homechevron_rightNewschevron_rightEU seeks to clarify GDPR rules for FATCA: what does this mean for you?

EU seeks to clarify GDPR rules for FATCA: what does this mean for you?

7 min

Published on: 03-11-2026 Last modified on: 03-11-2026

EU seeks to clarify GDPR rules for FATCA: what does this mean for you?

EU member states want to clarify that tax authorities may, under certain conditions, repeatedly transfer personal data to countries outside the European Union. This is relevant to FATCA and the annual transfer of financial information to the United States. The proposed clarification is not yet final law. For Americans living in Europe, bank reporting and any personal filing obligations therefore remain unchanged for now.

What does the Council of the European Union want to clarify?

On 21 October 2026, the Council of the European Union adopted its negotiating position on the Digital Omnibus. This is a package of proposed amendments and clarifications to European digital legislation, including the General Data Protection Regulation, or GDPR.

The published Council text says that transfers under Article 49(1)(d) GDPR do not necessarily have to be occasional. It expressly refers to international data exchanges between tax administrations. According to the Council position, such transfers may therefore be repetitive when this is necessary to serve an important public interest.

This text reflects proposals raised by Spain during EU discussions in 2026. Spain sought greater legal certainty for systematic international exchanges of tax information. Reports about those proposals specifically referred to FATCA as an example.

Has the GDPR already been amended?

No. The Council has adopted a negotiating position, not a final amendment to the GDPR. The European Parliament must still adopt its own position. Parliament and the Council can then negotiate the final text.

FATCA is also not named in the published Council mandate. The text refers more broadly to international exchanges between tax administrations. Other GDPR requirements remain relevant, including necessity, proportionality, data minimisation and appropriate safeguards.

It is therefore too early to say that the EU has definitively approved FATCA transfers or that every transfer of tax information is now permitted.

Why is there a dispute about FATCA and privacy?

Under FATCA, European financial institutions identify certain accounts connected with US persons. In countries with a Model 1 FATCA agreement, the bank reports the information to its national tax authority. That authority then exchanges reportable information with the US Internal Revenue Service.

Depending on the account and the applicable rules, the information may include the account holder’s name, address, US taxpayer identification number, account number, year-end balance or value, and certain income or proceeds.

The GDPR does not automatically prohibit every transfer outside the European Economic Area. Chapter V provides several possible transfer mechanisms and safeguards. Article 49 includes a derogation for transfers that are necessary for important reasons of public interest.

The legal dispute concerns whether that derogation can support automatic, periodic and large-scale FATCA transfers. Questions also remain about proportionality, data-subject rights, retention periods, available remedies and the extent to which the United States provides reciprocal information.

What is happening in the Belgian FATCA proceedings?

The issue became more urgent because of Belgian proceedings concerning the data of accidental Americans. In 2023, the Belgian Data Protection Authority found that certain FATCA transfers were unlawful. The Brussels Market Court later annulled that first decision and returned the case to the authority for reconsideration.

The Belgian authority adopted a new decision in April 2025. The Belgian State also appealed that decision. The Market Court subsequently referred thirteen questions to the Court of Justice of the European Union.

The Court of Justice has been asked to clarify, among other matters, how Articles 46, 49 and 96 GDPR apply to FATCA, which safeguards are required and whether reciprocity is relevant. The case is still pending. There is therefore no final European judgment that either approves or prohibits FATCA.

What does this mean for Americans living in Europe?

For now, the existing national FATCA frameworks remain applicable. The EU negotiations and the Belgian proceedings have not automatically suspended bank reporting. A European bank may therefore continue to ask about your place of birth, nationality, tax residence and US taxpayer identification number.

If you receive such a request, check exactly what the bank is asking. Do not provide a number you do not have or sign a declaration you do not understand. If you are unsure whether the United States considers you a US person, first establish your citizenship and tax status.

It is important to distinguish three separate matters:

Reporting by your bank: the financial institution determines whether your account is reportable under FATCA.
Your own US reporting: bank reporting does not replace a possible FBAR or Form 8938. Whether you must file either form depends on your circumstances and the separate requirements and thresholds for each form.
Paying tax: a tax return or information-reporting obligation does not automatically mean that additional US tax is due.

For general background, read the Americans Overseas explanation of US tax obligations for Americans living abroad.

Can FATCA affect a non-US partner?

If you hold a joint account with a US partner, that account may be included in FATCA reporting. This does not make the non-US partner subject to US tax solely because of the joint account. It may, however, mean that account information, including the full balance or value of the joint account, is reported.

The privacy discussion is therefore also relevant to non-US partners. You can ask the bank which information it processes, the legal basis it relies on and which data-protection rights are available. The answer may depend on the account, the account holders and the information the bank is required to report.

Which developments should you follow?

Two European developments now matter. The first is the European Parliament’s consideration of the Digital Omnibus and the subsequent negotiations over the final text. The second is the future judgment of the Court of Justice in the Belgian FATCA case.

Until there is greater clarity, two categorical conclusions should be avoided. The GDPR has not automatically rendered FATCA inapplicable. At the same time, the European Union has not definitively determined that every systematic FATCA transfer complies with all data-protection requirements.

The position as of 3 November 2026 is narrower. The Council wants to clarify that repetitive tax-data transfers may be possible for important reasons of public interest. The application of that clarification to FATCA and the safeguards that would be required remain legally contested.

Get Informed with Americans Overseas

We, the founders of Americans Overseas, were born in the Netherlands and received our American citizenship through our (American) mother.

When we first learned about the U.S.–Netherlands tax treaty around 2013, we felt disbelief (“this can’t be true”), anger (“how can they do this?”), fear (“will I get fined or have problems?”), and panic (“what should I do?”).

Unfortunately, it is true that there is a U.S. tax obligation for Dutch citizens who acquired American nationality by birth. There was no information from local authorities, the U.S. consulate referred us to the IRS, and the IRS itself was impenetrable.

That is why we started this initiative: to help others with reliable information, to prevent unnecessary panic, and to offer free, no‑obligation assistance. When needed, we can connect you with a network of affordable professionals (accountants) who can help you meet your U.S. tax obligations.

Sources

Frequently asked questions about FATCA and the GDPR

Understanding the US tax system, the obligations, and all the additional terms can be difficult. Especially if one lives outside of America. Is your question not answered? Contact us.

Has the GDPR already been amended for FATCA transfers?

No. On 21 October 2026, the Council of the EU adopted a negotiating position. The European Parliament must still adopt its own position, and the final text may change. There has therefore been no definitive amendment to the GDPR.
Has European FATCA reporting been suspended?

No general suspension has been announced. The EU negotiations and the Belgian court proceedings have not automatically suspended national FATCA reporting. Banks may continue to request information and report accounts under the applicable national FATCA framework.
Has the Court of Justice already ruled that FATCA violates the GDPR?

No. The Brussels Market Court referred thirteen questions about FATCA and the GDPR to the Court of Justice. Case C-804/25 is still pending. There is therefore no final European judgment that either approves or prohibits FATCA.
Does my bank’s FATCA report replace my FBAR or Form 8938?

No. FATCA reporting by a bank and your possible personal obligations to file an FBAR or Form 8938 are separate matters. Which forms you must file depends on your circumstances and the requirements and reporting thresholds for each form.
Does a joint account make my non-US partner subject to US tax?

Not solely because the partner holds a joint account with a US person. The account may nevertheless be reportable under FATCA, and the reported information may include the full balance or value of the joint account.