On 24 April 2025, the Belgian Data Protection Authority\u2019s Litigation Chamber issued Decision 79\/2025, declaring that the automatic transfer of personal data by the Service Public F\u00e9d\u00e9ral Finances to the United States Internal Revenue Service under the FATCA agreement violates the General Data Protection Regulation. This landmark ruling, following a Brussels Court of Appeal remand, underscores the primacy of data protection law over international agreements and offers critical lessons for businesses handling cross-border data transfers. This legal insight of Allegiance Law breaks down the decision\u2019s implications and provides actionable strategies for ensuring General Data Protection Regulation compliance when concluding contracts.<\/p>\n
Key Findings of Decision 79\/2025<\/strong><\/p>\n The complaint, filed by an individual and the Accidental Americans Association of Belgium, challenged the Service Public F\u00e9d\u00e9ral Finances\u2019 transfer of personal data\u2014such as names, addresses, tax identification numbers, and financial account details\u2014to the United States Internal Revenue Service. These transfers, mandated by the 2014 FATCA agreement between Belgium and the United States, aim to combat tax evasion by United States citizens, including \u201caccidental Americans\u201d with minimal ties to the United States. The Belgian Data Protection Authority found multiple violations of the General Data Protection Regulation, reinforcing the regulation\u2019s stringent requirements for international data transfers. Key findings include:<\/p>\n Inapplicability of Article 96 General Data Protection Regulation<\/strong><\/p>\n The Service Public F\u00e9d\u00e9ral Finances argued that Article 96 of the General Data Protection Regulation, which allows pre-May 24, 2016, international agreements to remain valid if compliant with prior European Union law (Directive 95\/46\/EC), shielded the FATCA transfers. The Belgian Data Protection Authority rejected this, ruling that the agreement failed to meet even the earlier directive\u2019s standards, as it lacked a precise purpose and proportionality, necessitating full compliance with the General Data Protection Regulation.<\/p>\n Violation of Core General Data Protection Regulation Principles<\/strong><\/p>\n The transfers breached several General Data Protection Regulation principles (i) purpose Limitation (Article 5.1.b) because the broad scope of data collected lacked a sufficiently specific purpose tied to tax enforcement (ii) diata Minimization (Article 5.1.c) because the systematic, annual transfer of financial data, regardless of tax evasion indicators, was deemed disproportionate, (iii) transparency (Articles 12, 14) because the Service Public F\u00e9d\u00e9ral Finances failed to adequately inform data subjects about the transfers, with its website providing only general, technical information that was neither accessible nor comprehensive, and (iv) accountability (Articles 5.2, 24) because the Service Public F\u00e9d\u00e9ral Finances did not demonstrate proactive compliance, ignoring risks to data subjects\u2019 rights.<\/p>\n Non-Compliance with International Transfer Rules<\/strong><\/p>\n The transfers lacked appropriate safeguards under Article 46 of the General Data Protection Regulation, as the FATCA agreement did not incorporate protections equivalent to European Union standards. The Belgian Data Protection Authority also dismissed Article 49 derogations (e.g., public interest), citing their inapplicability for systematic transfers. This echoes the Court of Justice of the European Union\u2019s Schrems II ruling, which invalidated the Privacy Shield for insufficient United States data protections.<\/p>\n Failure to Conduct a Data Protection Impact Assessment<\/strong><\/p>\n Despite the high risks posed by transferring sensitive financial data to a non-European Economic Area country, the Service Public F\u00e9d\u00e9ral Finances did not perform a Data Protection Impact Assessment (Article 35). The Belgian Data Protection Authority deemed this a significant oversight, given the treatment\u2019s scale, systematic nature, and potential impact on vulnerable data subjects.<\/p>\n Corrective Measures and Reprimand<\/strong><\/p>\n The Belgian Data Protection Authority issued a reprimand and ordered the Service Public F\u00e9d\u00e9ral Finances to bring the transfers into General Data Protection Regulation compliance within one year (by April 24, 2026). This includes ensuring proportionality, implementing robust safeguards, providing clear information to data subjects, and conducting a Data Protection Impact Assessment. Notably, the Belgian Data Protection Authority opted against an immediate suspension or prohibition of transfers, citing Belgium\u2019s international obligations, though some argue Schrems II warranted stronger action.<\/p>\n Implications for Businesses<\/strong><\/p>\n Decision 79\/2025 reaffirms that public authorities and businesses cannot rely on international agreements to bypass General Data Protection Regulation obligations, particularly for data transfers to non-European Economic Area countries like the United States. For companies involved in cross-border data sharing\u2014whether with tax authorities, partners, or vendors\u2014this ruling highlights the need for rigorous compliance to avoid legal and reputational risks. The Belgian Data Protection Authority\u2019s emphasis on transparency, proportionality, and impact assessments sets a high bar for all data controllers, especially those handling sensitive financial or personal data.<\/p>\n Allegiance Law\u2019s Practical Tips for Concluding Contracts<\/strong><\/p>\n To align with Decision 79\/2025 and General Data Protection Regulation requirements, Allegiance Law offers the following tips for businesses drafting contracts involving personal data transfers:<\/p>\n Include explicit contractual terms ensuring that any cross-border data transfers comply with Chapter V of the General Data Protection Regulation (Articles 44\u201350). Specify the use of approved safeguards, such as European Commission Standard Contractual Clauses, and require due diligence to verify the recipient country\u2019s data protection adequacy, avoiding reliance on outdated agreements.<\/p>\n Incorporate clauses requiring all parties to inform data subjects clearly and accessibly about data processing, including transfers to third countries. Ensure contracts detail who is responsible for providing information under Article 14, covering purposes, recipients, safeguards, and data subject rights, to prevent gaps like those identified in the Service Public F\u00e9d\u00e9ral Finances\u2019 website.<\/p>\n\n
\n