Mishcon de Reya is acting for a client, Jenny, who has launched a crowdfunding campaign on CrowdJustice seeking to uphold her fundamental rights to privacy and data protection in relation to the treatment of her personal data through the Foreign Account Tax Compliance Act ("FATCA").
In 2010, following banking scandals in which wealthy US citizens were allegedly using offshore bank accounts to hide funds, the US government introduced FATCA, requiring foreign banks to report on any US citizen to the IRS. This included Americans living in the UK, dual citizens and US-born British citizens. This law, which operates without exceptions, was extended to the UK in 2012.
Under FATCA, banks are required to send all personal and financial information of any US citizens to US authorities on an annual basis independent of any actual US tax liability. All it takes is for an American citizen to have a bank account outside of America.
Whilst the objective of preventing tax evasion is sound, the claim argues that the processing of Jenny's date under FATCA is disproportionate and represents a violation of her human rights to privacy and data protection. The transfer of information under FATCA does not require any indication of tax evasion and operates independently of any underlying US tax liability.
In addition, the claim argues that the sharing of personal and financial information is in direct breach of several GDPR principles. These include data minimisation, lawfulness of data processing, lack of safeguards for transfers of information to non-EEA countries.
FATCA exposes Jenny to a potential hack throughout the data processing chain as data is passed from the bank to HMRC and then on to the IRS. There is the significant unintended consequence that US citizens like Jenny may be unable to open UK bank accounts, or are seeing them closed down, due to the cost implications on banks of compliance with FATCA.
Jenny has filed a complaint against the UK tax authorities before the Information Commissioner's Office (ICO), the UK's independent data protection agency.
As reported in The Financial Times, in October 2021 Jenny filed a claim against HMRC in the High Court in London.