ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø

The Belgian Data Protection Authority (DPA) on April 24, 2025, issued Decision No. 79/2025, which notes that the automatic transfer of personal financial data of U.S. citizens by the Belgian Federal Public Service (FPS) to the U.S. tax authority (IRS) under the FATCA agreement is non-compliant with the European Union (EU) General Data Protection Regulation (GDPR).

The ruling follows a complaint filed by the Belgian accidental Americans, which stated that the FATCA framework, as implemented in Belgium, results in broad and undifferentiated transfers of personal tax data without sufficient safeguard. Initially, the DPA ruled that these transfers violate EU data privacy rules and that data concerning Belgian accidental Americans should not be transmitted to the United States. However, the Brussels Court of Appeals suspended the ruling, allowing data transfers to continue while the merits of the case are being considered by the court.

In Decision No. 79/2025, the DPA concluded that the current data transfer arrangements breach the GDPR principles, including purpose limitation, data minimization, and the requirement to ensure adequate protection for data transferred outside the EU.

As a result, the DPA has ordered the FPS to take the following actions within one year of the decision:

• Adjust the transfer of complainants' data to the United States to ensure compliance with GDPR requirements
• Conduct a Data Protection Impact Assessment (DPIA) for the data transfers under FATCA
• Improve transparency by publishing clear GDPR-compliant information on its website regarding data transfers under the FATCA agreement

Read a May 2025 report prepared by the ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø member firm in Belgium