand Duchy of Luxembourg and that of the United States pursuant to the "FATCA" agreement signed with the Grand Duchy, approved by a law of July 24, 2015. Decision on the merits 79/2025 — 39/96
"In this case, the appellants essentially challenge the legality of the transfer of
data to the United States of America (see "this transfer of data violates
several key principles of the right to protection of personal data" in the appellants' request to the ACD), but not the communication of the same data by the Luxembourg financial institutions to the ACD. However, in view of Article 3, paragraph (3) of the aforementioned Law of 24 July 2015, it is the ACD,
as the party responsible for the said transfer of the collected data to the United States, which
is to be considered responsible for this processing.
Therefore, the State's criticism regarding the lack of intervention
of the Luxembourg financial institutions involved in the collection of the data subject to the transfer must be dismissed as unfounded, given that the
processing of personal data carried out by them is not the subject of the appellants' criticisms. It should be added that the State did not rule on the legal consequences it intended to attach to this accusation and that in this case, there is in any case no obligation on citizens to prosecute all those potentially responsible for the violation they allege.
136. Because the defendant raised this point in its submissions, the Litigation Chamber
adds the following. The defendant emphasizes that during the hearing before the Litigation Chamber on January 10, 2023 (the one preceding the adoption of Decision
61/2023), the plaintiffs' counsel clarified that the plaintiffs had not filed a complaint
against the financial institutions due to a conflict of interest, as his firm or he himself
also acted as counsel for several of these financial institutions. Consequently, the
defendant concludes that it is appropriate, with respect to the plaintiffs' counsel, to terminate
their intervention in this matter, in accordance with the principle of independence and
loyalty.137. The Litigation Division notes that this request is addressed directly to the plaintiffs' counsel, who have maintained their intervention in this case notwithstanding this request. To the extent necessary, the Litigation Division indicates that it is not competent to conclude whether or not a conflict of interest exists on the part of the plaintiffs' counsel, regardless of the parties' disagreement over the statements made during the hearing on January 10, 2023. The question of whether the plaintiffs' counsel must withdraw in this case is not within its jurisdiction, nor is it within its jurisdiction to order the plaintiffs' counsel to withdraw. The Litigation Division merely notes that the minutes of the hearing of January 10, 2023, state the following: "Upon Mr. van Gyseghem's reflection on the reason why the banks were not implicated in the complaints filed, Mr. V. Wellens stated that they were not implicated due to a conflict of interest, his firm also acting as counsel to banks" (page 5 of the minutes). The Litigation Division also recalls, as mentioned in point 59, that the plaintiffs' counsel made no reservations or comments regarding these minutes. Decision on the merits 79/2025 — 40/96
In any event, it does not appear to the Litigation Division that the existence of a conflict
of interest on the part of the plaintiffs' counsel would taint this decision
with illegality, since the absence of the financial institutions does not affect it, as
explained above.
138. In conclusion, the Litigation Division considers that it is right to
not suspend the examination of the complaint given the absence of the financial
institutions in the case and to adopt this decision with respect to the defendant
only.
II.4. Regarding the defendant's status as data controller
139. The Litigation Chamber notes that throughout the proceedings, the defendant has stated
that it is the data controller for the transfer of
personal data to the IRS, in support of Article 13.2 of the Law of December 16, 2015, which
explicitly qualifies it as such (see in particular point 17 of its second
additional and summary submissions).
140. Since this is a decisive qualification with regard to the GDPR and the obligations arising therefrom, the
Litigation Chamber will seek below to verify the defendant's status as
data controller, notwithstanding the latter's recognition
in this regard with regard to the transfer to the IRS.
141. The Litigation Chamber thus notes that Article 13.2. of the Law of December 16, 2015
provides that:
"§ 2. For the purposes of Regulation (EU) 2016/679 of the European Parliament and of the
Council of April 27, 2016, on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and the Law of July 30, 2018, on the
protection of natural persons with regard to the processing of personal data, each Reporting Financial Institution and the FPS Finance
are considered to be the "controller" of "personal data" with regard to the information referred to in this
law relating to natural persons."
142. The defendant is therefore expressly designated as the data controller under the terms
of the Law of December 16, 2015. Since the amendment made by the Law of November 20, 2022,
it expressly refers to the GDPR.
54
Brussels Court of Appeal, Market Court Section, 19th Chamber A, Market Chamber, judgment of February 23, 2022 -
2021/AR/65.
55Emphasis added by the Litigation Chamber. Decision on the merits 79/2025 — 41/96
143. Article 4.7 of the GDPR states that the data controller is "the natural or legal person, public authority, service or other body which, alone or jointly
with others, determines the purposes and means of the processing." Article 4.7. adds that
"where the purposes and means of such processing are determined by Union law
or the law of a Member State, the controller may be designated, or the specific criteria
for its designation may be provided for by Union law or by the law of a
56
Member State." This is the case for the defendant under Article 13.2 of the aforementioned
Law of 16 December 2015.
144. As the EDPB emphasizes in its Guidelines on the concepts of
57
controller and processor in the GDPR, the Litigation Chamber
considers that when the controller is specifically identified by law,
this designation is decisive in defining who acts as the controller.
This presupposes that the legislature has designated as the controller
the entity that is truly capable of exercising control. On the other hand, the
Litigation Chamber cannot accept the plaintiffs' argument that since
the Belgian State negotiated the FATCA agreement, it is responsible for the resulting processing.
As is the case with the Belgian Law of December 16, 2015, the defendant's status as data controller stems from the fact that the FATCA agreement entrusts it (as
Competent Authority) with the processing that consists of transferring data to the IRS. 145. In its defense, the defendant emphasizes that it does not have access to the content of the
"bundle" of data it receives from financial institutions (here, from the plaintiff's Bank Z) for the purpose of transferring this data to the IRS. This is an organizational measure aimed at ensuring the security and integrity of the data, limiting its
intervention to a logistical role of "preparing" the transfer. As already mentioned,
the defendant nevertheless acknowledges its status as data controller (paragraph
139). It cannot shirk its obligations as data controller due to
the lack of access to said data.
146. To the extent necessary, the Litigation Chamber reiterates that the fact that the
defendant does not have access to the data communicated has no impact on its status.
56. Emphasis added.
57European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, https://edpb.europa.eu/system/files/2022-
02/eppb guidelines 202007 controllerprocessor final fr.pdf (point 23). 58
This is particularly evident from the second additional submissions filed in the context of the resumption of the case
leading to this decision (point 61, for example) and from the minutes of the hearing of December 11, 2024. Decision on the merits 79/2025 — 42/96
of the controller, as the CJEU clarified in its Google Spain and Google judgment of May 13, 2014, and in its IAB judgment of March 7, 2024. 59
147. In conclusion, and in support of the combined reading of Article 4.7 of the GDPR and Article 13.2.
of the Law of December 16, 2015, the Litigation Chamber upholds the defendant's classification as data controller with regard to the data processing challenged by the plaintiffs, namely the communication (transfer) of personal data to the IRS.
148. As for financial institutions (such as the plaintiff's Bank Z in this case), they are not, as already mentioned, parties to the proceedings (Title II.3). They nevertheless play an important role in the data processing chain that takes place within the framework of the execution of the FATCA agreement and the Law of December 16, 2015. As the defendant emphasizes (see point 17 of its second additional submissions, which constitute summary submissions), it is they who initially ensure the status of the account holders affected by the obligation to communicate data to the defendant. They are the ones who collect the data required pursuant to Article
2.2. of the FATCA agreement and Article 5 of the Law of December 16, 2015, and then transmit
them to the defendant, who, in turn, transfers the data to the IRS. As such,
financial institutions are also classified as data controllers by the Belgian legislature for the purposes of the Law of December 16, 2015. As explained in
point 133, the Litigation Chamber takes into account, in compliance with the GDPR, the potential
distribution of obligations provided for by law between the financial institutions on the one hand and the
defendant on the other, and the consequences thereof. In other words, if there were
to be consequences for the defendant in terms of obligations arising from
obligations specific to financial institutions, the Litigation Chamber takes this into account in
this decision.
59
Judgment of the CJEU of 13 May 2014, C-131/12, Google Spain and Google, ECLI:EU:C:2014:317, paragraphs 22-41, and in particular paragraphs 22 and 34:
"22. According to Google Spain and Google Inc., the activity of search engines cannot be considered processing of data appearing on third-party web pages displayed in the list of search results, since
these engines process information accessible on the Internet in its entirety without distinguishing between personal data and other information. Furthermore, even if this activity were to be classified as "data processing," the operator of a search engine cannot be considered "controller" for such processing, since it has no knowledge of the data and no control over it." "34. Furthermore, it should be noted that it would be contrary not only to the clear wording but also to the objective of this provision, which is to ensure, through a broad definition of the concept of "controller," effective and comprehensive protection of data subjects, to exclude the operator of a search engine from this protection on the grounds that it does not exercise control over personal data published on third-party web pages. »
See also CJEU judgment C-25/17, Jehovan Todistajat, EU:C:2018:551, paragraph 69, and CJEU judgment C-210/16, Wirtschaftsakademie Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraph 38, as well as the EDPB Guidelines 7/2020
already cited concerning the concepts of controller and processor in the GDPR, paragraph 45.
See also CJEU judgment of 7 March 2024, C-604/22, IAC v. Data Protection Authority, ECLI:EU:C:2024:214,
paragraph 69. Decision on the merits 79/2025 — 43/96
II.5. Regarding Article 96 of the GDPR
149. Article 96 of the GDPR is undoubtedly at the heart of the discussion on the legality of the
transfers of personal data to the IRS complained about by the complainants.
150. Thus, the SI raises the applicability of Article 96 of the GDPR and decides not to pursue its investigation further
in the absence of an apparent violation of the GDPR, noting, as already
explained in paragraphs 31 et seq., that the CPVP and the CSAF had favorably assessed the Law of
December 16, 2015 and authorized the transfer.
151. As for the defendant, it argues, based on Article 96 of the GDPR, and in line
with the findings of the Internal Revenue Service (IS) mentioned above, that the "FATCA" agreement, which is inseparable from the Act of December 16, 2015, complies with EU law applicable on May 24, 2016. The defendant
therefore considers itself, pursuant to Article 96 of the GDPR, authorized to base the transfer to the IRS
of the data of the first plaintiff and that of the accidental Americans represented by the
second plaintiff, on these provisions (paragraph 86).
152. In view of the findings of the Internal Court, the defendant's arguments in support of this article, and
their challenge by the complainants, the Litigation Chamber considers it necessary to examine
the objective, scope, and conditions of application of Article 96 of the GDPR. It does so
in the following paragraphs.
153. Article 96 of the GDPR reads as follows:
"International agreements involving the transfer of personal data to third countries or international organizations which were
concluded by Member States before 24 May 2016 and which comply with Union law as applicable before that date shall remain in force until they are
amended, replaced, or revoked."
154. The Litigation Chamber recalls that by opting for a regulation (the GDPR) intended to replace a directive (Directive 95/46/EC), the European co-legislators have chosen to strengthen the harmonization of personal data protection rules within the EU. Unlike the directive, the regulation is directly applicable within the domestic legal system of each Member State. The GDPR also pursues the objective of strengthening the effectiveness of the right to data protection, which has since been enshrined as a fundamental right by the Charter of Fundamental Rights of the EU of 7 December 2000 (Article 8). 155. By providing for the entry into force of the GDPR on May 25, 2018, two years after its entry
into force on May 24, 2016 (Article 99 of the GDPR), and a repeal of Directive 95/46/EC
Recital 102 of the GDPR: "This Regulation (GDPR) is without prejudice to international agreements concluded
between the Union and third countries regulating the transfer of personal data, including appropriate safeguards
for data subjects." Decision on the substance 79/2025 — 44/96
On the same date (Article 94 of the GDPR), the European co-legislators not only granted a two-year compliance period for the new GDPR obligations
but also clearly stated that as of May 25, 2018, ongoing data processing
should comply with all the provisions of the GDPR. Recital 171 of the GDPR
illustrates this objective and provides in this regard that "processing already in progress at the date
of application of the Regulation should be brought into compliance with it within
two years of its entry into force."61
156. This compliance is essential to achieve the objective of strong harmonization
pursued by the GDPR and to strengthen the protection of the fundamental rights it
implements. If processing operations in progress prior to the GDPR's entry into force are not brought into compliance with the GDPR, two protection regimes would coexist. This would, in essence, be contrary to the very nature of the regulation and, a fortiori, to that of a fundamental right. 157. The regime provided for in Article 96 of the GDPR is an exception in this regard, since it authorizes
the maintenance of international agreements concluded before May 24, 2016 (provided, of course, that
they comply with the EU law applicable on that date) until their possible amendment,
replacement, or revocation, even if they are not compliant with the GDPR.
158. The Litigation Chamber is of the opinion that it is in light of the legislative ratio of the GDPR as a whole,
and in particular the transitional provisions noted above (Articles 94 and
99), that the regime provided for in Article 96 of the GDPR must be understood, both in its material scope (rationae materiae) and in its temporal application, as well as, ultimately, in assessing whether the essential condition is met. that it poses, namely "compliance with Union law as of 24 May 2016".
159. As for the material scope, only the content of the international agreement concluded by
the Member State is covered by Article 96 of the GDPR, the wording of which unequivocally refers to "international agreements involving the transfer of personal data to
third countries".
160. Without prejudice to any conclusions that may be drawn in terms of compliance, since the
"FATCA" agreement does not contain a specific provision concerning the information obligation
for example, this obligation is necessarily excluded from the scope of Article 96 of the
GDPR. The defendant is therefore bound by Articles 12 and 14 of the GDPR (in the case of indirect collection – see Section II.6.3 below). As for the obligations arising from Article 35 of the
GDPR (DPIA) as well as Articles 5.2 and 24 (accountability), these are new obligations
which will be fully applicable. They are indeed non-existent in the agreement.
61The Litigation Chamber specifies, as far as necessary, that it is therefore not stating here that Article 96 of the GDPR would only apply
for a period of two years. Decision on the merits 79/2025 — 45/96
"FATCA" of 2014 and arise from the obligations imposed on the defendant in its
capacity as data controller since May 24, 2018.
161. In other words, the application of Article 96 of the GDPR is limited to the content of
the agreement alone. The wording of Article 96 is clear on this point, and this reading is also consistent with the ratio legis of Article 96, which, as the Litigation Chamber will explain below, aims to preserve the rights acquired by third countries under the terms of said agreements, not to relieve the defendant of its independent obligations arising from the GDPR.
162. The Litigation Chamber immediately clarifies that the principle of accountability (which consists of the data controller implementing technical and organizational measures to meet the requirements of the GDPR and reporting on them) includes for the defendant the obligation to demonstrate that it was in the conditions to invoke the application of Article 96 of the GDPR, the principle of accountability covering the entire text of the GDPR.
163. The Litigation Chamber will thus verify whether the defendant is indeed justified in
conclusing that the FATCA agreement complies with EU law applicable on May 24, 2016
and demonstrating this. The Litigation Chamber considers that it is first required to
verify whether the FATCA agreement complies with EU law applicable on May 24, 2016.
Only if it concludes that this is not the case will it examine the compliance of the transfers made by the defendant with the GDPR, and therefore the defendant's right to continue these transfers in execution of the agreement. The Litigation Chamber considers that
this interpretation is the only one that respects the desire of the European co-legislators to grant
Member States more time to comply with their international commitments, as shown in the preparatory work for the GDPR (see below).
164. Thus, the Litigation Chamber does not subscribe to the analysis of the French Council of State, which,
in a decision brought against a CNIL decision following a complaint also relating
to the "FATCA" agreement, provided, in a judgment of July 19, 2019, a different interpretation of
Article 62:
Article 96 of the GDPR.
"It is clear from these provisions that the authors of the regulation
fully determined the conditions of the relationship between European Union law
and agreements concluded prior to its signature that involve the
transfer of personal data to third countries." For the application
of this article (i.e., Article 96 of the GDPR), it is necessary to first determine whether
the agreement of November 14, 2013, complies with the provisions of the Regulation of April 27,
2016, which have direct effect, and only if this is not the case, to verify, in a second step, whether this agreement complies with European Union law as it was applicable before the signature of the Regulation.
165. The Litigation Chamber therefore does not subscribe to the interpretation given by the
defendant itself in its decision of October 4, 2021. Thus, after informing the
complainant on March 30, 2021, that it was incumbent upon him to demonstrate that the agreement " FATCA" violated
Directive 95/46/EC" (point 16), the defendant reiterates in its decision of October 4, 2021
the terms of the aforementioned judgment of the French Council of State of July 19, 2019, according to which it is
necessary to first verify the compliance of the "FATCA" agreement with the GDPR (point 18). The Litigation
Section notes that the defendant has, however, amended its interpretation in accordance with the
submissions filed in the present proceedings and now shares the
position set out by the Litigation Section in point 163 above.
