Belgian DPA Decision Raises Questions Over EU-US FATCA Arrangements

Belgium's Data Protection Authority (the "DPA") recently held that transfers of personal information relating to U.S. accountholders in Belgian financial institutions by Belgium's tax authority to the IRS in the U.S. for FATCA purposes are not compliant with the GDPR. While the decision focuses specifically on Belgium's tax authority's GDPR compliance measures, it raises broader questions regarding the compatibility with the GDPR of current FATCA arrangements between certain EU Member States and the U.S. (which were generally put in place some time ago and have not been updated recently).

Pursuant to certain provisions of the U.S. Foreign Account Tax Compliance Act ("FATCA") a "foreign financial institution" may be required to withhold tax from certain payments it makes to persons that fail to meet certain certification, reporting or related requirements. The purpose of FATCA is to reduce tax evasion and to improve tax compliance in relation to offshore assets