UK's data protection agency seeking HMRC response in FATCA legal challenge

The ICO’s action came last week, in response to a complaint brought by Jenny, a US.-born British citizen, who is being represented by London's Mishcon de Reya law firm.

The ICO is the UK's data protection agency, which oversees the execution and implementation of compliance of data protection and related issues. 

Once the ICO has HMRC’s full response, it can begin drafting its official response to the complaint, Jenny said on Tuesday, in an email update sent to those who have contributed to her cause via her Crowdjustice.com site.

“This will be the first-ever ruling by a national data protection authority on FATCA, or on automatic exchange of information (AEOI),” Jenny added.

As of today (Jan. 31), Jenny has seven days to meet her “stretch” funding target of £120,000, of which she thus far has received more than half (£75,290) from 320 donations. She says her CrowdJustice campaign has had 11,247 page views so far.

As reported, Jenny hit her initial funding requirement of £50,000 a day early, in October.

At that time, she said that the £120,000 target – which includes the original £50,000 raised – was a more realistic figure to aim for, “given the scale of the task ahead”.

“Jenny” – who has been a British citizen since 2010, in addition to being American – came to the UK 20 years ago, and works with deaf students at a university in the north of England, where she is a research associate.

As she explains on her CrowdJustice page, she doesn’t believe anyone should ever “evade tax”, but that she objects to “the disproportionate nature of [FATCA as it is being used] to achieve its [tax compliance] objective”.

Unintended effects on expats

FATCA, formally known as the Foreign Account Tax Compliance Act, was signed into law in 2010 in the wake of a number of high-profile revelations of foreign bank accounts being used by U.S.-based individuals to evade U.S. taxes.

However, as has been reported exhaustively ever since, it has caused major problems for a significant percentage of the estimated 9 million Americans who live overseas, as it obliges them to file tax returns every year, which is rarely cheap and often very expensive.

FATCA also often also obliges them to pay U.S. taxes in addition to the taxes they’re already paying in the countries in which they currently live, even if they have never lived in the U.S. nor plan to, and thus have never benefited from the U.S. government services that these taxes they’re being forced to pay will be helping to fund.

The penalties for failing to comply properly with FATCA, meanwhile, can be exceptionally harsh for those on a modest income – as many expat Americans are – typically beginning at US$10,000.

Other legal challenges to FATCA have been attempted in the years since it came into force, including a long-running one in Canada that was decided in favor of the government last July, but which was subsequently appealed, and which is ongoing.  Other attempts have been made in France and the U.S., thus far without success, although there has been talk of future challenges. 

First FATCA challenge over GDPR

Unlike some earlier FATCA challenges, Jenny’s lawsuit seeks to prove that by providing her personal data to the U.S., HMRC is violating data protection and privacy laws – including the EU’s recently-implemented General Data Protection Regulation (GDPR).

Filippo Noseda, pictured left, the Mishcon de Reya partner who brought Jenny's complaint, says the case is a significant one  because it represents the first time anyone has challenged the implementation of FATCA in the EU under the GDPR, as well as other fundamental rights for individual EU citizens that are “enshrined in EU and UK legislation".

"The implementation of FATCA in the UK was rushed through against the advice of the European data protection authorities, and even concerns raised by the European Commission," Noseda, a privacy and data-protection law specialist, added.

"The recent hacking of the tax data of the entire population of an EU member state [Bulgaria], with reverberations beyond the EU's borders, and the OECD's admission that the data stolen included data transferred between tax authorities under a system derived from FATCA, shows the importance of raising these issues."

As for the fact that the UK – where Jenny is bringing her challenge – is officially leaving the EU as of today, Noseda said: "From Feb. 1, 2020, the UK will no longer be a Member State of the EU. However, under the Withdrawal Agreement, EU law will continue to apply during the transition period, which runs until 11pm on Dec. 21, 2020.

"Until then, UK citizens will continue to be able to have their cases referred to the European Court of Justice.

"Following the UK's full departure from the EU, it is perhaps unlikely that the UK's data protection rules will diverge from the principles contained in the GDPR, as EU businesses will need to be reassured that they can export data to the UK, and vice-versa.

"[Also], the UK will remain a party to the European Convention on Human Rights of 1950, which confers a fundamental right to a private life, on which all subsequent data protection legislation, including the GDPR, is based." 

UK officials twice
declined FATCA FOI request 

As reported here last March, in a separate matter having to do with the personal data and taxpayer information collected by HMRC as part of its FATCA compliance obligations, UK officials twice turned down a U.S.-born British citizen's Freedom of Information (FOI) request, which sought to discover the "extent of... the annual disclosure of British taxpayer information to the U.S. Internal Revenue Service, as per FATCA's requirements" – even though similar requests to the Canadian and Australian governments had been recently granted. 

The British citizen in that case, who requested anonymity, told the American Expat Financial News Journal at the time that it was her understanding that the ruling by the British Information Commissioner's office represented "the first time that the ICO [had] ruled on automatica exchange of information (AEOI)" and that it also appeared to be "the first notice concerning HMRC that [had to do with] international relations". 

To see the ICO decision notice in connection with that matter, click here.

To see Jenny's CrowdJustice.com page and make a contribution, click here.