166. These divergences show that, while it may seem clear in its wording and
provides for a very specific regime, Article 96 of the GDPR is neither uniformly understood
nor uniformly applied. This difference is not insignificant, given that, depending on
the interpretation, the reference text is either Directive 95/46/EC (repealed seven years ago)
or the GDPR (a regulation offering enhanced protection), with Directive 95/46/EC
filling the gaps in the event that it is not fully complied with.
167. Provided they comply with EU law applicable on May 24, 2016, international agreements
involving transfers of personal data to third countries
remain in force "until they are amended, replaced, or repealed,"
even, as already noted, if they do not comply with the GDPR. 168. However, the Litigation Chamber considers, for the reasons developed below, that it
would be contrary to EU law to consider that this regime of Article 96 is intended to
apply indefinitely.
169. Article 96 of the GDPR aims to preserve the rights of third countries: it is clear that negotiating an
international agreement takes time and that the rights acquired by a third country party to an
international agreement cannot simply be immediately withdrawn
due to the entry into force of new legislation when that agreement was
compliant with EU law at the time of its conclusion. The Council's preparatory work,
cited by the defendant elsewhere, thus states that Article 96 "guarantees legal certainty
for data controllers and avoids an unnecessary administrative burden for
Member States." It also takes into account the fact that Member States are dependent
on the cooperation of the third country or international organization concerned to amend
existing agreements."
170. Without prejudice to the foregoing, EU Member States are nonetheless
obliged to comply with EU law. This obligation results from Article 4.3 of the Treaty of the European Union (TEU), which enshrines, in particular, the principle of sincere cooperation
between Member States. Article 4.3 of the TEU applies to the latter, including their
independent data protection authorities entrusted with tasks based on applicable
European law (Article 8.3 of the Charter of Fundamental Rights of the Union and
Articles 51 et seq. of the GDPR). 64
171. In this regard, Article 96 of the GDPR is in line with Article 351 of the Treaty on the
Functioning of the EU (TFEU), 65 in respect of which the CJEU has already ruled that:
- On the one hand, "the rights and obligations arising from an agreement concluded
before the date of accession of a Member State between that State and a third State
shall not be affected by the provisions of the Treaty." This provision [see Article 351
of the TFEU] aims to clarify, in accordance with the principles of international law,
that the application of the Treaty does not affect the commitment of the Member State concerned to
respect the rights of third States resulting from a previous agreement and to observe
its obligations" 66.
- Furthermore, practices must be brought into line with European law,
with the Member State in question being required to use all appropriate means to
eliminate the incompatibilities found "unless such practice is necessary to
ensure the performance by the Member State concerned of obligations towards third States
67
resulting from a previously concluded agreement."
172. It follows from this position of the CJEU that "the meaning of the two paragraphs [read of
Article 351 TFEU] have been reconciled, and it is now safe to affirm that Article 351(1) TFEU
provides temporary protection to allow the Member States not to incur international
responsibility while the ultimate goal established by Article 351(2) TFEU (that is, the removal of
63
Article 4.3. TEU: By virtue of the principle of sincere cooperation, the Union and the Member States shall respect and assist each other in the performance of the tasks arising from the Treaties. The Member States shall take all appropriate measures, general or particular, to ensure the fulfilment of the obligations arising from the Treaties or resulting from the acts of the institutions of the Union. The Member States shall facilitate the accomplishment by the Union of its tasks and shall refrain from any measure which might jeopardize the achievement of the Union's objectives.
64See In this sense: the judgment of the CJEU of 15 June 2021, Facebook Ireland and Others v. Gegevensbeschermingsautoriteit, C-645/19, ECLI:EU:C:2021:483, para. 60.
65
Article 351 TFEU: The rights and obligations arising from agreements concluded before 1 January 1958 or, for acceding States, before the date of their accession, between one or more Member States, on the one hand, and one or more third States, on the other, shall not be affected by the provisions of the Treaties. To the extent that such agreements are incompatible with the Treaties, the Member State or States concerned shall take all appropriate measures to eliminate the incompatibilities established.
66 CJEU, Judgment of 3 March 2009, C-205/06, ECLI:EU:C:2009:118, Commission v Austria, para. 33. This judgment concerns the second paragraph of Article 307 of the Treaty establishing the European Community (repealed by Article 351 TFEU). Article 307: "The rights and obligations arising from agreements concluded before 1 January 1958 or, for acceding States, before the date of their accession, between one or more Member States, on the one hand, and one or more third States, on the other, shall not be affected by the provisions of this Treaty. To the extent that such agreements are incompatible with this Treaty, the Member State or States concerned shall use all appropriate means to eliminate the incompatibilities established." 67 CJEU, judgment of 28 March 1995, C-324/93 The Queen v Secretary of State for the Home Department, ex parte Evans Medical
and Macfarlan Smith, ECLI:EU:C:1995:84, p. 33. Decision on the merits 79/2025 — 48/96
all incompatibilities) is achieved in a sustainable (for the Member State involved) and lawful
(from an international law perspective) manner 68”.
173. The Litigation Chamber cannot therefore subscribe to an interpretation according to which
Article 96 of the GDPR authorizes, without any time limit, the continued application
of international agreements concluded before 24 May 2016 – even if they complied with
EU law on that same date – without further compliance with the GDPR. Following such an interpretation, the co-legislators would have permitted, in defiance of the case law of the
CJEU cited above, the coexistence, without time limit, of international agreements
compliant with the state of Union law as of May 24, 2016 (including Directive
95/46/EC, which was repealed on May 24, 2018), on the one hand, and international agreements
concluded after that date, which must comply with the GDPR, on the other.174. The Litigation Chamber further notes that Article 49.5 of the GDPR contains the same
words: "until amended, replaced, or repealed." Article 45.9
thus provides that "decisions adopted by the Commission on the basis of Article 25, paragraph
6, of Directive 95/46/EC [i.e., adequacy decisions] shall remain in
force until amended, replaced, or repealed by a Commission decision adopted in accordance with paragraphs 3 or 5 of this Article." 69
175. The European Commission—which has the exclusive power to adopt an adequacy
decision—has nevertheless reexamined the 11 existing adequacy decisions in light of
70
the GDPR. In its report of 15 January 2024, the Commission decided to maintain the adequacy decisions adopted for the 11 countries and territories concerned, noting that its review demonstrated that the data protection frameworks in force in these countries and territories have continued to converge with the EU framework and have strengthened the protection of the personal data to which they apply. It notes that the GDPR has inspired positive changes such as the introduction of new rights for data subjects and the strengthening of the independence and powers of data protection authorities.
176. The European Commission also emphasizes that "the adequacy decisions [some of which are more than 20 years old at the date of application of the GDPR (Canada, Switzerland)] have laid the foundations for closer cooperation and further regulatory convergence between the EU and like-minded partners." By
allowing the free movement of personal data, these decisions have opened
68 Emphasis added by the Litigation Chamber: https://www.europeanpapers.eu/europeanforum/court-of-justice-finally-
rules-on-analogical-application-art-351-tfeu
69 Emphasis added by the Litigation Chamber.
70 Report from the Commission to the European Parliament and the Council on the first review of the operation of adequacy decisions adopted on the basis of Article 25(6) of Directive 95/46/EC COM/2024/7 final. https://eur-
lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:52024DC0007 Decision on the substance 79/2025 — 49/96
of commercial channels for EU operators, in particular by complementing and
amplifying the benefits of trade agreements, as well as facilitating cooperation with
foreign partners in a large number of regulatory areas."
177. The analogy with Article 96 of the GDPR is not perfect. However, the content of Article
45.9 of the GDPR, on the one hand, and this review of adequacy decisions carried out by the
European Commission - even though these adequacy decisions also create, in a certain way, a framework in place for years that facilitates the communication of
personal data from the Union to third countries - on the other hand, are indicators.
They demonstrate that the ultimate objective - notwithstanding the period of tolerance granted
under either Article 45.9 or 96 of the GDPR - is the elimination of the coexistence of
two distinct protection regimes. To this end, it was incumbent on the European Commission
(competent for adequacy decisions) to contribute, which it promptly did
by initiating a review of the adequacy decisions it had previously adopted in light of the GDPR requirements. It is incumbent on Member States to diligently do the same
with regard to the international agreements they have concluded.
178. The Litigation Chamber is aware that the Belgian State, in its role as negotiator,
is not a party to these proceedings. It nevertheless notes that the more time
passes, the less acceptable the States' inertia in this regard becomes. Already in 2021, data protection authorities—including the DPA—invited EU Member States to review their international agreements in light of the GDPR. As of the date of adoption of this decision,
nearly nine years have passed since the GDPR entered into force, and seven years since its entry
into force. The Litigation Chamber notes in this regard that no indication of the Belgian government's intention to request a review of the FATCA agreement was brought to its attention by the defendant in the context of this case, nor did the defendant,
the primary contact for the IRS, at any time conduct such an assessment in order
to assist the Belgian government in initiating a review request. 179. With regard to data protection authorities such as the DPA, a reading of Article 96 of the GDPR that would authorize its application without time limit, combined with the absence of any renegotiation of the agreement, would also imply that the DPA assesses the compliance of these international agreements with EU law applicable on May 24, 2016, in many cases.
71 Statement 04/2021 of April 13, 2021 on international agreements, including transfers:
https://edpb.europa.eu/system/files/202205/edpb statement042021 international agreements including transfers fr.pdf
The EDPB considers that "to ensure that the level of protection of natural persons guaranteed by the GDPR (...) is not compromised when personal data are transferred outside the Union, it is necessary to take into account of
the objective of bringing these agreements into compliance with the requirements of the GDPR (...) applicable to data transfers
where this is not yet the case. The EDPB therefore invites Member States to assess and, where appropriate, review their international agreements involving international transfers of personal data, such as those relating to taxation (e.g., the automatic exchange of personal data for tax purposes), (…) which were concluded before 24 May 2016 (for agreements relevant to the GDPR). (…). The EDPB recommends that Member States take into account, for this review of the GDPR (…), the relevant EDPB guidelines applicable to international transfers [the EDPB cites its Guidelines, as well as the case law of the Court of Justice, in particular the Schrems II judgment of 16 July 2020.” Decision on the merits 79/2025 — 50/96
years after this date, particularly in light of Directive 95/46/EC having been repealed
for a number of years, a number that will only increase over time. In this regard, the Litigation Chamber is of the opinion that
the more time passes, the less acceptable it is for data protection authorities
to be limited in the exercise of the mission entrusted to them
by the GDPR since May 25, 2018, a mission which, as previously
emphasized, consists precisely in contributing to the effective and uniform application of the GDPR. In
the aforementioned Schrems II 72 judgment, the CJEU emphasized the following in this regard, with regard to the
competence of supervisory authorities as enshrined in Articles 8.3. of the Charter
and 57.1. a) of the GDPR:
"(…) Therefore, each of them [read supervisory authorities] is vested with
the power to verify whether a transfer of personal data from
the Member State to which it belongs to a third country complies with the requirements laid down by
that regulation. (…) The exercise of this task is particularly important
in the context of a transfer of personal data to a third country,
since, as is clear from the very terms of recital 116 of that
regulation, 'when personal data cross the external borders of the Union, this may increase the risk that individuals
will be unable to exercise their data protection rights, in particular to protect
themselves against the unlawful use or disclosure of that information'" (paragraphs
107 and 108 of the judgment).
180. Thus, the failure of Member States to implement their obligation to cooperate
hinders, by implication, the effectiveness of the right to data protection (via its oversight
by an independent data protection authority guaranteed by Article 8.3 of the Charter of Fundamental Rights of the EU), even though the CJEU is particularly
demanding regarding the protection that international agreements must guarantee, on the one hand, and
the role of data protection authorities, on the other. - The CJEU imposes very strict conditions on international agreements that have an
impact on the exercise of the rights to privacy and the protection of personal data
enshrined in Articles 7 and 8 of the Charter. More specifically, it follows
from Opinion 1/15 of the CJEU on the draft PNR agreement between Canada and the EU (as
well as from Judgment C-817/19 of June 21, 2022) and the Schrems II judgment that "communication
72 The Litigation Chamber specifies that when it cites this judgment, it is to draw lessons from it with regard to
the importance of regulating transborder data flows and the role of protection authorities in this regard, even when the purposes of the flows are not commercial.73
Article 8.3 of the Charter of Fundamental Rights of the EU: Compliance with these rules (i.e., the right to data protection as enshrined in paragraphs 1 and 2) is subject to review by an independent authority.
74 CJEU, Opinion 1/15 of 26 July 2017 (EU-Canada PNR Agreement), ECLI:EU:C:2017:592.
75 CJEU, Judgment C-817/19 of 21 June 2022, Human Rights League, ECLI:EU:C:2022:491. Decision on the merits 79/2025 — 51/96
of personal data to a third party, such as a public authority, constitutes
an interference with the fundamental rights enshrined in Articles 7 and 8 of the
Charter, regardless of the subsequent use of the information provided. The same applies
to the retention of personal data and access to such data for use by public authorities. In this regard, it
is irrelevant whether the information relating to private life in question is
sensitive or whether the data subjects have suffered any disadvantages
77
as a result of such interference."
- Any limitation to the fundamental rights enshrined in the Charter (including the fundamental
right to data protection in Article 8) must meet the conditions of
Article 52.1. of the Charter cited above, which states that "Any limitation on the exercise of the
rights and freedoms recognized by this Charter must be provided for by law and respect
the essence of those rights and freedoms. In accordance with the principle of
proportionality, limitations may be imposed only if they are
necessary and effectively meet objectives of general interest recognized by
the Union or the need to protect the rights and freedoms of others."
181. Thus, it would be reductive to consider that the question of the temporal application of
Article 96 of the GDPR would only arise if the DPA (via its Litigation Chamber) or other
data protection authorities were to conclude that the "FATCA" agreement was
compliant with EU law as applicable on 24 May 2016. As such,
Article 96 limits the effective exercise by data protection authorities, in this case the DPA, of
the tasks entrusted to them by the GDPR.
182. In its decision of 13 December 2024, already mentioned with regard to the classification of
data controller, the Administrative Court of the Grand Duchy of Luxembourg applied
Article 96 of the GDPR by explicitly classifying it as a transitional provision. "Article 96 of the GDPR constitutes, in essence, a transitional provision that allows Member States to continue to apply international agreements
providing for the transfer of protected personal data
to third countries and which they had entered into before May 24, 2016, the date of entry into
force of the GDPR, even if the terms agreed in these agreements do not
meet the standards set by the GDPR, in order to prevent the
continued execution of said agreements from encountering new requirements."
76 This is emphasized by the Litigation Chamber. 77
Opinion of the CJEU of 26 July 2017 (EU-Canada PNR Agreement), ECLI:EU:C:2017:592, paras 123 and 124 and the judgments cited: see, to this effect, judgments of 20 May 2003, ÖsterreichischerRundfunke.a., C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraphs 74 and 75; of 8 April 2014, Digital Rights Ireland and Others, C-293/12 and C-594/12, EU:C:2014:238, paragraphs 33 to 35, and of 6 October 2015, Schrems, C-362/14, EU:C:2015:650, paragraph 87). Decision on the merits 79/2025 — 52/96
or more stringent provisions of the new Community regulation. The exemption from compliance with the
GDPR permitted by this provision is nevertheless conditional on
compliance with "Union law as it [was] applicable before [May 24, 2016]," i.e.
the standards applicable before May 24, 2016. Furthermore, this exemption is
only intended to last until the amendment, replacement, or revocation
of these previous international agreements."
183. This passage from the judgment, and in particular the classification of Article 96 as a transitional provision, leads the Litigation Chamber to the following question: if Article 96 of the GDPR is indeed a transitional provision, is it permissible for this transitional period to potentially last indefinitely and de facto deprive data subjects of the enhanced protection offered by the GDPR? Isn't this lack of a time limit for a transitional regime contrary to the general principles of transitional law, characterized, admittedly, by the non-retroactivity of the standard, but without having the effect of (and therefore authorizing) indefinitely denying the benefit of enhanced protection to data subjects? While potentially indefinitely transitional, doesn't Article 96 of the
GDPR establish a pure and simple and permanent derogation from the GDPR, the compatibility of which with the Charter of Fundamental Rights of the
Union must be questioned? Any provision of an EU regulation, i.e., Article 96 of the GDPR in question here,
must itself be compatible with the said Charter. 184. Regardless of the question of the temporal application of Article 96, the role and
responsibility of the Belgian State (like that of any other Member State signatory to a "FATCA" agreement
comparable to the one signed by the Belgian State) does not, in any event, exempt
the data controller who, like the defendant, intends to rely on
Article 96 of the GDPR, from examining whether the conditions for invoking Article 96 are met and
from demonstrating to the competent supervisory authority (in this case, the DPA) that this is the case. Indeed,
invoking Article 96 of the GDPR inherently implies, through the condition it imposes
(compliance with EU law as applicable on May 24, 2016), that the data controller
perform this assessment. 185. "Union law as applicable on 25 May 2016" includes primary law such as Article 78 79
16 of the TFEU and Articles 7, 8, and 47 of the Charter of Fundamental Rights of the EU, as well as
Directive 95/46/EC. To the extent necessary, the Litigation Chamber specifies that
78 Article 7 of the Charter of Fundamental Rights of the EU - Respect for private and family life: Everyone has the right to respect for their private and family life, their home, and their communications.
