A ruling last week by the UK's Supreme Court, in favor of a plaintiff who claimed that data protection laws had been broken in the transfer of her son's personal data to U.S. authorities, is being seen as potentially precedent-setting, as it is said to be the first such case involving questions about the legal transfer of personal data from Britain to the United States since the introduction of the GDPR across Europe in 2018.
Among those who are cautiously hailing the March 25 judgment, which followed hearings that took place last July, were “Jenny”, a U.S.-born British citizen who is crowd-funding a legal challenge against FATCA, and her legal team.
Specifically, they believe that the fact that the judges in the matter of Elgizouli v. Secretary of State for the Home Department found that the UK had transferred the personal data of the individual in question in that case to U.S. officials illegally, because it had done so without considering the data protection issues first, as required under the GDPR.
The GDPR (General Data Protection Regulation) came into force across Europe in May, 2018, and set a new standard for the movement of data involving individuals in the UK across international borders.
Although the UK is currently in the process of leaving the European Union, the provisions contained in the UK Data Protection Act 2018 reflect the general principles contained in the GDPR, according to legal experts at Mishcon de Reya, a London law firm which specializes in data protection issues and which has been handling Jenny’s complaint.
They note that both the GDPR and UK Data Protection Act establish strong data protection safeguards, as well as a high standard for "proof of necessity", before data collected in the EU may be legally transferred to a non-EU member state, such as the U.S.
As reported, "Jenny" – as she has chosen to be identified as, for reasons of privacy – came to the UK 19 years ago, and has been a British citizen since 2010. She decided to launch her challenge to FATCA last year, after having received a letter from her bank in 2016 that informed her of her U.S. tax obligations – which she hadn't been fully aware of at the time – and that her UK bank account data would be shared with the Internal Revenue Service, as required by FATCA.
Judgment is 'important'
Filippo Noseda, the Mishcon de Reya partner who is handling Jenny's FATCA challenge, noted that last week's ruling by the seven Supreme Court judges in the Elgizouli case was particularly significant for Jenny, as it came "after Brexit day".
This matters, he explained, because "it shows that the UK will continue to uphold the strict data protection principles introduced by the GDPR", even as it prepares to leave the EU, a fact that he and his Mishcon de Reya colleagues are in the process of bringing to the attention of the the UK’s data protection agency, the Information Commissioner’s Office (ICO), where Jenny's complaint is currently lodged, and awaiting action on the part of the ICO.
"The fact that the Supreme Court quashed a decision that had been taken by the UK government based on political expediency, rather than on data protection principles, is of great significance for FATCA, which was rolled out globally as several foreign banks were being targeted by the Department of Justice," Noseda said, in a statement over the weekend.
"It is clear that HM Revenue & Customs, which, let's remember, was the first foreign tax authority to sign an enhanced automatic tax information exchange agreement with the U.S., when it agreed to comply with FATCA in September 2012, did so without acknowledging or responding to strong concerns raised, even at the time, by Europe's data protection authorities."
As reported, the IRS recently announced that it was pushing back the March 31 deadline for financial institutions located in countries that are covered by so-called Model 2 FATCA agreements to July 15, to make it easier for those struggling as a result of the current coronavirus pandemic, but thus far hasn’t mentioned a change in the Model 1 FATCA agreement deadlines.
For this reason, Noseda's team is ramping up pressure on the ICO to respond to Jenny's FATCA complaint, which they say they reminded the organization more than three weeks ago it has had “since 11 November 2019”.
This, they say, is because UK banks and other financial institutions that have accounts belonging to American citizens, for which they are obliged to file 2019 FATCA information reports with HMRC are currently still facing a May 31 deadline for doing so, and if the agreement under which such filings are being made is in fact illegal, it would be better for this determination to be made now, rather than after yet another shipment of personal data gets made.
Under the Model 1 FATCA agreement the UK has with the US, the data is collected by HMRC, which then provides it to the IRS. This is different to Model 2 FATCA agreements – of which there are significantly fewer – which see the financial institutions providing the FATCA data on those of their accounts held by American citizens directly to the IRS.
FATCA challenger Jenny wasted no time in telling her crowd-funding supporters about last week's potentially-significant Supreme Court ruling.
In an email update to her crowd-funders today, she cited the Elgizouli case court documents in quoting one of the Supreme Court judges, Justice Lady Hale, as making the point that the transfer of data in question in the Elgizouli matter was “not based on an adequacy decision or on there being appropriate safeguards, because there were none”.
She noted that another of the judges in the case, Justice Lord Carnwath, pointed out that the UK's initial decision to transfer the individual-in-question's data, which the judges over-ruled, had been “based on political expediency, rather than strict necessity under the statutory criteria".
She then considered the potential precedent-setting relevance of the Elgizouli case to her own legal challenge, pointing to what she said was a similar use of “political expediency” to counter personal data concerns in the UK’s willingness to provide the IRS with the data of UK residents and bank-account holders, many of whom, like her, also happened to actually be British citizens.
“For reasons of political expediency, [such as being] eager to be the first to sign a new agreement with the U.S. government, HMRC gave itself powers under secondary legislation, with no parliamentary oversight, to exchange information with the IRS, without any safeguards or any regard for the concerns voiced by data protection authorities and [the European Parliament,” she writes. “[But in the Elgizouli ruling], the Supreme Court confirmed that 'the test of necessity is strict'.”
In her own case, Jenny continued, HMRC had "failed to show how the bulk data processing and transfer" it engages in under UK FATCA, "without any indicia of tax evasion, and in a generalized manner, with no right to be informed and no right to redress or correction, is necessary to achieve HMRC's stated objectives".
For this reason, she concluded, "in application of the principle of necessity, any processing of my data under FATCA is illegal."
challenge over GDPR
As reported, Jenny’s case is considered significant because it represents the first time anyone has challenged the implementation of FATCA in the EU under the GDPR regulations.
To see Jenny's CrowdJustice.com page, click here.
- ‘Policy concerns’ feared to weigh in pending UK FATCA challenge ruling
- The FATCA/AEOI Papers: Mishcon publishes research trove, unearthed as part of crowd-funded UK FATCA case
- Now IRS grants extension of info deadline for FATCA Model 1 jurisdictions
- Dutch 'accidental American' in €4,269 crowd-funding effort to renounce
- Dutch champion of 'accidentals' fires back at EU commissioner over FATCA impact assessment