THE TRANSATLANTIC MAGAZINE
In recent weeks, many overseas Americans have been buoyed by news of what has been nicknamed the Schrems II case. The case was a legal challenge, put before the Court of Justice in the EU (CJEU), which found that the current Data Privacy Shield used in transfering data between the EU and the USA offers inadequate protections. In the CJEU's ruling, the court explained that GDPR "provides that the transfer of such data to a third country may, in principle, take place only if the third country in question ensures an adequate level of data protection." The CJEU's ruling invalidated an earlier case which said that the Data Privacy Shield was adequately protected, meaning that at present, many data transfers between the EU and the US are essentially invalid.
This case is important to overseas Americans because of its implications for FATCA, the Foreign Account Tax Compliance Act, which requires that banks and financial organizations in Europe which hold data on US citizen clients must report that data back to the US on a regular basis. A recent case led by lawyer Filippo Noseda of Mishcon de Reya, on behalf of a US born British Citizen named Jenny, targeted exactly this concern, and challenged FATCA's legality in the context of data privacy laws in the EU like GDPR.
Mr Noseda recently described FATCA as a "data privacy disaster waiting to happen". In light of the Schrems II case, he has written to UK and EU bodies to seek further clarification on how this new ruling affects FATCA. In a letter dated July 16 to the UK Information Commissioner's Office (ICO), which had previously opted against further investigation of FATCA in the UK, Noseda wrote that this earlier decision should be re-examined, as "it is now abundantly clear that the ICO should have considered the fundamental issues raised by Jenny in her complaint, notably the compatability of the processing and transfer of her data to the US under UK FATCA with her fundamental rights to privacy and data protection".
One of the complaints leveled at FATCA, beyond concerns relating to data security, is its capacity to inhibit access for overseas Americans to basic financial services like bank accounts and credit cards. Some financial institutions in the UK and Europe do not accept US Citizens as clients due to the extensive data sharing required, and the prospect of financial penalties for not complying with FATCA rules. This means any invalidation of FATCA could prove enormously helpful to overseas Americans.
However, a written question and answer exchanged in the House of Commons could indicate that the Schrems II case ruling by the CJEU could be ignored by the UK Government in a post Brexit environment.
Chi Onwurah, Shadow Minister for Digital, Culture, Media and Sport, asked the Government "what legal mechanisms allow the transfer of UK citizens' data to the US."
Responding for the Government was Minister of State John Whittingdale, who said "UK data protection legislation sets out the rules for transferring personal data from the UK to a third country, including the US. For general processing, and unless a derogation can be relied upon, transfers are typically made either on the basis of an adequacy decision of the European Commission in respect of the third country or by using one of the so-called 'alternative transfer mechanisms', such as 'Standard Contractual Clauses' or 'Binding Corporate Rules'."
Citing the Schrems II case, Mr Whittingdale said "On Thursday 16 July the Court of Justice of the European Union handed down its judgment in the case known as 'Schrems II'. The Court invalidated the EU’s 'Privacy Shield' adequacy decision and it is therefore no longer a valid basis for the transfer of personal data from the UK to the US. The Court also concluded that 'Standard Contractual Clauses' remained a valid legal mechanism for international transfers, where such clauses can, in light of the wider circumstances, secure the level of protection required under the GDPR."
He added "The UK Government is working with the Information Commissioner’s Office and international counterparts on the implications of the judgment and to update guidance on international data transfers as soon as possible."
Perhaps the most significant aspect of Mr Whittingdale's response is his conclusion, in which he says "During the transition period the CJEU’s decisions are binding on the UK. From the end of the transition period, the UK will be responsible for the means by which personal data may be lawfully transferred to countries outside of the UK, including adequacy decisions and alternative transfer mechanisms."
The UK Government cited independence from CJEU rulings as one of its red lines in early Brexit negotiations, so this could simply be a reflection of that negotiating position. However, it also opens the possibility that if the Schrems II case does lead to a general reappraisal of FATCA in terms of the European Union, such protections could be bypassed in a post-EU Britain. The UK Government has been questioned on FATCA before, so this discussion findings its way to the House of Commons is hopefully a positive indication that any changes at an EU level will be asked of the UK Government irrespective of the role of the CJEU in the UK's personal data transfer rules.
The question and answer from the House of Commons website can be found in full at www.theyworkforyou.com