79 Article 47 of the Charter of Fundamental Rights of the EU - Right to an effective remedy and to a fair trial:
Everyone whose rights and freedoms guaranteed by Union law are violated has the right to an effective remedy before a tribunal, in accordance with the conditions laid down in this article. Everyone has the right to a fair, public, and timely hearing by an independent and impartial tribunal previously established by law. Everyone has the opportunity to be advised, defended, and represented. Legal aid is granted to those who lack sufficient resources, to the extent that such assistance is necessary to ensure effective access to justice. Decision on the merits 79/2025 — 53/96
The use of the terms "as applicable on May 25, 2016" does not mean that this right is frozen
in its interpretation as of May 25, 2016. Article 96 exempts compliance with the GDPR
(conditionally) by not adding any new data protection regulations to those applicable on May 24, 2016, in order to preserve, as
reiterated, the rights derived from the agreement by the third country with which the agreement is concluded. However, it
does not exempt the examination of the condition of compliance with EU law as of May 24, 2016, from including the potentially evolving interpretation given by the CJEU to
key data protection concepts—including with regard to the GDPR when they are
concepts common to both texts.
186. In conclusion, clarifying the scope of Article 96 of the GDPR is directly in line
with the requirement for uniformity and legal certainty, in a context where this provision is
subject to divergent interpretations within the Union, even though the GDPR aims
to guarantee a harmonized application of the right to data protection and the CJEU has
clearly stated that data transfers to third countries must comply with
Articles 7, 8, and 47 of the Charter of Fundamental Rights of the EU. Article 96 does not exempt data controllers who transfer data to third countries in execution of international agreements concluded before May 24, 2016, either completely or indefinitely from the GDPR. Article 96 GDPR constitutes only a temporary derogation, strictly conditional on compliance with EU law applicable before May 24, 2016. Therefore, necessarily interpreted restrictively, it provides for a transitional regime subject to conditions, the objective being to "ensure comprehensive and consistent protection of personal data in the Union" on the one hand and to avoid any legal vacuum on the other. Avoiding this legal vacuum does not amount, for the reasons set out above, to assessing compliance with EU law as interpreted on the fixed date of May 24, 2016. Thus, the data controller, like the defendant, who intends to rely on Article 96 of the GDPR must include relevant developments in CJEU case law in its assessment of the condition of compliance with EU law as of May 24, 2016. It must be able to demonstrate that, following this rigorous, documented, and updated assessment, it is justified in relying on Article 96 of the GDPR. This assessment will not, however, exempt it, as the Chamber
80
This objective is expressly explained in recital 95 of Directive 2016/680/EU, with regard to Article 61 of this directive, which is identical to Article 96 of the GDPR.Article 61 - Relationship with previously concluded international agreements in the field of judicial cooperation in criminal matters and police cooperation: "International agreements involving the transfer of personal data to third countries or international organizations concluded by Member States before 6 May 2016 and which comply with Union law as applicable before that date shall remain in force until they are amended, replaced, or revoked."
Recital 95 provides that "in order to ensure comprehensive and consistent protection of personal data in the Union, international agreements concluded by Member States before the date of entry into force of this Directive and which comply with the relevant provisions of Union law applicable before that date should remain in force until they are amended, replaced, or revoked." (Emphasis added by the Litigation Chamber). Decision on the merits 79/2025 — 54/96
The Litigation Court will further develop this in the decision, neither to carry out a DPIA nor
to its ongoing duty of accountability. In doing so, the data controller could
also contribute to the process of renegotiation of the agreement. The Member States, including
the Belgian State, are bound to do so in fulfillment of their duty of sincere cooperation pursuant to
Article 4.3 TEU, applied in light of Article 351 TFEU and Article 8 of the Charter of
Fundamental Rights of the EU.
II.6. As for the grievances raised,
187. As stated in the procedural background, the Procurement Court emphasizes
that the Litigation Chamber did not pay sufficient regard to the SI's findings in its
Decision 63/2021,
188. As the Procurement Court emphasized in its judgment of December 20, 2023, the Litigation
Chamber, having chosen to refer the matter to the SI in this case, must take into account
the latter's findings and, where appropriate, provide reasons for departing from them.
The Litigation Chamber is of the opinion that it could only depart from
the SI's material findings if supported by contrary evidence. However, it remains free
to substitute its reasoned assessment for that of the SI, based on the material findings
that the latter made in the exercise of its investigative powers. 189. As it will explain below, the Litigation Chamber is aware of the CPVP's opinions
61/2014 and 28/2015, the CSAF's authorization 52/2016, or the other evidence gathered by
the SI during its investigation. In exercising its jurisdiction to
determine compliance with the GDPR in its capacity as the administrative litigation body of
the APD, the Litigation Chamber has its own interpretation and will, as appropriate, draw other legal consequences from them,
in a reasoned manner. 190. The Litigation Chamber notes that the initial report of the SI does not conclude that the FATCA agreement was in conformity with EU law prior to May 24, 2016. The SI considers, on the basis of the aforementioned texts, that it is not appropriate for it to pursue its investigations further, explicitly invoking Article 64.2 of the LCA in this regard and concluding that there is no apparent violation of the GDPR.
191. According to its supplementary investigation report, the SI concludes that, in its view, there is no evidence indicating a lack of guarantees regarding the protection of the transferred data or a non-reciprocal nature of the exchanges. Decision on the merits 79/2025 — 55/96
II.6.1. Can the defendant rely on Article 96 of the GDPR?
II.6.1.1. Introduction
192. The Litigation Chamber examines the compliance of the transfers complained of by the complainants
taking into account Article 96 of the GDPR. It therefore verifies whether, as the defendant
argues, the FATCA agreement complies with EU law as of May 24, 2016 and authorized
the defendant to transfer the first complainant's data to the IRS and authorizes it to
continue these transfers with respect to the personal data of the accidental Americans
defended by the second complainant.
193. As the Litigation Chamber has just explained, the condition of Article 96 does not imply
only compliance with Directive 95/46/EC but more generally compliance with
EU law, including Article 8 of the Charter of Fundamental Rights.
194. Regarding compliance with Directive 95/46/EC, the Litigation Chamber emphasizes from the outset
that a data exporter who, like the defendant, transfers personal data to a third country must, in addition to complying with the rules relating to the
specific framework for transborder data flows, also comply with all applicable
protection obligations and principles. Thus, the defendant may not
transfer data for a purpose that does not meet the requirements of Article 6.1.
b) of Directive 95/46/EC nor transfer personal data that are neither
adequate, relevant, nor excessive in relation to that purpose, without violating Article
6.1. c) of the said Directive.
195. Recital 102 of the GDPR specifies, with regard to Article 96, that the agreement must contain
appropriate safeguards for the benefit of data subjects.
196. The defendant does not dispute that Article 96 of the GDPR applies only to the "FATCA" agreement. However, it adds that the Law of 16 December 2015 is inseparable from it and that
therefore, "analyzing the "FATCA" agreement in the context of Article 96 of the GDPR requires an
analysis of the said law" (point 24 of its second additional and summary submissions).
It argues that the "FATCA" agreement complies with the Union law applicable as of May 24, 2016
and that, therefore, both the agreement and the Law of December 16, 2015 remain valid pursuant to
81Recital 102: "This Regulation (GDPR) is without prejudice to international agreements concluded between the Union
and third countries regulating the transfer of personal data, including appropriate safeguards
for the benefit of data subjects." This is emphasized by the Litigation Chamber. While the French wording of this
recital is not the clearest, a reading of the English and Dutch versions clarifies that these agreements must contain
appropriate safeguards for the benefit of data subjects. Indeed, while the French version uses the wording "agreements (...) including appropriate safeguards," the English and Dutch versions explicitly link said agreements to the safeguards, stipulating that these safeguards must be included in these agreements. The English version thus states "agreements (...) including appropriate safeguards for data subjects [international agreements including appropriate safeguards for data subjects]," and the Dutch version, the more explicit version, mentions "international agreements in which appropriate safeguards are included [international agreements in which appropriate safeguards are included]." Decision on the merits 79/2025 — 56/96
of Article 96. According to the defendant, this compliance stems, as noted by the SI, from the
analyses carried out by the CPVP in its opinions 61/2014 and 28/2015, as well as from
the decision of 52/2016 of the CSAF. The defendant also invokes the decision of the French EC
of July 19, 2019, which found that the "FATCA" agreement does not violate the GDPR, as well as
a decision of September 17, 2015 of the CNIL (French Data Protection Authority) authorizing the implementation of a
data processing operation consisting of a transfer to the IRS of data collected in
execution of the French "FATCA" agreement, the content of which is similar to that signed by the State. It also relies on the CNIL decision of May 23, 2022, cited above, which closed
a complaint filed by the French AAA seeking the suspension of data transfers
to the IRS pursuant to the French "FATCA" agreement. Finally, the defendant relies on
the Constitutional Court's ruling of March 9, 2017, dismissing the application for annulment
against the Law of December 16, 2015. According to the defendant, all these texts demonstrate
the compliance of the FATCA agreement, read in conjunction with the Law of December 16, 2015, with
EU law applicable on May 24, 2016.
197. The Litigation Chamber considers, for the reasons it develops below, that
the FATCA agreement, even read and applied in conjunction with the Law of December 16, 2015,
is not compliant with EU law applicable on May 24, 2016. It is not consistent with the
principles of finality and proportionality, notwithstanding the findings of the Internal Review Panel and the arguments
of the defendant. The agreement also fails to contain, in addition to guarantees of compliance with the principles of finality and proportionality, the other guarantees required by Directive 95/46/EC, as specifically explained, with regard to data transfers to a third country included in the automatic data exchange by Groupe 29 since 2015. 82
Therefore, it concludes that the "FATCA" agreement is not compliant with EU law as applicable on May 24, 2016, within the meaning of Article 96 of the GDPR. 198. The Litigation Chamber notes that it is not disputed that Opinions 61/2014 and 28/2015 of the
CPVP relate to the draft law that will result in the future Law of December 16, 2015. They are therefore not
opinions on the FATCA agreement as such, which the CPVP also explicitly regrets in its Opinion 61/2024 (point 8 of the opinion). As for Resolution
56/2015 of the SCAF, it authorizes, under certain conditions, transfers to the IRS in execution of the
Law of December 16, 2015, but does not rule on the FATCA agreement itself.199. The defendant accuses the DPA of artificially separating the FATCA agreement from the 2015 Act. This is not the case. The DPA must examine whether the condition set out in Article 96 of the GDPR, namely the compliance of the FATCA agreement with EU law as of May 24, 2016, is established and
82
Group 29, Guidelines for Member States on the criteria to ensure compliance with data protection requirements in the context of the automatic exchange of personal data for tax purposes, WP 234 of December 16, 2015. Emphasis added by the Litigation Chamber.
83The SCAF also states that the CPVP was not consulted regarding the FATCA agreement in point 8 of its decision 52/2016. Decision on the merits 79/2025 — 57/96
demonstrated. The entire rationale of Article 96 is linked to the fact that an international agreement is
complex to amend and that States are dependent on the goodwill of the third country.
It is therefore the "FATCA" agreement in question, not the law of December 16, 2015, which is
not binding on the third country, in this case the United States. The commitments must be made by the Parties to
the agreement, and while certain data protection guarantees are included in the law of
December 16, 2015, they are, depending on the case, a priori, only binding on the defendant and not
necessarily on the third country to which the data is transferred - whose commitments
must be included in the agreement. The Litigation Chamber will therefore examine the
compliance of the transfer made by the defendant with the relevant provisions
of the FATCA agreement and the Law of December 16, 2015, where relevant.
II.6.1.2. Regarding the principle of purpose
200. The principle of purpose, as enshrined in Article 6.1.b) of Directive 95/46/EC
requires that data be collected for specific, explicit, and
legitimate purposes and not be further processed (including when
transferred to a third country) in a manner incompatible with those purposes. This principle is
also enshrined in Article 8.2 of the Charter of Fundamental Rights 84 and must be
applied in compliance with the requirements of Article 52 of the Charter.
201. The "purpose" is the sufficiently specific, determined, and, of course, legitimate reason for
which the data are processed: it is the objective or intention of the data processing.
An interest, on the other hand, is the broader interest that a data controller may have
in the processing, or the benefit that the data controller derives - or that society
could derive - from the processing, such as improving the enforcement of tax legislation or
combating tax evasion. 8
202. The sufficiently determined nature of the purpose depends on the possibility of analyzing whether and
conclusively concluding that the processing of the data is indeed necessary to
achieve the purpose, as required by the principle of proportionality enshrined in
Article 6.1.c) of Directive 95/46/EC. Thus, under the guise of "purpose," a general or broadly defined objective, even if its legitimacy is unquestionable, leaves too much latitude to the data controller and does not allow for effective application of either the principle of purpose or the principle of proportionality.
203. As early as 2015, the Article 29 Working Party, of which the CPVP was a member, clarified this in
its WP 234 document, specifically devoted to data protection requirements.
84
Article 8.2 of the EU Charter of Fundamental Rights: These data must be processed fairly, for specified purposes and on the basis of the data subject's consent or another legitimate basis provided for by law. Everyone has the right to access and rectify data collected about them. 85 See Group 29, Opinion 06/2014 on the concept of legitimate interest pursued by the data controller within the meaning of Article 7 of Directive 95/46/EC, WP217 of 9 April 2014, Title III.3.1 (page 26). Decision on the merits 79/2025 — 58/96
of data in the context of automatic data exchange that "any international agreement should clearly identify the purposes for which the data are collected and validly used. The wording of the purpose ("tax evasion /
improving tax compliance"), for example, may seem vague and insufficiently clear, leaving too much room for maneuver to the competent authority."
➢ The Purpose in the FATCA Agreement
204. With regard to the FATCA Agreement, the Litigation Chamber notes that the "purposes" of the automatic exchange of data specified in the introduction to the agreement are worded
as follows: (a) the improvement of international tax rules – a formulation
pointed out as too broad in the opinion above – and (b) the implementation of
the obligations arising from the US FATCA Act 86
205. Such wording is, at most, the expression of a general objective, albeit a legitimate one.
However, it does not constitute a specific and determined purpose(s) – within the meaning of
Article 6.1.b) of Directive 95/46/EC – for the processing of personal data
intended to achieve this objective. 206. In this regard, the Litigation Chamber is aware that the FATCA agreement, as
it mentioned in the statement of facts, is consistent with other international commitments
of the Belgian State, including the fight against tax fraud and evasion, for which
the automatic exchange of data has been established and to which the FATCA agreement refers
elsewhere (see below). This context, and more generally, these other commitments, do not, however, mean that the FATCA Agreement would necessarily be
compliant with EU law applicable on May 24, 2016.
207. Article 3.7 of the FATCA Agreement provides that "All information exchanged shall be subject to
the confidentiality and other protections provided for in the Convention, including the
provisions limiting the use of the information exchanged." "Convention" refers to the
OECD Convention on Mutual Assistance in Tax Matters, already cited. The
Disputes Chamber notes that, as such, this article of the FATCA Agreement does not specify
the specific and determined purpose of the data processing in question,
here, the transfer to the IRS. It does so by referring to the OECD Convention, the purposes of which are
86 See the following recitals of the FATCA Agreement: "Whereas the government of the Kingdom of Belgium and the
Government of the United States of America (…) desires to conclude an agreement to improve international tax compliance
through mutual assistance in tax matters based on an effective infrastructure for the automatic exchange of information” and
“Whereas, the Parties desire to conclude an agreement to improve tax compliance and provide for the implementation of
FATCA based on domestic reporting and reciprocal automatic exchange pursuant to the Convention [read the Convention on
mutual administrative assistancein tax matters done in Strasburg on January, 25, 1988](…)”. Decision on the merits 79/2025 — 59/96
been judged imprecise by ODA. This indirect transmission lacks clarity and predictability for
the people concerned.
