Readers of Tax Aware will recall that in October 2021, Mishcon de Reya filed a claim before the High Court for a US-born British citizen ("Jenny"), alleging that the automatic processing and exchange of personal data under FATCA without any indicia of tax evasion breached Jenny's fundamental right to privacy, and exposed her data to disproportionate risks of hacking and data loss. In 2022, the CJEU held that public registers of beneficial ownership are disproportionately against rights to privacy.
We now have not one, but two decisions from the Belgian data protection authority on the incompatibility of FATCA with the GDPR. The first, case DOS-2021-00068, was appealed by the Belgian government on procedural grounds, and has now been reconfirmed in a decision issued on 24 April 2025.
Not just an academic topic
Nobody should evade tax. However, the disproportionate scope of the Automatic Exchange of Information (AEOI) is not an academic topic. Independent research shows growing concerns for abuses of compliance rules by government. Concerns on the human rights implications of transferring data to authoritarian countries have also been voiced by parliamentarians, among others.
It is time for not only governments but also civil society, professional organisations and journalists to have a serious, balanced debate on the risks of disproportionate transparency measures, as well as proper vetting of recipients of sensitive personal data.
Find further information on the privacy work by Mishcon.