Belgium: Exchange of information under FATCA found contrary to GDPR

A groundbreaking decision by the Belgian Data Protection Authority

The Litigation Chamber of the Belgian Data Protection Authority (DPA) made a resounding decision on 24 April 2025: the transfer of personal data of Belgian (accidental) Americans to the US tax authorities under FATCA is considered in breach of the General Data Protection Regulation (GDPR) and hence, such transfers will be prohibited as of 26 April 2026 unless the current FATCA regime is brought in line with the GDPR requirements prior to such date.  

Please note that the decision may still be appealed by the Belgian government. In such an instance, the case would be referred back to the Markets Court which would probably have to raise a prejudicial question with the European Court of Justice regarding the compatibility of the Belgian FATCA regime with the European GDPR rules.
 

Alleged GDPR violations

The international data transfers required under the FATCA regime, as implemented in Belgium, were found to be non-compliant with the principles of purpose limitation, proportionality, and transparency. In this connection, the Litigation Chamber relied in particular on the case law of the Court of Justice of the European Union, according to which a generalized and indiscriminate collection of personal data for the purpose of combating tax evasion by a tax administration is not authorized because such an objective, even if legitimate, is overly general and broadly defined. As a result, it leaves too much latitude to the data controller.

The Litigation Chamber believes that the purpose of the data transfers should be detailed such that it is possible to assess whether the data processing is effectively needed to realize the set objectives and whether the proposed data processing is proportionate to these objectives. In view of the set objective to combat tax evasion, the IGA would contemplate a too broad group of people, i.e. all U.S. persons irrespective of whether there are indicia of tax evasion.  In this respect, it was added that the insertion of a de minimis exception does not address this concern because the exception is optional which means that financial institutions can decide to ignore the exception in which case the tax authorities will send the information to the US tax authorities in spite of the fact that the account qualifies for the de minimis exception.

The decision also pointed out that appropriate safeguards for the protection of personal data, such as the provision of adequate information to the concerned persons, were missing.
 

Corrective measures required

The Litigation Chamber has imposed corrective measures on the Belgian tax authorities to ensure compliance with the GDPR principles before April 24, 2026: 

• Amend the data processing required under FATCA, as implemented in Belgium to conform it to the proportionality and purpose requirements laid down in Articles 5.1.b), 5.1.c), 46.1. and 46.2.a) GDPR;
• Provide GDPR-compliant information on its website as required by articles 14.1-2 combined with Article 12.1 of the GDPR; and
• Conduct a Data Protection Impact Assessment (DPIA) as defined in Article 35 of the GDPR.
   

Consequences if corrective measures are not taken

If the FATCA regime is not (timely) amended, the Belgian tax authorities are no longer allowed to exchange information on financial accounts held by U.S. persons or so-called Passive Non-Financial Entities (NFFEs) with controlling persons that are U.S. persons.  It would mean that Belgium will be out of compliance with the Intergovernmental Agreement between Belgium and the US to Improve International Tax Compliance and to Implement FATCA. This on its turn, would cause Belgian financial institutions to become “Nonparticipating Financial Institutions”.

This may in theory be avoided by Belgian financial institutions entering into a so-called “FFI agreement” (Revenue Procedure 14-38). Section 7 of the FFI agreement deals specifically with the case of financial institutions that are prohibited by local law to report accounts under FATCA. Such financial institutions are required to request a valid and effective waiver of the prohibition or otherwise close or transfer the accounts required to be reported.

In the absence of an FFI agreement, the qualification as a Nonparticipating FFI will trigger US withholding tax at a rate of 30% on so-called ‘withholdable payments’ (which include, amongst others, U.S. source dividend payments and interest payments on U.S. debt securities issued on or after July 1, 2014 received for own account or for the account of customers) whilst they are currently usually entitled to an exemption from withholding tax on most U.S. sourced interest payments and to a dividend withholding tax at a reduced rate of 15%.

In case of further questions, feel free to reach out to Koen Marsoul, Aurore Mons delle Roche or your regular contact at EY FSO Tax.