208. As for article 3.8. of the “FATCA” agreement, it states that “Following the entry into force of
this Agreement, each Competent Authority shall provide written notification to the other
Competent Authority when it is satisfied that the jurisdiction of the other Competent
Authority has in place (i) appropriate safeguards to ensure that the information received
pursuant to this Agreement shall remain confidential and be used solely for tax purposes,
and (ii) the infrastructure for an effective exchange relationship (including established
processes for ensuring timely, accurate, and confidential information exchanges, effective
and reliable communications and demonstrated capabilities to promptly resolve questions
and concerns about exchanges or requests for exchanges and to administer the provisions
of Article 5 of this Agreement). The Competent Authority shall endeavor in good faith to
meet, prior to September 2015, to establish that each jurisdiction has such safeguards and
infrastructure in place.”
209. Upon reading this provision, it is clear that the Parties to the FATCA Agreement must
mutually confirm that they have implemented safeguards to ensure that the
information received remains confidential and will only be processed for “tax purposes.” The Litigation Chamber can only note the vague nature of this
“purpose,” as the CPVP did in its Opinion 61/2024, when it
stated, with regard to the first version of the draft law that would result in the Law of December 16,
2015, that the mere mention in the draft law of the automatic exchange of
information “for tax purposes” did not meet the requirements of the principle of
purpose (points 11 et seq. of the Opinion, point 9 of Opinion 28/2015). The defendant cannot therefore, any more than the SI can, claim that the CPP considered that the purposes of the FATCA agreement as such were consistent with the requirements of Article 6.1.b) of Directive 95/46/EC and Article 8.2 of the Charter of Fundamental Rights.
➢ Purpose in the Law of December 16, 2015
210. In its Opinion 61/2014 on the draft law that will result in the Law of December 16, 2015, the CVP
therefore clearly highlights that the mere mention of an exchange "for tax purposes"
does not meet the requirements of the principle of purpose. The CVP requests that the purposes
of criminal investigation and prosecution in matters of taxation be specifically excluded (point
11 et seq. of the Opinion, point 12 in particular).
211. In the opinion of the CPVP, the OECD Convention, to which Articles 3.7 and 3.8 of
the "FATCA" agreement refer, does not exclude the use of transferred data for the purposes
87It should be noted that the DPA Authorization and Advisory Center has since issued a particularly critical Opinion 51/2024 with regard to the
purposes of the OECD Convention, which it considers insufficiently defined:
https://www.autoriteprotectiondonnees.be/publications/avis-n-51-2024.pdf Decision on the merits 79/2025 — 60/96
of investigation and prosecution, but makes such use conditional on the agreement of the Party communicating
the data. Article 17.2 of the draft Law of December 16, 2015, was amended at the request of the CPVP and provides in its final version that "the Belgian competent authority may not authorize a jurisdiction to which the information is transferred to use it for purposes other than the assessment or collection of the taxes referred to in the treaty, proceedings or prosecutions relating to these taxes, decisions on appeals relating to these taxes, or the control of the foregoing" (points 9 et seq. of Opinion 28/2015). This paragraph provides some clarity regarding the purposes of transfers to the IRS. However, the question of what is meant by "prosecution" in the United States, where the data is transferred, remains unclear in the eyes of the Litigation Chamber. 212. The Litigation Chamber cites as evidence that in its deliberation 52/2016, the SCAF
states that it "therefore considers that Article 17 of the Law of December 16, 2015, must be
interpreted as meaning that (authorization) for the reuse (by United States jurisdictions other than tax jurisdictions) of data obtained for matters other than tax matters (for example,
mutual legal assistance in criminal matters, money laundering, corruption, or the fight against terrorism), or for transfer to countries without an adequate level of data protection is a priori excluded" (point 30 of the deliberation). ➢ Conclusion
213. In conclusion, the Litigation Chamber notes that the "purpose" of data processing pursuant to the FATCA agreement is neither specific nor sufficiently defined in the FATCA agreement itself (point 209). Under the Law of December 16, 2016, it is only "clarified" by the reference in Article 3.7 of the agreement to the OECD Convention - the purposes of which are not considered sufficiently specific and defined according to Opinion 51/2024 of the DPA - as well as by Article 17.2 of the law, the exact details of which remain unclear. 214. The Litigation Chamber considers, contrary to the conclusions of the CPVP in its Opinion 28/2015 and Authorization 52/2016 of the SCAF, that in such circumstances where the purpose of the transfer of personal data to the IRS is neither specific nor determined in the FATCA agreement, on the one hand, and where this purpose is very indirectly mentioned and remains imprecise under the Law of December 16, 2015, on the other hand, the transfer to the IRS by the defendant does not meet the requirements of the principle of specific and determined purpose within the meaning of Article 6.1.b) of Directive 95/46/EC. Neither the Litigation Chamber nor the data subject whose data is sent to the IRS are able to identify the purpose(s) for which the data is sent to the IRS and for which it could be processed once in its possession.
215. Thus, in response to the Market Court's observation on this point, the Litigation Chamber notes that neither the opinions of the CPVP nor the authorization of the SCAF have ruled on the purpose of the FATCA agreement as such. On the contrary, the CPVP and the SCAF have emphasized that the agreement was not submitted to them. As for the favorable assessment
made by its predecessors with regard to the Law of December 16, 2015, the Litigation
Section considers, in particular based on a thorough examination of the purposes of the OECD Convention referred to, that they are not sufficiently
defined, including with regard to subsequent processing once the data
have been transferred.
216. With regard to CSAF Authorization 52/2016 in particular, the Litigation
Section is aware that Article 111 of the LCA states, as the Court emphasizes,
that "authorizations granted by the sectoral committees of the Commission for the
Protection of Privacy (CPVP) before the entry into force of this law retain their legal
validity." This Article 111 adds, however, that this retention is "without prejudice to the supervisory powers
of the Data Protection Authority." Therefore, the Disputes Chamber is
authorized, as part of the review of the complaint leading to this decision, to
reexamine this authorization and to depart from it if necessary. In any event, this
authorization was granted subject to conditions, which the Disputes Chamber will note later
in the decision have not been met since 2016 (see paragraphs 233 and 300).
217. Without prejudice to the foregoing, the Litigation Chamber further considers that this
very indirect "determination" is a fragile hypothesis because it depends on texts
distinct from the FATCA agreement itself – a text that is the only one binding the Parties to
each other – and therefore that this determination is conditional on the continued applicability of these texts and their content.
II.6.1.3. Regarding the principle of proportionality
218. The Litigation Chamber recalls that, pursuant to the principle of proportionality
enshrined in Article 6.1. c) of Directive 95/46/EC, only data that is adequate,
relevant, and not excessive to achieve the purpose may be processed. It is not sufficient
for them to be merely useful; less intrusive alternatives must be considered to satisfy this principle.
88
While the defendant also provides the written notification signed by both the Belgian State and the IRS, by which each Party (the Belgian State on the one hand, and the United States on the other) acknowledges compliance with its respective obligations, particularly in terms of confidentiality, this document is not such as to call into question the finding of the Disputes Chamber. Decision on the merits 79/2025 — 62/96
219. As the plaintiffs point out, the transfer of data to the IRS in the context of the implementation of the FATCA agreement is a system of automatic and annual transfer of data based on the criterion of US nationality and reportable bank accounts (Article 2 of the FATCA agreement and Article 5 of the Law of December 16, 2015) without any indication that any tax law has been violated. This is not a system of
ad hoc data transfers carried out at the request of the US authorities and
based on the presence of evidence requiring said data transfer given the
purposes pursued.
220. The Litigation Chamber is of the opinion that this system, as provided for in the
"FATCA" agreement, does not comply with the principle of proportionality, supported in particular by the
case law of the CJEU, which has already had the opportunity to indicate on several occasions,
including in preliminary rulings, how this principle should be applied in
the light of processing comparable to that complained of by the complainants. 221. Thus, in a judgment of April 8, 2014, the CJEU ruled that the retention
of data generated or processed in the context of the provision of publicly available
communication services or public communications networks was disproportionate, since
this obligation applied "even to persons for whom there is no evidence
of such a kind as to suggest that their conduct may have a link, even indirect or
89.
remote, with serious crime." It concluded that the EU legislature had exceeded
the limits imposed by compliance with the principle of proportionality under Articles 7, 8, and
52.1 of the Charter of Fundamental Rights of the EU and invalidated Directive 2006/24/EC on
this basis. 222. Following this ruling, the data protection authorities, including the CPP at the time,
meeting within Group 29, adopted the aforementioned Opinion WP234 at the end of 2015, in which
the Group argues that there is no reason to limit the CJEU's considerations solely to
measures adopted in the fight against terrorism. Other public policy measures
intended to pursue distinct objectives, in particular through the
collection of personal data, are also subject to the same compliance with the principle
of proportionality set out in Article 6.1.c) of Directive 95/46/EC, which was then applicable.
223. The data protection authorities insist on the necessary respect for this principle,
including in the context of FATCA, in the following terms: "While this
case concerned the necessity and proportionality of certain counter-terrorism measures,
the Article 29 Working Party is of the opinion that the balancing exercise prescribed by
the Court of Justice applies to any public policy implemented (including
cooperation policies in tax matters) that has an impact on the rights to
89 CJEU, judgment of 8 April 2014 C-293/12 and C-594/12, Digital Rights Ireland and Seitlinger and Others, ECLI:EU:C:2014:238, pt. 58:
https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:62012CJ0293 Decision on the merits 79/2025 — 63/96
protection of personal data. It is therefore imperative, in tax cooperation agreements, to demonstrate that the planned data exchange
is necessary and that it covers the minimum amount of data required to achieve
the intended objective." 90.
224. The Group of 29 further specifies that "consequently, tax cooperation agreements
should include provisions and criteria that explicitly link the exchange
of information, and in particular the communication of personal data
concerning financial accounts, to possible tax evasion and that exempt
low-risk accounts from reporting obligations. In this regard, these criteria should be
applied ex ante to determine which accounts (and information) should be
reported."
225. In 2017, the European Data Protection Supervisor (EDPS) 91 said the same thing when it emphasized in its Guide for Assessing the Necessity of Measures Limiting
the Fundamental Right to Data Protection 92 that "not all measures that
might prove useful for the given objective are desirable or
can be considered necessary in a democratic society. It is not enough for a measure to be merely convenient or cost-effective." The EDPS
also stated that the annual nature of the reporting pursuant to the "FATCA" agreement demonstrates that the reporting is not based on indications
of tax evasion or fraud, but rather is systematic. 93.
226. On February 24, 2022, the CJEU issued a judgment94 in which it expressly stated that a
widespread and indiscriminate collection of personal data for the purpose of combating
90
Group 29, Guidelines for Member States on the criteria to ensure compliance with data protection requirements in the
context of the automatic exchange of personal data for tax purposes, WP 234 of December 16, 2015. Emphasis added by the Litigation Chamber.
91
The European Data Protection Supervisor (EDPS) is the equivalent of a national data protection authority for the institutions of the European Union. See Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
92https://www.edps.europa.eu/sites/default/files/publication/17-06-01 necessity toolkit final fr.pdf
93
See also a 2018 study commissioned by the European Parliament which states that the reporting requirements under the FATCA agreement are not sufficiently limited in light of the risk of tax evasion. The study in question states that "in conclusion, the limitations introduced by FATCA within the European Union through IGAs [i.e., intergovernmental agreements] appear, at the current stage and in certain circumstances, to be neither necessary nor proportionate, insofar as they do not restrict the reporting obligations of individuals suspected of tax evasion. However, these limitations introduced by FATCA would constitute "necessary and proportionate measures" provided that the United States provides, on a case-by-case basis, evidence that American expatriates are using the Union's financial system to engage in tax evasion abroad. In the absence of such evidence, FATCA's limitations appear to go beyond what is strictly necessary to achieve the objective of combating tax evasion abroad." The updated version of this study concludes along the same lines
https://www.europarl.europa.eu/RegData/etudes/IDAN/2022/734765/IPOL IDA(2022)734765 EN.pdf
94
CJEU, Judgment of 24 February 2022, C-175/20, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), ECLI:EU:C:2022:124. See also the judgment C-817/19, Ligue des droits humains (PNR), already cited, of 21 June 2022: "115.
Regarding the principle of proportionality, the protection of the fundamental right to respect for private life at Union level
requires, in accordance with the Court's settled case law, that derogations from the protection of personal data and limitations thereof must be limited to what is strictly necessary. Furthermore, a general objective of combating tax evasion by a tax administration cannot be permitted. The administration
concerned must refrain from collecting data that is not strictly necessary
in view of the purposes of the processing (paragraph 74 of the judgment). The administration must also
examine whether its requests could be more targeted based on more
specific criteria.95 Thus, even in the exercise of the public interest mission with which the data controller
has been entrusted, the CJEU specifies that it cannot carry out data collection in a
generalized and indiscriminate manner and must consider the possibility of
more targeting its requests using specific criteria (paragraphs 74-76 of the judgment).
227. It also follows from this judgment that the recipient of the data request has an obligation
to examine the merits of the request and verify whether it is legally authorized to respond. Failing to do so, the recipient of the request risks violating its own obligations arising from the
right to data protection. 228. The defendant considers that this case law is irrelevant because this case does not involve either widespread and indiscriminate collection or subsequent transfers that could also be classified as such. According to the defendant, in accordance with the FATCA agreement, the data processing concerns a specific category of persons, namely those of American nationality, and among these, some would not be affected if the amount in their bank account does not reach the reportable threshold. However, the defendant emphasizes, the Constitutional Court specifically considered in its judgment of March 9, 2017 (see below) that "the collection of information in accordance with the FATCA agreement is proportionate insofar as the law defines in its annexes the criteria taken into account to determine which data must be communicated (…)." The Constitutional Court's ruling, according to the defendant, would therefore be all the more consistent with the 2022 CJEU ruling, which uses the same terms "proportionality" and "criteria."
229. The Litigation Chamber considers that, in line with the CJEU's 2014 case law cited above, the lessons of this ruling in Case C-175/2020 are, on the contrary, entirely relevant. Applied to the present case, it follows for the Litigation Chamber that,
as the data protection authorities emphasized immediately after the judgment of June 8, 2014, in order to respect the principle of proportionality in the context of an exchange of data—automatic, moreover—and unrelated to any tangible evidence of tax evasion, it is appropriate,
as a minimum criterion, to exclude the categories of persons or accounts that
may be exempted from the reporting obligation under "FATCA" as well as those that
may be prosecuted without taking into account the fact that it must be reconciled with the fundamental rights affected by the measure, by
performing a balanced balance between, on the one hand, the general objective and, on the other hand, the rights at stake." 95The CJEU makes these considerations with regard to the request made by the Latvian tax authorities to an economic operator to provide it, for a specified period, with data relating to advertisements for the sale of private cars published on its website, as well as to restore permanent access to the data relating to these sales advertisements and, failing this, to provide it with monthly data relating to said advertisements (paragraphs 14-16 of the judgment). Decision on the merits 79/2025 — 65/96
present a very low risk of tax evasion. Thus, if the targeted persons are in reality
not taxable in the United States under the tax regime applicable to non-residents, provided
that their foreign income does not exceed the threshold set, the transfer of their personal data
will not be proportionate. This situation is likely to apply to
Americans who are victims of accidents, precisely because they are non-residents.230. The transfer of data to the IRS, as opposed to specific processing upon ad hoc request, a priori concerns all persons of American nationality. The generalized nature of the processing must be assessed with regard to the recipients of the data themselves, who may form an identified group. If the stated purpose is to combat
tax evasion (at the very least, the assessment of proportionality being in any event made difficult given the lack of a sufficiently precise purpose (see
supra) based on American nationality) and the processing concerns the data -
even listed data - of all Americans residing abroad (in this case in Belgium), the
processing is generalized. Just as the CJEU considered that the
communication of data relating to the advertisements of all used vehicle sellers
or the permanent availability of this data via the Internet constituted a
generalized collection, similarly, the transfer of personal data of all
Americans living in Belgium is generalized.
231. The transfer to the IRS also appears to the Litigation Chamber to be very undifferentiated since
it targets all Americans, regardless of any evidence related to the purpose
for which the transfer to the IRS occurs, namely tax evasion, except "Exception" related to
reportable accounts. The Litigation Chamber emphasizes that, in its view, the
circumstance that the personal data to be collected and subsequently transferred are listed
is not a relevant and sufficient targeting "criterion" that differentiates the Americans
concerned with respect to this purpose.
232. The sole exception related to reportable accounts referred to in point A of Part I of Annex II
of the FATCA agreement is not, in reality, truly an exception, since banks
may exempt themselves from it. It is specified that "low-value accounts, in
this case less than US$50,000, are not subject to reporting procedures, unless the reporting financial institution decides otherwise."
