Commissioner Michael McGrath has deferred to national data protection authorities and the Court of Justice of the European Union (CJEU) to determine whether data transfers under the US Foreign Account Tax Compliance Act (FATCA) comply with the General Data Protection Regulation (GDPR), signalling that the Commission will not intervene pre-emptively. The answer, given on behalf of the Commission, impacts EU citizens' data privacy rights, national tax authorities, and the balance between fighting tax evasion and protecting personal data.
McGrath was responding to a parliamentary question from Greens/EFA MEP Saskia Bricmont and S&D MEP Murielle Laurent, who raised concerns following a 2025 Belgian Data Protection Authority ruling that FATCA data transfers violate GDPR, and a subsequent referral of preliminary questions to the CJEU by the Brussels Cour des Marchés.
The Commissioner's answer contains no concrete proposals, numerical targets, or new initiatives. Instead, it reiterates the existing legal framework: it is for independent data protection authorities (DPAs) and national courts, ultimately the CJEU, to enforce GDPR compliance. The Commission will follow developments closely, including through the European Data Protection Board.
Policy orientation and ambition McGrath's response leans toward preserving the status quo and avoiding unilateral EU action while the CJEU case (C-804/25) is pending. He emphasises the need for an 'appropriate balance' between data protection and fighting tax avoidance, suggesting the Commission sees legitimate public interest in FATCA's objectives. This cautious approach avoids pre-judging the CJEU and leaves Member States to manage bilateral FATCA agreements.
Expected institutional follow-up The key milestone is the CJEU preliminary ruling, which will provide binding guidance on GDPR compliance for FATCA data transfers. The Commission is likely to wait for that judgment before considering any legislative or policy changes. No timeline for the ruling has been given. In the meantime, DPAs may issue further decisions, and the European Parliament may continue to press for stronger safeguards.
← Atlas › News › Justice & Citizenship