Today, 27 October 2021, Mishcon de Reya filed a claim before the High Court in London on behalf of Jenny for breaches of her individual rights under the EU's data protection legislation in connection with the processing of her sensitive personal and financial information under FATCA, causing personal damage and distress.
The defendant is HM Revenue & Customs (HMRC), the UK tax authority entrusted with carrying out data processing under regulations enacted to implement a bilateral agreement with the US, known as 'Inter-Governmental Agreement' or 'IGA'.
Commenting on the case, Filippo Noseda, who has been representing Jenny in the claim said: "Jenny's claim is symptomatic of the steady erosion of individuals' data-privacy rights by governments".
As the alleged data breaches took place before Brexit, Jenny's claim engages the GDPR as well as the previous EU Data Protection Directive, which was at the heart of the recent "Schrems II" judgment on the transfer of personal data to the US. In that case, the Court of Justice of the European Union held that US data protection rules are not essentially equivalent to those required under EU law.
Jenny's claim is a reminder that individuals' data protection rights are relevant in the context of e-commerce, as well as data processing by governments.