233. If this option exists, it is because the transmission of data relating to these accounts is not
truly necessary within the meaning of Article 6.1.b) of Directive 95/46/EC. SCAF Resolution
52/2025 already stated in this regard: "The Committee therefore notes the optional nature
of this threshold. The applicant was, however, able to indicate that financial institutions had
confirmed their use of it. In order to avoid an excessive number of accounts being
reported to the United States, the Committee invites financial institutions to apply the threshold
of US$50,000 (…) to ensure proportionality of processing" (point 16 of Decision on the merits 79/2025 — 66/96
Resolution). While the SCAF certainly targets banks, its resolution is no less directed at the
defendant, which had been notified. In this regard, the defendant cannot, a fortiori given
Deliberation 52/2016, hide behind the behavior of banks that do not exercise the option granted to them, as it does in its submissions. Indeed, it is
incumbent upon the defendant, as data controller, to transfer only relevant and non-excessive (and therefore necessary) data to the IRS and to remind financial institutions of this duty. 234. In the context of automatic exchange, it was immediately identified, as early as the OECD Convention, that there was a risk of receiving irrelevant data and that this risk had to be avoided. 96. In the FATCA agreement, Annex II thus establishes the principle of a regular review of the categories of persons and/or reportable accounts (in view of the ceiling amount) that present a low risk of tax evasion, which should be excluded from the automatic exchange of data concerning them. Given this requirement, it is all the more questionable that the defendant transfers the personal data of non-reportable account holders on the grounds that the banks would collect it and/or that it would not have access to the content of the data. How can the defendant then, as it denies to the IS in particular, ensure compliance with the principle of minimization? 235. To the extent necessary, the Litigation Chamber notes that this judgment is indeed
post-date May 24, 2016, as are certain documents that the Litigation Chamber
mentioned above. For the reasons it set out in Section II.5, including the ex tunc effect of
judgments delivered on preliminary questions, the Litigation Chamber takes into account the
way in which the key concepts of data protection are interpreted by the CJEU,
including the interpretation given to the concepts of the GDPR that are common to
Directive 95/46/EC, and even more so when, as in this case, it is merely a
confirmation, this time in a tax context, of case law existing since 2014.
96Excerpt from the Explanatory Report to the OECD Convention (Article 6): 62. A characteristic feature of automatic exchanges of information is that they cover a large amount of specific information of the same nature, usually relating to payments from the State providing the information and to taxes withheld at source in that State. Information of this type can be obtained periodically, within the framework of that State's own system, and transmitted systematically and regularly. Automatic exchange of information makes it possible to improve tax accuracy and detect fraud that might otherwise have remained unsuspected. States must strive to exchange information as efficiently as possible, given its significant volume. 63. If taxpayers are aware of this arrangement and, consequently, of the nature of the information exchanged, they will be more likely to comply with their tax obligations, and the number of cases and the amount of reductions in income tax returns should decrease after a few years. However, there may be ways to maximize efficiency and minimize costs, for example, by limiting automatic exchange to areas where tax compliance is weakest, by changing the nature of the information exchanged after a few years of exchange, and by using standardized forms (see also paragraph 66 below). In this regard, Annex II of the FATCA agreement: “This Annex II may be modified by a mutual written decision entered into between the Competent Authorities of Belgium and the United States: (1) to include additional entities and accounts that present a low risk of being used by U.S. persons to evade U.S. tax and that have similar characteristics to the entities and accounts described in this Annex II as of the date of signature of the Agreement.” Decision on the merits 79/2025 — 67/96
236. In support of the CJEU case law it has just set out, applied to the present case,
the Litigation Chamber notes that the principle of proportionality enshrined in Article
6.1(b) of Directive 95/46/EC is not respected. The defendant fails to demonstrate that
only adequate, relevant, and non-excessive personal data, even if such data
is listed (whether in the FATCA agreement (Article 2.2) or in the Law of December 16, 2015 (Article 5)), is transferred to the IRS, as their transfer is, in certain
circumstances, not likely to achieve the intended purpose (without prejudice to the
considerations made by the Litigation Chamber regarding the purpose). 237. Given the legal primacy of this CJEU case law with regard to the principle of proportionality, the Litigation Chamber can only note that the opinions of the CVP, the deliberations of the CSAF, the deliberations of the CNIL, or the decision of the French Council of State of July 19, 2019, could not form the basis for the defendant's belief that the FATCA agreement was indeed compliant with EU law applicable on May 24, 2016.
The defendant cannot rely on them since their conclusions, on proportionality in particular, are contrary to what the CJEU expects in terms of compliance with this principle.
This also applies to the judgment of the Constitutional Court of March 9, 2017, on which the defendant relies in particular. In this regard, the Litigation Chamber notes that, in any event, this judgment could not support the defendant's belief that the FATCA agreement and the Law of 16 December 2015 comply with EU law applicable on 24 May 2016. Given the ground of appeal before the Court 99, the Litigation Chamber considers that it can only be inferred that, by concluding as it did that the interference met the conditions of Article 8(2) of the ECHR – without ruling on Article 8 of the Charter of Fundamental Rights, which was referred to in ground of appeal 100 – the Constitutional Court would also have concluded that not only the Law of 15 December 2016, but also the FATCA agreement, were in conformity with both Directive 95/46/EC exhaustively and the Charter of Fundamental Rights. fundamental rights of the EU.98 See, for example, regarding this primacy: CJEU, judgment of 14 September 2017, C-628/75, The Trustees of the BT Pension Scheme and the references cited: ECLI:EU:C:2017:687
99
In its judgment of 9 March 2017, the Constitutional Court responded in particular to a fifth ground of appeal "based on the violation of Article 12 of the contested law (i.e., the Law of 16 December 2015), Article 8 of the European Convention on Human Rights, Articles 7, 8, and 52 of the Charter of Fundamental Rights of the European Union, and Article 4, paragraph 3 of the Law of 8 December 1992 on the protection of privacy with regard to the processing of personal data." In this regard, Article 4.1, paragraph 3, reads as follows: "Personal data must be adequate, relevant, and not excessive in relation to the purposes for which they are obtained and for which they are subsequently processed."
100
As for the examination in light of the EU Charter of Fundamental Rights, the Litigation Chamber finds no trace of it in the judgment. However, Article 8 of the EU Charter of Fundamental Rights offers broader protection than Article 8 of the ECHR, including the principle of purpose (8.2) and the requirement of independent review (8.3). Article 52.3 of the Charter of Fundamental Rights states that "to the extent that this Charter contains rights
corresponding to rights guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms, their meaning and scope shall be the same as those conferred on them by that Convention. This provision shall not prevent Union law from granting more extensive protection." Decision on the merits 79/2025 — 68/96
238. The Litigation Chamber also notes that the Constitutional Court concluded that this argument is unfounded, based in particular on the consideration that "the collection of information
helps achieve the objective of the law and is proportionate to the extent
that the law defines in its annexes the criteria taken into account to determine which data
must be communicated (point A of Part I of Annex II)." For the Litigation Chamber, the objective of the law does not constitute a processing purpose, and the data listed are not a criterion (paragraph 236). Regarding the reference to Annex II cited above, this is, as already mentioned, merely an option (paragraphs 232-233). The Litigation Chamber is aware that annulment judgments of the Constitutional Court dismissing applications for annulment are binding on the courts with regard to the legal issues decided by these judgments. As already mentioned, this must, however, give way to the primacy of EU law (including the case law of the CJEU).
II.6.1.4. Other safeguards for the benefit of data subjects
239. In addition to the fact that the data processing it provides for must comply with the principles of
purpose and proportionality already discussed, the FATCA agreement must, in order to meet the
condition of Article 96 of the GDPR and as provided for in Recital 102, contain a number
of other safeguards for the benefit of data subjects. The
failures alone of the principles of purpose and proportionality render the
transfer unlawful under the FATCA agreement and the Law of December 16, 2015. However, the
Litigation Chamber notes, without being exhaustive in this regard, that other safeguards
required in the agreement are lacking. 240. In its WP 234 opinion, cited above, Working Party 29 identified these guarantees resulting from
the application of Directive 95/46/EC with regard to automatic data transfers for tax purposes.
241. Thus, in addition to the principles of purpose and proportionality, WP 34 upholds the requirement of proportionality in retention periods (Article 6.1 of the opinion). The Litigation
Section will also examine compliance with this principle from the perspective of the GDPR, and the
considerations it sets out in paragraph 259 also apply with regard to Directive
95/46/EC, as the GDPR has not changed the requirements of this principle. A retention period is not provided for, even by reference to relevant parameters, in
the FATCA agreement. There is no commitment from the IRS regarding this. Decision on the merits 79/2025 — 69/96
242. WP234 also maintains a transparency requirement. Information in accordance with
Articles 10 and 11 of Directive 95/46/EC must be provided in the agreement. 10. Here too, the
Litigation Chamber refers to its examination of this point with regard to the GDPR
(paragraphs 262 et seq.). Even if the information elements required by Directive 95/46/EC are
more limited than those required by Article 14 of the GDPR, the "FATCA" agreement does not contain any
guarantees in terms of information, particularly from the IRS.
II.6.1.5. Conclusion on Compliance with EU Law Applicable as of May 24, 2016
243. In support of the foregoing, the Litigation Chamber is of the opinion that the evidence relied on
by the defendant in support of the compliance of the FATCA agreement with EU law as of
May 24, 2016, did not allow it to conclude that it could continue to transfer
the data to the IRS by relying on Article 96 of the GDPR. The defendant does not
prove that the conditions for the application of Article 96 were and are met, or that
the FATCA agreement alone, and even with the Law of December 16, 2015, complies with
EU law applicable as of May 24, 2016.
II.6.2. Transfers to the IRS and Compliance with the GDPR
II.6.2.1. Principles
244. It follows from the above that the FATCA agreement is currently no more
compliant with the GDPR than it was with EU law before May 24, 2016, with regard to the
principles of purpose and minimization enshrined in Articles 5.1.b) and 5.1.c) of the GDPR
which translate into the GDPR the principles of purpose and proportionality of Articles
6.1.b) and 6.1.c) of the GDPR. However, the Litigation Chamber has just concluded that the data transfers carried out under the "FATCA" agreement were neither compliant with Article 6.1.b) nor
with Article 6.1.c) of Directive 95/46/EC nor with Articles 8 and 52 of the Charter of Fundamental Rights of the EU (Titles II.6.1.3 and II.6.1.4).
245. The transfer of data to the IRS also does not meet the requirements of
the regulation of transborder data flows to third countries such as the United States, as required by Chapter V of the GDPR.
10. "Clear and appropriate information should place data subjects in a position to understand what is being applied to their personal data and how to exercise their rights, as provided for by Articles 10 and 11 of the Directive." (Translation: Clear and appropriate information should enable data subjects to understand what happens to their personal data and how to exercise their rights, as provided for in Articles 10 and 11 of the Directive).
102 A third country is any country that is not a member of the European Economic Area (EEA). The transfer of the first complainant's personal data by the defendant to the IRS is a transfer to a third country within the meaning of the GDPR. Decision on the merits 79/2025 — 70/96
246. As the parties emphasize in their respective submissions, Chapter V of the GDPR
establishes a cascade system between different instruments that can be used by a data controller or processor to transfer personal data
103
to a third country. This system is in line with the data transfer regime
provided for by Directive 95/46/EC.104 Thus, in the absence of an adequacy decision within the meaning of
Article 45 of the GDPR, the data controller may only transfer personal data
to a third country if it has provided appropriate safeguards and provided
that the data subjects have enforceable rights and effective legal remedies
within the meaning of Article 46.1 of the GDPR. These appropriate safeguards may take various forms
including a legally binding instrument (Article 46.2. a) of the GDPR).
Finally, in the absence of an adequacy decision and appropriate safeguards, a transfer of
data to a third country may only take place if one of the exemptions listed in Article
49 of the GDPR applies. If the requirements of Articles 45 to 49 of the GDPR are not met, the transfer of personal data to a country outside the EEA is prohibited. 247. It is not disputed that there is no adequacy decision covering the transfer of
the data of the first complainant (and more broadly of the Belgian accidental Americans (whose interests the
second complainant is defending) to the IRS in the United States, since the
"Privacy Shield" decision105 – invalidated by the CJEU in the aforementioned "Schrems II" ruling –
does not apply to this type of transfer, nor does the adequacy decision of
July 10, 202310, which the parties do not dispute.
II.6.2.2. Application of Articles 46.1 and 46.2. a) of the GDPR
248. It has already been mentioned that, without prejudice to Article 96 of the GDPR, which it relies on as
principal ground, the defendant In this case, the company relies on Article 46.2.a) of the GDPR since the transfer of the defendant's data to the IRS, which it carries out, is based on a legally binding and enforceable instrument between the company and the IRS that does not require any authorization from the DPA, namely the "FATCA" agreement on the one hand and the Law of December 16, 2015 on the other.249. It follows from Article 46.2. a) of the GDPR that appropriate safeguards must be included in
the legally binding instrument. 107Article 46.2. a) is indeed worded as follows:
10See Kuner, in Kuner a.o. The EU General Data Protection Regulation: A Commentary, OUP 2020, p. 846.
104
For a comparison between Directive 95/46/EC and the GDPR, see Kuner, in Kuner a.o. The EU General Data Protection Regulation: A Commentary, OUP 2020, p. 758.
105 Commission Implementing Decision (EU) 2016/1250 of 12 July 2016, in accordance with Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield Framework, OJ 2016, L 207/1.
106 Commission Implementing Decision (EU) 2023/12795 of 10 July 2023, establishing, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the adequate level of protection of personal data provided by the EU-US data protection framework, OJ EC of 20 September 2023, L-231/118.
107 See Also the EDPS Guidelines 02/2020 already cited, p. 21 et seq. Decision on the merits 79/2025 — 71/96
"appropriate safeguards (...) may be provided (...) by a legally binding and enforceable instrument between public authorities or bodies." They may be based on a binding national legal standard, but the reference to it must be express.
250. Although these appropriate safeguards are not mentioned as such in Article
46 of the GDPR or in Recital 108 thereof, they must be such as to ensure that the individuals whose personal data are transferred to a third country
benefit from a level of protection substantially equivalent to that guaranteed within the EU by the GDPR and that this level of protection is not compromised.
111
251. In its Guidelines 02/2020, the EDPB lists, in support of Article 44 of the GDPR and
the case law of the CJEU, in particular the aforementioned Schrems II judgment, the minimum guarantees
that must be included in the binding legal instrument (Article 46.2.a)
of the GDPR).
252. These reinforce those that Working Party 29 had already explained in its WP 234
as early as 2015. More than recommendations, these are minimum guarantees that must
be included in the international agreement implementing Article 42.a) and for which it is the
responsibility of the defendant to demonstrate that they are actually in place and
continuously effective. The EDPB includes the enforceable rights and effective remedies required
by Article 46.1 of the GDPR, as already cited.
253. These minimum requirements concern, in particular, (1) the definitions of basic concepts,
(2) the basic principles of data protection, (3) the rights of data subjects, (4) the limitation of onward transfer and sharing of data,
(5) effective remedies, (6) control mechanisms, and (7) accountability.
254. The Litigation Chamber will not exhaustively examine each of the minimum guarantees
that must be provided by the FATCA agreement. Indeed, the absence of a certain number of them is sufficient to conclude that transfers made on the basis of
it are unlawful.
255. Definition of basic concepts (point 2.2. of the EDPB Guidelines): it is
essential that the parties agree on the definition of the key concepts of data processing
108
This is emphasized by the Litigation Chamber.
10See point 14 of the EDPB Guidelines 02/2020.
110
See to this effect the CJEU judgment of 16 July 2020, C-311/18, Facebook Ireland and Maximilian Schrems (Schrems II judgment), paragraphs 92 and 96; EDPB Guidelines 2/2020, points 6 and 12
11 EDPB, Guidelines 2/2020 of 15 December 2020 relating to Article 46(2)(a) and (3)(b) of Regulation (EU) 2016/679 for transfers of personal data between public authorities and bodies established within the EEA and those established outside the EEA: https://www.edpb.europa.eu/system/files/2021-
06/edpb guidelines 202002 art46guidelines internationaltransferspublicbodies v2 fr.pdf (point 12). Decision on the substance 79/2025 — 72/96
data provided for by the agreement between them and that these concepts are defined therein. Failing this,
the effectiveness of any other safeguards could be compromised. The EDPB thus lists the
definitions of the following important concepts: "personal data",
"processing of personal data", "data controller", "processor", "recipient", and "sensitive data".
