The CJEU will soon hear the Belgian DPA's case against FATCA, the tax treaty that results in the systematic bulk transfer of data about thousands of "Accidental Americans" to the IRS.

FATCA is a US law intended to prevent US citizens from hiding assets in foreign banks.

But it also hits "Accidental Americans"—people who might have been born in the US and acquired a US passport, but have very little connection to the country.

Under an intergovernmental agreement (IGA), the Belgian state regularly transfers personal data to the Inland Revenue. In May 2023, the DPA ordered these transfers to stop, saying that they were unlawful under the GDPR. 

Belgium argues that the 2014 IGS predated the GDPR and is thus valid under Article 96, which says that older international agreements remain valid as long as they were lawful at the time. 

Among 13 questions to the CJEU:

— Article 96: Does the "grandfather clause" offer indefinite protection to pre-GDPR international agreements, even if they violate fundamental rights?

— Are Member States obliged to renegotiate or revoke old treaties that clash with the GDPR?

— Can Article 49(1)(d) (important public interest) justify systematic, bulk, annual transfers? (The EDPB generally says "no").

— Does the EU-US Data Privacy Framework (DPF) imply that the US public sector bodies offer adequate protection in the context of data transfers?

If the CJEU rules that Article 96 is not a blank cheque and that public interest derogations cannot support bulk surveillance, the legal mechanism for FATCA across the entire EU could collapse.

Could be a pretty big deal!