Belgium’s Data Protection Authority (DPA) reaffirmed its decision through Decision No. 79/2025 of 25 April 2025 to ban the transfer of data to the United States under the Belgium-United States FATCA Model 1A Agreement (2014), specifically affecting accidental Americans on 24 April 2025.
The Court of Appeal in Brussels overturned this decision and referred the case back to the DPA for further review.
The litigation chamber (LC) has affirmed its decision that the broad transfer of tax data under the FATCA agreement violated the principle of purpose limitation, as the agreement lacked clear objectives for data transfers. The DPA also stated that it failed to meet the principles of proportionality and data minimisation, as it exchanged more data than was necessary to combat tax fraud.
The LC also clarified that the “standstill” effect under Article 96 of the GDPR is limited in scope and restrictive. This means that Article 96 of the GDPR cannot allow international agreements to remain non-compliant with the GDPR. The agreements made before the GDPR’s implementation still require EU member states to renegotiate them to ensure compliance with the GDPR. The LC also noted that the FATCA agreement lacks safeguards to ensure that exported personal data is as protected as data within the EU.
The LC confirmed that transferring data of Americans in Belgium to a non-EU authority without adequate data protection is unlawful. The DPA again prohibited the SPF Finance from processing the complainants’ data and asked it to inform the relevant legislator of this ban and the identified shortcomings.