256. The Litigation Chamber notes that the FATCA agreement contains none. While Article
1 of the agreement is exclusively dedicated to definitions (1 (a) to (z) + (aaa) to (mm), none
relates to data protection concepts, even though the very principle of the agreement
is based on a sequence of personal data processing operations. The agreement
refers to "information", which demonstrates the importance of agreeing on what
constitutes personal data, if any. Thus, while the defendant is bound by the definitions contained in the GDPR (and the Law of December 16, 2015), this is not the case for the IRS, which will receive the data. The agreement also makes no reference to any US legislation that would define these concepts.
113
257. Purpose limitation principle (point 2.3.1 of the EDPB Guidelines): on this point, the Litigation Chamber refers to its conclusions in Section II.6.1.3 above. Furthermore, the FATCA agreement does not specify the type of data processing that is transferred and processed under the agreement. 114
115 116
258. Principle of minimization and accuracy (point 2.3.2 of the EDPB Guidelines):
Regarding compliance with the principle of minimization, the Litigation Chamber refers to its conclusions above (section II.6.1.4).
11 Point 16 of the EDPB Guidelines 02/2020.
113
See page 6 of WP234 and point 18 of the EDPB Guidelines 02/2020: the international agreement must delimit its scope and specify the purposes for which the personal data are processed (transferred), including compatible purposes for further processing, and ensure that the data will not be further processed for incompatible purposes.
114
See Section 2.1 of the EDPB Guidelines 02/2020.
115 See page 6 of WP234 and points 21 and 22 of the EDPB Guidelines 02/2020. The categories of personal data transferred and processed pursuant to the agreement must be clearly mentioned in the international agreement, while ensuring that this mention only concerns data that are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are transmitted and subsequently processed. In practice, compliance with this principle prevents the transfer of inadequate or excessive data. Furthermore, the transferred data should be accurate and up-to-date in relation to the purposes for which they are processed. It is therefore important that the international agreement provide that the transferring party must ensure that the data transferred under the agreement are accurate and, where appropriate, up-to-date.
116Furthermore, the agreement should provide that, if one of the parties learns that inaccurate or outdated data has been transmitted or is being processed, that party must inform the other party without delay. Finally, the agreement should ensure that when it is confirmed that the data transmitted or processed are inaccurate, each party processing the data will take all reasonable steps to rectify or erase the data. Decision on the merits 79/2025 — 73/96
117 118
259. Principle of limited retention (point 2.3.3 of the EDPB Guidelines):
The Litigation Chamber notes that the FATCA agreement contains no commitment
regarding the limited retention of data processed and transferred in execution of the agreement
nor a maximum retention period. Admittedly, as the defendant emphasizes in its
submissions, the Law of December 16, 2015, provides for a retention period of seven years
in its own right (Article 15.3 of said law). This period provided for by Belgian law is binding only
on the defendant. This does not demonstrate that the IRS would be required to maintain a proportionate retention period
for the transferred data as well. However, the data must remain
protected once in the United States, which the defendant must, as mentioned,
ensure. In its submissions, the defendant provides a table listing a number of retention periods applicable to the IRS, which it describes as "guidelines," including one period that it states is "generally" five years (point 66 of the defendant's second additional and summary submissions).
Besides the fact that nothing is included in the agreement itself, the Disputes Chamber is unable
to assess the proportionality of these deadlines with regard to the purposes of the processing.
119
260. Rights of data subjects: In accordance with Article 46.1 of the GDPR and
recital 108, the international agreement must guarantee enforceable and effective rights for
the data subject. This implies that the agreement should include all the rights enjoyed by
data subjects, including the specific commitments made by the
Parties to guarantee these rights. For these rights to be effective, the international agreement must
provide mechanisms to ensure their application in practice. Furthermore, any
violation of the data subject's rights must be accompanied by an appropriate remedy. 120
11 See pages 6 and 7 of WP234 and point 24 of the EDPB Guidelines 02/2020: the international agreement must contain a data retention clause. This clause must specify, in particular, that personal data are only kept in a form that allows identification of data subjects for the period necessary for the purposes for which they were transferred and subsequently processed. Where a maximum retention period is not set in the national legislation of the parties, a maximum period should be set in the text of the agreement.
118
On the importance of setting a compliant retention period, see Opinion 2/2015 issued by the European Data Protection Supervisor (EDPS) on the agreement between the EU and Switzerland on the automatic exchange of tax information:
"Indicating an explicit retention period for the personal data collected and exchanged would have ensured that the data were retained for the period strictly necessary to pursue legitimate policy objectives and, once this was done, that they were deleted, thus fully restoring individual rights. Otherwise, the large-scale and continuous exchange of tax information about citizens would result in a vast archive that would be difficult to control and potentially harmful to citizens."
https://www.edps.europa.eu/sites/default/files/publication/15-07-08 eu switzerland exsum fr.pdf and
https://www.edps.europa.eu/sites/default/files/publication/15-07-08 eu switzerland fr.pdf
119 See page 7 of WP 234 and section 2.4. points 27 et seq. of the EDPS Guidelines 02/2020.
120 In this regard, the EDPS specifies that the international agreement must clearly describe the parties' obligations regarding transparency (section 2.4.1 of the EDPS Guidelines). The agreement must also guarantee the data subject the right to obtain information on all personal data processed and to have access to it. Finally, the agreement must include a clause stating that the receiving organization will not make any automated individual decisions, including profiling, producing legal effects concerning the data subject or significantly affecting them solely on the basis of automated processing within the meaning of Article 22 of the GDPR. When the purpose of the transfer includes the possibility for the receiving organization to make such decisions, the conditions for such decision-making must be defined in the agreement and comply with Article 22(2-4) of the GDPR. Decision on the merits 79/2025 — 74/96
261. The Litigation Chamber notes that the "FATCA" agreement does not contain any mention of the data subject's rights, whether the right to information, the right of access, the right
of rectification, the right to erasure, the right to restriction, or the right to object. It does not
contain any further indication of when they may be invoked or the terms and conditions for exercising them.
262. As for the right to information, which is absent from the FATCA agreement, the defendant cannot argue
that this information obligation results from the Law of December 16, 2015
or the GDPR, since its position is precisely that it is exempt from providing this information since it falls exclusively to the banks (see Title II.6.3).
However, the minimum guarantee required by Article 46.2.a) of the GDPR is worded as follows:
"the public body transferring the data (here, the defendant) should inform the data subjects individually in accordance with the notification requirements set out in Articles 13 and 14 of the GDPR," specifying in this regard that "a general information notice on the website of the public body in question will not be sufficient."
263. An information obligation should also apply to the IRS to which the data is transferred pursuant to the agreement. In this regard, the defendant does not demonstrate that
this requirement is met, and as stated, this information duty does not arise from the agreement.
264. As for the other rights, the Litigation Chamber can only note that they are neither included in the agreement nor arising from the texts to which the agreement refers. The Litigation Chamber
notes that the plaintiffs emphasize that the IRS website, which deals with
the "FATCA" agreement, does not contain any information about these rights. Regarding the right
of access (a pillar of data protection law), the international agreement should specify
that individuals have the right to request confirmation from the receiving public body whether
personal data concerning them is being processed and, if so, to have access to this data
as well as to specific information regarding the processing, including the
purpose, categories of data, recipients of the data, retention periods
and remedies. This is not the case.
265. With particular regard to the required reference to Article 22 of the GDPR, the
defendant argues that it does not carry out processing operations that fall under this provision. This circumstance, even if verified, is irrelevant. Indeed, what is required
as a guarantee in the agreement is the commitment of the Parties, including the
recipient of the data (i.e., the IRS), not to carry out this type of processing in particular
(hence the importance, as mentioned, of identifying the types of processing as
indicated in point 257). This guarantee is not provided by the agreement. Decision on the merits 79/2025 — 75/96
266. Since the rights of data subjects are neither enshrined in nor fall within the scope of the agreement
"FATCA" - Article 46.1. a) of the GDPR is not satisfied, which, as a reminder, requires "that data
subjects have enforceable rights and effective legal remedies." The
defendant still fails to demonstrate that these rights are actually enforceable
and effective.
267. As for remedies 121: in order to guarantee these enforceable and effective rights, the agreement
must provide for a system that allows data subjects to continue to benefit from
recourse mechanisms after their data has been transferred to a country outside
the EEA. These recourse mechanisms must allow data subjects whose
rights have been violated to file a complaint and have it resolved.
268. The Litigation Chamber can only note on this point that the defendant has
not demonstrated that such recourse mechanisms would exist for the benefit of the data
affected by the processing complained of once the data has been transferred, including
accidental Belgian Americans.
122
269. Monitoring mechanism: In order to ensure that all obligations created under
the international agreement are respected, the agreement must provide for independent monitoring to verify
that it is being implemented correctly and to monitor violations of the rights provided for in
this agreement. The Litigation Chamber notes that no evidence has been provided by the
defendant on this point other than the reference to a peer review system (response to
question 2 of the IS – supplementary investigation report), which does not provide the required
guarantees. Such a mechanism is not provided for in the agreement.
II.6.2.3. Conclusion
270. Under the terms of "Sufficient Guarantees," the defendant relies on the opinions
of the CPVP, the authorization of the SCAF, and the judgment of the Constitutional Court of March 9, 2017, which
the Litigation Chamber already dismissed during the discussion on the principles of
purpose and proportionality. These defenses are therefore not of a nature to call
into question the Litigation Chamber's finding that many of the guarantees required by
Article 46.2. a) of the GDPR are lacking, since these guarantees specifically include compliance
with the principle of proportionality, on the one hand, and it has not been demonstrated that the condition of
Article 46.1 of the GDPR (effective and enforceable rights accompanied by remedies) is
satisfied. 271. As the IS points out (page 3/22 of its supplementary report), Article 3.7 of the agreement
"FATCA" refers to the confidentiality obligations and other guarantees provided for by
Points 50 et seq. of the EDPB Guidelines 02/2020.12. Points 56 et seq. of the EDPB Guidelines 02/2020. Decision on the merits 79/2025 — 76/96
OECD Convention (Articles 21 and 22). The IS further notes that Article 3.8 of the FATCA agreement provides that each competent authority shall notify the other in writing when it is satisfied that the other has implemented appropriate safeguards (page 3/22 of the IS's supplementary investigation report).
272. The defendant did indeed produce this document entitled "Notification of Adequacy of Data Safeguards and Infrastructure," signed by both itself and the IRS, on January 10, 2017 for the defendant and January 24, 2017 for the IRS, respectively.
The said notification reads as follows:
"This constitutes the notification required by Article 3.8 of the Agreement between the
Government of the United States of America and the Kingdom of Belgium to
Improve International Tax Compliance and Implement Fatca (the "Agreement") and, once signed, will serve to inform the other party that
our respective jurisdictions have in place (i) appropriate safeguards to
ensure that information received under the Agreement will remain
confidential and will be used only for tax purposes and (ii) the infrastructure
necessary for an effective exchange relationship, including established processes to
ensure timely, accurate, and confidential exchanges of information,
effective and reliable communications, and demonstrated capabilities to promptly resolve
questions and concerns regarding exchanges or exchange requests and to administer the provisions of Article 5 of
the Agreement." 273. The Litigation Division notes that this notification was signed in 2017 and that no indication has been given to the Litigation Division that the commitments made under this notification, which is more than eight years old, are maintained and updated. More importantly, the content of this notification does not provide guarantees equivalent to those required by Articles 46.1 and 46.2.a) of the GDPR. Thus, with regard to compliance with the purpose, the Litigation Division has, in any event, challenged the sufficiently specific and determined nature of the "tax purposes" to which the text refers and for which the data could be processed once transferred (the same provisions specified by Article 17 of the Law of December 16, 2015). "Confidentiality" (apart from not being further specified in what it covers), the commitments made with regard to "infrastructure," as well as the reference to Article 5 of the agreement, while referring to security commitments, do not concern the guarantees that the Litigation Chamber found lacking in the FATCA agreement, such as retention limitations, recognition of rights, remedies, or a monitoring mechanism.
12See. In this regard, DPA Opinion 51/2024, already cited in note 67. Decision on the merits 79/2025 — 77/96
The "Competent Authority Arrangement" mentioned in the IS, as well as the Data Safeguard
Workbook (also mentioned in the IS with regard to the preliminary analysis mentioned in Section II.6.4 and
which the DPA itself indicates relates to security), which are linked to this Article 3.8, are not
likely to change the Disputes Chamber's point of view. Indeed, they precisely implement
— without their binding status being attested to—Article 3.8, the content of which
is deemed insufficiently aligned with the guarantees required by Articles 46.1 and 46.2. a) of the
GDPR. 274. In conclusion, the Litigation Chamber notes, in support of the above, as
124
the Slovak Data Protection Authority had similarly done before it, that the
defendant has not demonstrated that the appropriate safeguards required by Article 46.2. a)
of the GDPR (as well as Article 46.1) that it is relying on are provided by the FATCA agreement.
Consequently, the Litigation Chamber finds a violation of Articles 46.1 and 46.2. a)
on the part of the defendant.
II.6.2.4. As to Article 49 of the GDPR
275. The Litigation Chamber notes that in its decision of October 4, 2021, the defendant
relyed on Article 49.1.d) of the GDPR (point 18). In the context of the present proceedings,
it invokes Article 46.2.a) of the GDPR. Thus, while initially,
it invoked the exception of Article 49.1.d) of the GDPR, which presupposes the absence of safeguards
as explained above in light of the GDPR's cascade system, the defendant
then invokes Article 46.2.a) of the GDPR and argues that the appropriate required safeguards
are all in place. It ultimately concludes that, in reality, Article 49.1.d) of the GDPR cannot
be applied in this case (point 50 of the defendant's second summary submissions).
276. To the extent necessary, the Litigation Chamber rejects the application of Article 49.1.d)
of the GDPR in this case. It reiterates that this exemption - necessarily interpreted restrictively - applies only when transfers are authorized for reasons of substantial public interest in a spirit of reciprocity, which transfers cannot, however, take place on a large scale and systematically, as is the case in this case. Indeed, it is necessary to respect the general principle that exemptions from Article 49.1(d) cannot become "the rule" in practice but must be limited to...
12 Opinion of the Office for Personal Data Protection of the Slovak Republic, dated August 23, 2022, addressed to the Ministry of Finance of the Slovak Republic (unofficial translation into French). This opinion follows the request for an assessment of the GDPR compliance of international agreements on the exchange of tax information made by the EDPB in its Statement 04/2021. The Slovak DPA concludes in this regard that, with regard to the transfer to the US authorities, the conditions of Chapter V of the GDPR are not met. The appropriate safeguards, as set out by the EDPB in its Guidelines 02/2020, are not provided for in the FATCA agreement as required by Article 46.2.a) of the GDPR. Decision on the merits 79/2025 — 78/96
Special situations 12. Each data exporter must also ensure that the transfer meets the strict necessity/minimization test. The Litigation Chamber concluded
in Section II.6.1.3 that the transfer to the IRS by the defendant did not pass this test.
II.6.3. Regarding compliance with the information obligation
277. For the reasons set out in paragraph 160 above and also resulting from the finding made in
paragraph 242, the Litigation Chamber considers that Article 14 of the GDPR applies to the
defendant independently of Article 96 of the GDPR.
278. In this case, since it concerns personal data that it did not obtain
directly from the first complainant—since it obtained them from financial institutions
(this is referred to as indirect collection)—the defendant, as data controller,
unless it can rely on an exception, must comply with Article 14 of the GDPR,
combined with the requirements of Article 12 of the GDPR with regard to the transfer of personal data
to the IRS.
279. The information to be provided pursuant to Article 14 of the GDPR is as follows:
the identity and contact details of the data controller and, where applicable,
their representative (Article 14.1. a)); where applicable, the contact details of the Data Protection Officer (DPO)
(Article 14.1. b)); the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing (Article
14.1.c)); the categories of personal data concerned (Article 14.1.d)); where applicable,
the recipients or categories of recipients of personal data (Article 14.1.e)); where applicable, the fact that the controller intends
to transfer personal data to a recipient in a third country or an international organization, and the existence or absence of an adequacy decision issued by the [European] Commission, or, in the case of transfers referred to in
Article 46 or 47, or the second subparagraph of Article 49(1), a reference to the appropriate or suitable safeguards and the means of obtaining a copy or the location where they have been made available (Article 14.1.f)); the period for which the personal data will be stored or, where this is not possible, the criteria used to determine this period (Article 14.2.a)); When processing is based on Article 6.1.f), the
legitimate interests pursued by the controller or by a third party (Article 14.2.b));
125 EDPB, Guidelines 2/2018 of 25 May 2018 on the derogations provided for in Article 49 of Regulation (EU) 2016/679: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb guidelines 2 2018 derogations fr.pdf
12 Data protection authorities have agreed in this regard that all information in Article 14 of the GDPR,
whether required by Section 1 or Section 2, must be communicated to the data subject when relevant
to the processing carried out.Working Party 29, Guidelines on Transparency within the meaning of Regulation EU 2016/679, WP260
(point 23): https://ec.europa.eu/newsroom/article29/items/622227 These Guidelines were endorsed by the EDPS at its inaugural meeting on 25 May 2018:
https://edpb.europa.eu/sites/default/files/files/news/endorsement of wp29 documents.pdf Decision on the merits 79/2025 — 79/96
the existence of the right to request from the controller access to, rectification or erasure of, or restriction of processing of personal data relating to the data subject, as well as the right to object to processing and the right to data portability (Article 14.2.c)); When processing is based on
Article 6.1.a) or Article 9.2.a), the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given
before its withdrawal (Article 14.2.d)); the right to lodge a complaint
with a supervisory authority (Article 14.2.e)); the source from which the personal data originate and, where applicable, a statement indicating whether or not they originate from publicly available sources (Article 14.2.f)) and the existence of automated decision-making, including profiling, referred to in Articles 22.1 and 22.4 and, at least in such cases, meaningful information about the logic involved, as well as the significance and the anticipated consequences of such processing for the data subject (Article 14.2.g)).
