FATCA

Mishcon de Reya is acting for a client, Jenny, who has launched a crowdfunding campaign on CrowdJustice seeking to challenge the legislation relating to the Foreign Account Tax Compliance Act ("FATCA") which she believes breaches her fundamental rights to data protection and privacy.

In 2010, following banking scandals involving wealthy Americans hiding money in offshore bank accounts, the US introduced FATCA, requiring foreign banks to report on any US citizen to the IRS, including Americans living in the UK, dual-citizens and US-born British citizens. This law, which operates without exceptions, was extended to the UK in 2012.

Under FATCA, banks are required to send all personal and financial information of any US citizens to US authorities on an annual basis independent of any actual US tax liability. All it takes is for an American citizen to have a bank account outside of America.

Whilst the objective of preventing tax evasion is sound, the claim argues that FATCA is disproportionate and represents a violation of fundamental rights to privacy and data protection, as the transfer of information under FATCA does not require any indicia of tax evasion and operates independently of any underlying US tax liability. 

However, EU law and the European Convention on Human Rights provide that  limitations to the fundamental rights to privacy and data protection are only allowed to the extent that they are necessary to achieve the objective and both the European Court of Justice and the UK Supreme Court have held that the necessity test is a strict one.

In addition, the claim argues that the sharing of personal and financial information is in direct breach of several GDPR principles (data minimisation, lawfulness of data processing, lack of safeguards for transfers of information to non-EEA countries).

The need for strong safeguards for transfers of data to the US was reiterated by the European Data Protection Board in guidelines issued in January 2020, which also apply to FATCA.

FATCA could expose US citizens to a potential hack throughout the data processing chain as data is passed from the bank to HMRC and then on to the IRS, and there is the significant unintended consequence that US citizens may be unable to open UK bank accounts, or are seeing them closed down, due to the cost implications on banks of compliance with FATCA.

Mishcon de Reya had put together a comprehensive list of hacking and data breaches incidents affecting tax authorities, other government agencies, central banks, financial institutions and private companies that support the financial industry and the UK tax authorities have already acknowledged in a separate matter that these incidents are 'serious'.

Mishcon de Reya has seen correspondence written by the European Commission  in 2011-12 expressing 'worrying' data protection concerns.

Serious concerns were also raised by the European data protection authorities from 2012 until the end of 2016.

A study prepared by the European Parliament following a petition by a French resident individual reiterated those concerns.

Despite those concerns, the UK tax authorities went ahead and signed an agreement with the US to implement FATCA in the UK.

A number of other EU governments did the same and data analysed by Mishcon de Reya shows that the French IGA was signed by its finance minister (Pierre Moscovici) shortly before he moved to the European Commission where he led the tax department for six years, arguably making it politically difficult for the Commission to follow up the concerns expressed following the introduction of FATCA.

Our client has filed a complaint against the UK tax authorities before the Information Commissioner's Office (ICO), Britain's independent data protection agency.

According to data provided by the European data protection authorities before the European Parliament, this is the first GDPR complaint against FATCA in Europe.

Depending on the outcome of that complaint, a judicial review might be necessary.

Our client has started a crowdfunding campaign to cover the costs of her challenge.

Following a recent appearance before the European Parliament [in support of a petition brought by a US-born French citizen known as Jude], Mishcon de Reya was given access to a trove of internal EU documents, which show that the European Commission had 'worrying' concerns about the data protection implications of FATCA.  Mishcon de Reya has taken the decision to publish its letters to the European Parliament to foster a public debate on the interaction between FATCA and EU law.