127
280. In support of Article 14.1 of the Law of 16 December 2015, the defendant concludes that it was the banks that were legally responsible for informing the first complainant, not the defendant itself.
It states that in this case, Bank Z also informed the latter. The defendant
adds that, despite the absence of any obligation on its part, it nonetheless informs the
data subjects of transfers to the IRS via its website.
281. The Litigation Chamber is of the opinion that the obligation to provide information on the part of the banks
does not ipsofacto exempt the defendant from its obligation with regard to the processing it
carries out in its capacity as data controller, in particular the transfer of
data to the IRS. Indeed, even though Bank Z is legally required to inform the first
complainant in accordance with Article 14.1 of the Law of December 16, 2015, Z was not required
to provide all the information that the defendant must provide with regard
to its own processing.
282. The exemption from providing information provided for in Article 14.5. a) of the GDPR, according to which the controller
must inform the data subject "except when and to the extent that" they already have
128
this information, must also apply within the strict limits of the text. It goes without saying that
Article 14.5.a) of the GDPR can only be invoked if the information has already been provided
in relation to the same processing in question.
12Article 14.1 of the Law of 16 December 2015 requires reporting institutions (i.e., banks) to inform data subjects
"that the information referred to by the law will be communicated to the competent Belgian authority."
128This exemption may therefore only apply to certain elements of information. This is what follows from the unequivocal use of the terms "insofar as" Working Party 29, Guidelines on Transparency within the meaning of EU Regulation 2016/679, WP260 (point 56): https://ec.europa.eu/newsroom/article29/items/622227 These Guidelines were adopted by the EDPS at its inaugural meeting on 25 May 2018: https://edpb.europa.eu/sites/default/files/files/news/endorsement of wp29 documents.pdf Decision on the substance 79/2025 — 80/96
283. To be able to rely on Article 14.5. a) of the GDPR, the defendant must therefore demonstrate
that the banks provide information on the elements of its own processing, namely the transfer to
the IRS, AND that all the relevant elements of Article 14 of the GDPR with regard to the latter
processing are covered (in principle, only the elements of Articles 14.2b) and 14.2.d) are automatically
excluded). 284. In this regard, the Disputes Chamber notes that Article 14.1 of the Law of December 16, 2015, does not provide for all the elements required by Article 14.1-2 of the GDPR. The elements listed in Article 14.1 of the Law of December 16, 2015, are relatively limited: a) the purposes of the disclosure of personal data, b) the ultimate recipient or recipients of the personal data, c) the reportable accounts for which the personal data are disclosed, d) the existence of a right to obtain, upon request, disclosure of the specific data that will be or have been disclosed concerning a reportable account and the procedures for exercising this right, and (e) the existence of a right to rectify the personal data concerning the individual and the procedures for exercising this right. 285. The defendant's argument that it is the banks alone that are responsible
for providing information (even if their obligation arises from the Law of December 16, 2015) cannot therefore be accepted. 286. Regarding the information provided in the event to the complainant, the Litigation Chamber notes,
in support of the documents provided, that certain information was indeed
provided to the complainant (paragraphs 11-13) but does not cover everything required by Article
14.1-2 of the GDPR with regard to the transfer to the IRS. Thus, the safeguards governing the transfer
to the IRS are not mentioned by Bank Z (Article 14.1.f) of the GDPR), nor are the
contact details of the defendant's DPO (Article 14.1.b)), the right to lodge a complaint with
the DPA (Article 14.2.e), or the terms and conditions for exercising or the limits of the right of access (Article 14.2.
c)). The Litigation Division also notes that one of the letters refers to the FPS Finance for further information, which is in total contradiction with the defendant's position that it is the banks' sole responsibility to provide information (point 11) and demonstrates the defendant's admittedly limited but definite role, and in any case, based on complaints from the persons concerned, that of ensuring that the banks comply with their duty to inform. 287. Article 14.5.c) of the GDPR (the applicability of which the complainants reject, without it being invoked by the defendant) also provides that the information elements listed in paragraphs 1 and 2 must not be provided to the data subject when "the obtaining
or communication of the information is expressly provided for by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard the data subject's legitimate interests." Decision on the merits 79/2025 — 81/96
288. In a "Mäsdi" judgment C-169/23 of November 28, 2024, the CJEU clarified and ruled that
it is the collection and disclosure of data that must be provided for by national law (and not that of the information listed in Article 14.1-2), notwithstanding the terms of
129
the French version of Article 14.5.c) of the GDPR.
289. The Litigation Chamber is of the opinion that Article 14.5.c) of the GDPR does not apply
in this case, as the conditions for its application are not met, even if the processing is
provided for by the FATCA agreement and the Law of December 16, 2015. This exception under Article
14.5.c) of the GDPR can only be invoked if appropriate measures to
protect the legitimate interests of the data subjects are provided for by the said
regulation, which has not been demonstrated by the defendant. While the latter certainly does not invoke
this provision, it also does not respond to the plaintiffs' argument that
this exception would not apply under any circumstances. 290. Since no exemption from providing information applies, the Litigation Division will examine
the extent to which the defendant fully fulfills its obligation to provide information
as it claims to do via its website, even though it is not required to do so, through "more theoretical
explanations, news, links to relevant documents, and a FAQ" (point 68 of its second additional and summary submissions). The Litigation
Division adds that, in accordance with Article 12.1 of the GDPR, this information must be
concise, transparent, understandable, and easily accessible, formulated in clear and simple terms.
Without prejudice to the observation it will make in this regard, the Litigation
Division emphasizes that this is all the more the case since, as it explains, the defendant
does not have the identity of the Americans concerned to provide them with individual
information. The Litigation Chamber recalls that the EDPS requests individualized information (see above)130.291. The Litigation Chamber was thus able to note the following:
292. https://finances.belgium.be/fr/E-services/fatca 131: this is a general page that describes the
principle of the "FATCA" agreement in general terms as below and which
also includes a number of technical updates:
12 See ECLI:EU:C:2024:988, points 40 to 43: https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:62023CJ0169.
There is indeed a language difference between the French version and, for example, the Dutch version of this provision. Indeed, while the French version of Article 14.5.c) states "when and to the extent that the obtaining or communication of information is expressly provided for by Union or Member State law," the Dutch version of the text uses the following terms: "when and to the extent that the obtaining or communication of information is expressly provided for by Union or Member State law," the Dutch version of the text uses the following terms: "In order to prevent and prevent the collection or disclosure of information under Union or Member State law, it is expressly provided for by Union or Member State law."
13The Litigation Chamber is of the opinion that this individualized information may take the form of an explicit referral to the FPS Finance website through the individual information that financial institutions must provide to the data subjects. 131
Website consultation by the Litigation Chamber on April 23, 2025. Decision on the merits 79/2025 — 82/96
293. https://financien.belgium.be/fr/E-services/fatca/creation de fichiers xml fatca 13: this is
the "creation of Fatca XML files" page, which details how FATCA XML files
must be formatted in accordance with the XSD schema defined by the US Internal Revenue Service (IRS). The page is therefore intended for financial institutions (banks) and
links to the various user guides and IRS pages exclusively in English.
Only the note relating to the correction process and the user guide are available in French,
for example.
133
294. https://financien.belgium.be/fr/E-services/fatca/envoi de fichiers fatca xml: this is
the page that describes the process of sending files to the defendant and is therefore
also aimed at financial institutions.
13Idem
133
Idem Decision on the merits 79/2025 — 83/96
295. https://financien.belgium.be/fr/E-services/fatca/faq and documentation 135: this section
"FAQ and documentation" contains a list of numerous links to various
relevant documents in the context of the transfer or taxation by foreign tax
authorities (not exclusively "FATCA"), largely in English.
136
296. https://financien.belgium.be/fr/E-services/fatca/faq and documentation/faq/generalites:
For example, the General FAQ refers to a number of questions (cited in the defendant's submissions as contributing to the fulfillment of its information obligation).
297. The Litigation Chamber notes that the elements of the defendant's website
certainly provide information on the FATCA agreement, in particular on the obligations imposed on Belgian banks and on the manner in which they should
provide data to the defendant, which, in turn, will transmit it to the IRS. This
information is both general and technical and is largely aimed at financial
institutions and not directly at the potentially affected citizen.
Moreover, many documents are only available in English.
298. In support of the preceding paragraphs, the Litigation Chamber notes that this
information does not meet the requirements that must be actively provided to data subjects
134
Ibid
13 Ibid
136
Ibid Decision on the merits 79/2025 — 84/96
within the meaning of Article 14.1-2 of the GDPR. The Litigation Chamber considers this
to be a particularly serious failure, given that the right to information is a
cornerstone of data protection law. Without information, the data subject
is unable to be aware of the processing of their data. It is
furthermore deprived of the ability to exercise the control over this data that
the GDPR allows it to do through the exercise of rights of which it is informed neither of the existence
nor of the conditions for exercising them (see Articles 14.2 e) and 14.2.c) of the GDPR).
299. Furthermore, the various pieces of information, even if contained in one or the other
document, quod non, are neither easily accessible nor understandable
for the data subjects, as required by Article 12.1 of the GDPR.
300. These findings of the Litigation Division are consistent with those, as highlighted by the SI,
made in 2016 by the CSAF in its decision 52/2016:
301. In conclusion to the above, the Litigation Division finds a breach of
Articles 14.1 and 14.2, in conjunction with Article 12.1, of the GDPR, on the part of the defendant, both
because it failed to inform the first complainant regarding the transfer of his personal data
to the IRS and because of the insufficient information it made available to the
data subjects, including the Belgian Americans represented by the defendant.
II.6.4. Regarding the failure to fulfill the obligation to carry out a DPIA
302. For the reasons set out in point 160 above, the Litigation Chamber considers that
Article 35 of the GDPR applies to the defendant independently of Article 96 of the GDPR,
this is without prejudice to the fact that, as early as 2015, Group 29 recommended carrying out a DPIA
with regard to data processing occurring within the framework of the automatic exchange
of data for tax purposes.
13 See WP 234 of the Working Party 29 already cites: “Each Member State should consider implementing an agreed Privacy Impact Assessment to ensure that the data protection safeguards are adequately addressed, and a consistent standard is applied for the tax cooperation agreements by all EU countries.” Decision on the merits 79/2025 — 85/96
303. When the controller carries out one of the processing operations listed in Article 35.3 of the GDPR, it is required to carry out a DPIA. The same applies when the proposed processing operation is included in the list of processing operations requiring a DPIA adopted by the DPA in implementation of Article 35.4 of the GDPR. 139. The processing operations referred to in the complaint are not covered by these
two paragraphs of Article 35.
304. This exclusion does not exempt the controller from verifying whether it
falls within the conditions of application of Article 35.1 of the GDPR, which provides that "where a type
of processing, in particular through the use of new technologies, and taking into account the
nature, scope, context, and purposes of the processing, is likely to result
in a high risk to the rights and freedoms of natural persons, the controller
shall carry out, prior to processing, an analysis of the impact of the proposed processing operations on the protection of personal data. A single
analysis may cover a set of similar processing operations that
present similar high risks."
305. This obligation must be understood in the context of the controller's general obligation to appropriately manage the risks posed by the processing of personal data it carries out. It is therefore part of its accountability obligation (Articles 5.2 and 24 of the GDPR).
306. The defendant was therefore required to examine whether the transfer to the IRS required it to carry out a DPIA or not, starting from May 25, 2016, in order to be compliant by May 25, 2018 at the latest, and then remain vigilant for any changes—factual or in the legal framework—that would require a reassessment of the risks. 307. In this regard, the defendant clarifies for its defense that when questioned on this point on June 30, 2021, its DPO responded that, based on a preliminary impact assessment, it had been concluded that a DPIA was not necessary given the fact that:
- The law had incorporated the comments made by the CPVP in the two opinions issued on the draft law;
(data are adequately taken into account and a consistent standard is applied to tax cooperation agreements by all EU countries). 13Article 35.3 of the GDPR provides that a DPIA is required in the following three cases: (a) the systematic and in-depth evaluation
of personal aspects relating to natural persons, which is based on automated processing, including profiling,
and on the basis of which decisions are taken which produce legal effects concerning a natural person or
significantly affect them in a similar manner, (b) the large-scale processing of special categories of data referred to in Article 9.1 or personal data relating to criminal convictions and offenses
referred to in Article 10, and (c) the systematic large-scale monitoring of a publicly accessible area.
139 The list of processing operations that, according to the DPA, require a DPIA pursuant to Article 35.4 of the GDPR can be found here:
https://www.autoriteprotectiondonnees.be/publications/decision-n-01-2019-du-16-janvier-2019.pdf Decision on the merits 79/2025 — 86/96
- That the CSAF had issued a decision authorizing the transfer of data to
the US tax authorities and that the conditions of this decision had been
implemented;
- That the processing complies with the requirements of the AEOI standard regarding confidentiality and data protection, as well as the defendant's information security policies based on the ISO27001 standard: the transmission of information is doubly protected, at the level of encrypted and signed files and at the level of the channel through which the information is communicated (the secure MyMinfin platform for data transmission by Belgian banks and the secure IDES platform for transmission to the IRS);
- That the US authorities are also required to provide the necessary security measures to ensure that the information remains confidential and is stored in a secure environment, as provided for by the FATCA Data Safeguard Workbook.
308. The SI has not taken any action regarding this response, limiting itself in its supplementary investigation report to reproducing the response of the defendant's DPO. In its
conclusion, the IS does not specifically mention the DPIA provided for by the GDPR, concluding
generally on the presence of guarantees concerning the protection of the transferred data
and on the reciprocity of the exchanges.
309. As for the complainants, they are of the opinion that a DPIA should have been carried out.
310. The Litigation Chamber notes from the outset that the defendant's DPO does not specify
the date on which this preliminary analysis was carried out. While the IS explicitly requested
that this analysis be communicated to it during the investigation, the defendant has so far failed
to do so. This preliminary analysis is not included in the file, and the defendant
therefore remains in default of providing proof that it was carried out during the period invoked.
311. The Litigation Chamber considers, in any event, that the defendant's argument based on this preliminary analysis cannot be accepted for the following reasons. 312. The Disputes Chamber recalls Article 35.10 of the GDPR, which provides that "where the
processing carried out pursuant to Article 35(1)(c) or (e) has a legal basis in Union law or in the law of the Member State to which the controller is subject, where that law regulates the specific processing operation or
all processing operations in question, and where a data protection impact assessment has already been carried out as part of a general impact assessment
conducted in the context of the adoption of the legal basis in question, paragraphs 1 to 7 of the GDPR shall not apply, unless the Member States consider it necessary to carry out
140
such an assessment prior to processing activities." 313. The Belgian legislator has therefore provided, under Article 23 of the LTD, that even if an impact assessment has been carried out as part of the adoption of the legal basis for the lawfulness of the processing (Article 6.1. c) or Article 6.1. e) of the GDPR), the data controller is not exempt from carrying out a DPIA within the meaning of Article 35.1 of the GDPR when its conditions of application are met.
314. The Belgian legislator has thus expressly provided that a DPIA carried out in the context of parliamentary work does not exempt the data controller from carrying out a DPIA within the meaning of Article 35 of the GDPR before operationalizing the processing operations concerned. The opinions
issued by the CPVP and the authorization of the CSAF regarding compliance with Directive 95/46/EC
are not relevant for DPIA purposes within the meaning of Article 35.10 of the GDPR. It would in any case be
contrary to Article 23 of the LTD, read in light of Article 35.10 of the GDPR,
to accept that a preliminary analysis based on these texts to conclude that the
data controller is not required to carry out a DPIA is admissible as an exemption. Finally, the Litigation Chamber refers to its conclusions in light of these opinions
and deliberations (Section II.6).
315. The fact that the preliminary analysis is also based on the existence of other standards is also
irrelevant. These standards alone, which primarily guarantee a certain level of
security, are not sufficient, as will be demonstrated below, to exonerate the defendant.
316. The Litigation Chamber is indeed of the opinion that the transfer of data to the IRS is a
processing process likely to create a high risk for the rights and freedoms of data subjects
within the meaning of Article 35.1 of the GDPR, for which a DPIA was necessary.
140 Emphasis added by the Litigation Chamber.
14 See The preparatory work of the LTD on Article 23: "It is provided that a data protection impact assessment must be carried out before the implementation of the processing activity, even if an impact assessment has already been carried out during the development of the law or the regulations that put it in place, in order to ensure an effective and timely analysis when all the elements are brought to the attention of the controller. All the elements of the impact assessment are provided for in Article 35 of the Regulation. The analysis must contain at least a systematic description of the processing operations, the purposes, including, where applicable, the legitimate interest pursued, an assessment of the necessity and proportionality of the processing operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address the risks, including safeguards, measures, and security mechanisms to ensure the protection of personal data and demonstrate compliance with the Regulation, taking into account the rights and legitimate interests of data subjects and other affected persons. When developing the legal basis, it is often difficult to see in detail which practical and technical security measures and mechanisms will be most appropriate to address the risks identified in the analysis. Similarly, when implementing the processing, it may turn out that the measures and mechanisms implemented generate additional risks that were not taken into account during the initial analysis:
https://www.lachambre.be/FLWB/PDF/54/3126/54K3126001.pdf (Chamber of Representatives, Parl. Doc., 54 3126/001, page 48. Decision on the merits 79/2025 — 88/96
317. Several criteria cited in recital 75 of the GDPR and in the EDPB Guidelines on DPIA demonstrate a potential high risk in this case.
318. Thus, the Litigation Chamber maintains:
- "Systematic monitoring" 143 in that the data concerned are, except
" the "exception" linked to the "reportable" threshold for bank accounts systematically
transferred annually to the IRS, whether or not there is evidence of tax evasion, in particular
(Title II.6.1.3);
- The data transferred to the IRS is financial data that falls into the
144
category of "highly personal data" within the meaning of the aforementioned
Guidelines;
145
- The data is processed "on a large scale" because it concerns, a priori, with
a limited exception, the data of all US nationals
with bank accounts in Belgium. The scope of the obligation and its recurrence,
even annually, play a role in assessing the "large-scale" nature
of the processing, alongside the number of individuals concerned and the volume of data
transferred (see also Title II.6.1.3);
- The data subjects can be classified as "vulnerable persons"
(recital 75) when an imbalance in their relationship with the defendant
can be identified, and even more so with the IRS, the recipient of the data. This imbalance
results not only from the fact that this transfer is imposed on the data subjects
without them being able to object, but above all from the complexity of the legal framework,
including the existence of possible remedies for exercising their rights;
142 Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation (EU) 2016/679,
WP 248: https://ec.europa.eu/newsroom/article29/items/611236 . The EDPS adopted these guidelines on May 25, 2018, in accordance with the decision you can find here:
https://edpb.europa.eu/sites/default/files/files/news/endorsement of wp29 documents.pdf
143 The EDPS Guidelines on the DPIA define as surveillance data processing used to observe, monitor, or control data subjects, including the collection of data via networks, for example. "Surveillance" is therefore not limited to surveillance by cameras, for example. "Systematic" also means any surveillance that meets one or more of the following criteria: the surveillance is carried out according to a system; it is prepared, organized, or methodical; it is carried out as part of a general collection plan; it is carried out as part of a strategy, which is the case in this case.144The EDPB Guidelines on DPIA specify that, beyond Articles 9 and 10 of the GDPR, certain categories of data may be considered to increase the possible risk to the rights and freedoms of individuals. These are considered "sensitive" in the common sense of the term. Financial data are included, especially when their disclosure is intended to combat breaches that could be attributed to the data subjects. 145To determine whether processing is taking place "on a large scale," the EDPB recommends in its Guidelines on DPIA that the following factors be taken into account in particular: the number of data subjects, the volume of data and/or the range of different data elements processed; the duration or permanence of the processing activity; and the geographical scope of the processing activity. Decision on the merits 79/2025 — 89/96
- The purpose pursued (fighting tax evasion at the very least) and the subsequent processing operations likely to be carried out in the United States, according to the Litigation Chamber, entail a potential "cross-referencing or combination of data sets," another criterion of the guidelines already cited.
319. Finally, although this does not constitute one of the nine criteria listed by the EDPB, the transfer takes place to a country outside the EEA whose level of data protection is not considered adequate, at least with regard to the processing operation in dispute. The defendant cannot be unaware of this, and this situation, according to the Litigation Chamber, requires particularly careful attention and a particularly rigorous risk assessment.
320. The Litigation Chamber specifies that the EDPB is of the opinion that in most cases, the
controller may consider that processing that meets two of the nine criteria
listed in its Guidelines requires a DPIA. Generally speaking, the EDPB considers
that the more criteria a processing operation "meets," the more likely it is to present a
higher risk to the rights and freedoms of data subjects and therefore to require
a DPIA, regardless of the measures the controller plans to adopt.
321. Combined, the presence of the five criteria identified in paragraph 318 reflects a
high level of risk in the transfer complained of to the IRS. This high level of risk justified
according to the Litigation Chamber that a DPIA within the meaning of Article 35.1 be carried out by the
defendant, as, moreover, as mentioned, already recommended since 2015
(paragraph 302). Furthermore, an assessment by the defendant of the compliance of the "FATCA" agreement with the GDPR would have made it possible, if necessary, to alert the Belgian public authorities and initiate a review of the agreement. This analysis, by the defendant's own admission, was not carried out for reasons that the Litigation Chamber rejected under the preceding paragraphs.
322. Therefore, the Litigation Chamber concludes that the defendant has breached Article 35.1 of the GDPR with regard to the processing complained of by the plaintiffs.
II.6.5. Regarding the breach of Article 20 of the LTD
323. The Litigation Chamber recalls here that since the complaint concerned non-compliance with
Article 20 of the LTD, it invited the parties to defend themselves against this complaint in its letter
of May 30, 2024, "provided that this complaint is maintained by the complainants, the latter
having abandoned it during the exchange of submissions leading to Decision 61/2023 of the
Litigation Chamber, annulled by the Market Court" (paragraph 76). Decision on the merits 79/2025 — 90/96
324. The Litigation Chamber notes that the parties have no longer pursued a conclusion on this complaint in the context of
the resumption of the case leading to this decision. It notes that the subject matter of the complaint
no longer includes it and makes no ruling on it.
II.6.6. Regarding the failure to ensure accountability
325. In accordance with the principle of accountability, the defendant was required,
taking into account the nature, scope, context, and purposes of the processing, as well as
the risks, the likelihood and severity of which vary, for the rights and freedoms of natural persons, to implement appropriate technical and organizational measures
to both ensure that the processing is carried out in accordance with the GDPR
and to be able to demonstrate this (Article 24 of the GDPR).
326. In this case, the nature of the processing, its scope, and its purpose certainly presented
risks to the rights and freedoms of the data subjects (as the Litigation Chamber demonstrated in Section II.6.4 above, devoted to the obligation to carry out a DPIA).
327. The Litigation Chamber finds that the defendant did not take the correct measure risks to the rights and freedoms of the first complainant and the Belgian Americans
whose interests are defended by the second complainant, nor adopted appropriate measures
to address these risks.
328. The defendant could not completely ignore the repeated calls (some of which
post-date the opinions and authorizations it invokes), in particular from data
protection authorities, including the DPA, meeting within Group 29 and then the EDPB, to assess an
international agreement such as the "FATCA" agreement in light of the GDPR. While some of these political calls
were directly aimed at the Belgian State, the "negotiator," which is not
in charge of the dispute, wearing this hat, others, more technical in the form of the Guidelines cited in
this decision, for example, were addressed directly to data controllers
like the defendant.
329. Pursuant to its accountability obligation, the defendant, solely responsible for the flow
to the IRS, was required to continuously ensure compliance with the various safeguards that
were intended to govern the transfer to the IRS, including proportionality and the provision of information to the data subjects
in particular - two aspects emphasized by the SCAF's conditional authorization 52/2016 - without attempting to shirk these/its obligations by
hiding behind the fact that it was merely a logistical intermediary (even if this
resulted from an international consensus on how to transfer data, as the
defendant clarified at the hearing on December 11, 2024) - even though it is the data controller. Its responsibility cannot be limited to guaranteeing a
secure transfer of data to the IRS. 330. In light of the various breaches noted under Sections II.6.2, II.6.3, and II.6.4, the Litigation Chamber
finds that the defendant failed in its accountability obligation.
In support of the above, it concludes that the defendant violated Articles 5.2 and 24 of the
GDPR (accountability) with regard to the processing complained of by the complainants.
III. Remedial Measures and Sanctions
331. Under Article 100.1 of the LCA, the Litigation Chamber has the power to:
1° dismiss the complaint;
2° order a dismissal of the case;
3° suspend the decision;
4° propose a settlement;
5° issue warnings or reprimands;
6° order compliance with the data subject's requests to exercise their rights;
7° order that the data subject be informed of the security issue;
8° order the temporary or permanent freezing, limitation, or prohibition of processing;
9° order that the processing be brought into compliance;
10° order the rectification, restriction, or erasure of data and notification of such data recipients;
11° order the withdrawal of accreditation from certification bodies;
12° impose periodic penalty payments;
13° impose administrative fines;
14° order the suspension of transborder data flows to another State or an international organization;
15° forward the file to the Public Prosecutor's Office in Brussels, which shall inform the data subject of the follow-up action taken on the file; 16° decide on a case-by-case basis to publish its decisions on the Data Protection Authority's website.
332. Based on the documents in the case file and following its analysis, the Litigation Chamber
concludes that the transfer of the first complainant's personal data by the
defendant to the IRS was unlawful, since this transfer violated the principles of finality, minimization, and the rules of Chapter V of the GDPR, in particular Article 46.2.
a) of the GDPR. The Litigation Chamber has also demonstrated that this unlawfulness also applies, more
generally, to the transfer of personal data of the American
Belgian accidentals defended by the second complainant.
333. In its Schrems II judgment, cited above, the CJEU stated that "Article 58(2)(f)
and (j) of Regulation 2016/679 must be interpreted as meaning that, unless there is a valid adequacy decision adopted by the European Commission, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country based on standard data protection clauses adopted by the Commission, where that supervisory authority considers, in light of all the circumstances specific to the transfer, that those clauses are not or cannot be complied with in that third country and that the protection of the transferred data required by EU law, in particular Articles 45 and 46 of that regulation and the Charter of Fundamental Rights, cannot be ensured by other means, failing which the controller or its data controller may not be able to exercise due diligence. subcontractor established in the Union for having itself
suspended or terminated the transfer” (paragraph 121 of the judgment).
334. Given that this processing is part of an international commitment
of the Belgian State, the Litigation Chamber does not impose a prohibition but
favors, in support of Articles 58.2. d) and 100.1.9° of the LCA, compliance
by the defendant with the data transfer it carries out to the IRS within one year of this decision, taking into account all
considerations made by the Litigation Chamber with regard to the principles of purpose,
proportionality, and all appropriate safeguards that must govern said transfer. 335. The Litigation Chamber finds that the defendant violated
Article 14.1-2 in conjunction with Article 12.1 of the GDPR in that the defendant failed
to adequately inform the first complainant and failed to adequately inform
the Belgian accidental Americans and, more generally, the persons
concerned by the data processing carried out in execution of the "FATCA" agreement (Section
II.6.3).
336. The Litigation Chamber finds that the defendant also violated
Article 35.1 of the GDPR in that the defendant failed to carry out a DPIA
with regard to the processing complained of by the complainants (Section II.6.4).
337. Finally, the Litigation Chamber finds that the defendant was also guilty of a violation of Articles 5.2 and 24 of the GDPR in that it failed to fulfill its obligation of accountability with regard to the processing operations complained of (Title II.6.6). Decision on the merits 79/2025 — 93/96
338. For these breaches, the Litigation Chamber issues a reprimand to the defendant based on Articles 58.2.b) of the GDPR and 100.1.5° of the LCA. This reprimand is accompanied by an order to bring the transfers of personal data carried out in execution of the FATCA agreement into compliance with the GDPR within one year from the date of notification of this decision, taking into account the considerations expressed by the Litigation Chamber in this decision with regard to the principle of proportionality,
given the purpose and the requirements of Chapter V of the GDPR (Articles 5.1.b) and 5.1.c) of the GDPR; Articles 46.1 and 46.2.a) of the GDPR);
- to provide, within one year of notification of this decision,
complete, clear, and accessible information regarding the transfer of personal data
to the IRS under the "FATCA" agreement on its website
(Articles 12.1 and 14 of the GDPR);
- to carry out, within one year of notification of this decision, a
DPIA in accordance with Article 35 of the GDPR. In this regard, the Litigation Chamber
is aware that the GDPR does not require publication of the DPIA and that it is at the discretion of the data controller to
publish it or not. However, at least partial
publication, in the form of a summary or conclusion of its
DPIA, could be considered by the defendant. Such a practice would be useful to
instill confidence in the transfers it carries out as a public authority and
to provide assurances of accountability and transparency to the persons
146
concerned .
IV. Publication of the Decision
339. Given the importance of transparency regarding the decision-making process
and the decisions of the Litigation Chamber, this decision will be published on the
APD website. The Litigation Chamber has generally decided to publish
its decisions with the deletion of the direct identifying data of the
complainant(s) and the persons named, whether natural or legal, as well as
those of the defendant(s).
340. In this case, the Litigation Chamber decides to publish this decision with
identification of the parties, excluding the first complainant.
146 See EDPS Guidelines on DPIA, page 21 of the French version. Decision on the merits 79/2025 — 94/96
341. The Litigation Chamber specifies that this publication, with identification of both the
second complainant and the defendant, pursues several objectives.
342. With regard to the defendant, it pursues a public interest objective because
this decision addresses the issue of the liability of a federal public service (the
defendant) subject to obligations arising from an international agreement ("FATCA")
concluded with a country outside the EU/EEA. Identifying the defendant is also
necessary for a proper understanding of the decision and therefore for the achievement of the transparency
objective pursued by the Litigation Chamber's policy on publishing decisions.
147
... 343. With regard to the second complainant, a proper reading of the decision also requires that
her identity be disclosed since she is representing a specific and identified category of data subjects. Furthermore, while not a preponderant argument, the
Litigation Chamber is aware that the complaint filed by the second complainant against
the defendant was reported by the press at the initiative of one of her counsel and therefore made
public.
344. Finally, the publication of the identities of the second complainant and the defendant also contributes
to the pursuit of consistency and harmonized application of the GDPR. As
explained in Section II.2, the complaint should not have been handled under the one-stop-shop mechanism
provided for by the GDPR. The "FATCA" issue is nonetheless
current and a concern well beyond Belgium's borders. It is therefore possible that,
as has already been the case, other EU/EEA data protection authorities may
receive similar complaints in the future; for the examination of these complaints,
acquaintance with this decision may be useful, each supervisory authority exercising
its powers in complete independence, as already explained.
147 See https://www.autoriteprotectiondonnees.be/publications/politique-de-publication-des-decisions-de-la-chambre-
contentieuse.pdf Decision on the merits 79/2025 — 96/96
filed with the Registry of the Market Court in accordance with Article 1034quinquies of the Judicial Code, 149, or
via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code).
(Sé).Yves Poullet
President of the Litigation Division
6. The signature of the applicant or their attorney.
149 The application, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by registered letter to the court clerk or filed with the registry.
- ↑ Agreement between the Government of the Kingdom of Belgium and the Government of the United States of America to improve International tax compliance and to implement Fatca, April 23 2014.
- ↑ Belgian Law of December 16, 2015.
- ↑ The term "accidental American" has no legal definition. The data subject defines accidental Americans as individuals who, like himself, are US nationals despite having no significant ties with the US.
- ↑ These principles are close equivalents to their GDPR counterparts in Article 5: see Article 5(1)(b) and (c).
- ↑ CJEU, Case C-311/18, Facebook Ireland and Schrems, 16 July 2020 (available here).
- ↑ EDPS, Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation (EU) 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, 15 December 2020 (Version 2.0), available here.
- ↑ WP29, ‘Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679‘, 17/EN WP 248 rev.01, As last Revised and Adopted on 4 October 2017 (available here).
