The FATCA Wars: Jenny Goes to Court

Robert Goulder

There’s a new lawsuit before the U.K. High Court that you should know about. If you happen to be a U.S. expat, you might already know about it because it could affect your future. The matter is commonly known as Jenny’s case, and it’s been kicking around for a few years as a complaint with HM Revenue & Customs. It first gained notoriety because the taxpayer took the unusual step of crowdfunding her legal expenses.¹

Until recently Jenny sought to preserve her anonymity. Thus, the reticence to disclose her surname. With this latest court proceeding, filed October 27, continued anonymity was no longer an option. The High Court docket disclosed her full name as Jenny Webster, but the tax world still refers to this legal tussle as Jenny’s case.

Three things stand out about her case. First, it’s a platform to criticize citizenship-based taxation.² Second, it presents a unique challenge to the Foreign Account Tax Compliance Act that could have ramifications for the regime’s durability.³ Third, it illustrates how HMRC and the U.K. government’s Information Commissioner’s Office (ICO) have neglected the country’s taxpayers as far as their data protection rights are concerned.

The ICO’s behavior is particularly disappointing given that it is, in theory, an independent body established to uphold individual data privacy. How the ICO has handled Jenny’s case reveals it to be a lap dog for the conjoined interests of the U.K. government and the country’s influential banking sector — which would be pleased to see no further taxpayer complaints about FATCA.

If Jenny’s case is any example, there’s nothing independent about the ICO. When confronted with a situation deemed to be sensitive for various reasons, its instinct is to huddle with the affected stakeholders and take orders in the form of a policy review. What good are such information facilities if they turn spineless at the first whiff of controversy?

FATCA was not HMRC’s creation, to be fair. The necessary compliance upgrades come at no small expense to foreign banks. Both felt bullied by the unilateral aspects of the U.S. legislation. But now that participation in the data harvesting regime has become entrenched, it’s in their shared interest to maintain the status quo and discourage disruptions — such as pesky taxpayers who raise the matter of inadequate data protection.

The United Kingdom is not alone in this obstinance. We’ve seen other countries fall into the same pattern, in which the national office charged with upholding individual privacy rights is transformed into a feckless bureaucracy. The office becomes subsumed by the powers it should be standing vigil against. Rather than call out FATCA shortcomings in basic privacy safeguards, these bodies are predisposed to see, hear, and speak no evil. Their failure to act is more than just hypocritical; it’s actionable, as Jenny’s case may show in the months ahead.

I’m not talking about vague expectations of data privacy. Jenny’s case is rooted in hard law. Her claims are based largely on articles 78 and 82 of the General Data Protection Regulation (GDPR). She seeks a declaratory judgment that her data protection rights have been violated, coupled with appropriate damages. None of that is a stretch; article 79 of the GDPR establishes a right to effective judicial remedies.⁴

Litigation based on GDPR violations will become more frequent in the years ahead. Recent decisions from European courts confirm that anyone who gathers large batches of digital data from private individuals and transmits it to third parties is subject to the GDPR. That’s a major concern for large businesses, especially social media companies that scoop up bulk data from their European customers and send it back to headquarters.

The Court of Justice of the European Union does not take GDPR compliance lightly. It has already invalidated the safe harbor framework and the privacy shield (both U.S. inventions) that enabled data exporters to sidestep meaningful data protections for the sake of convenience. The implications of Schrems I and Schrems II loom large.⁵

The Schrems cases stand for the proposition that U.S. data protection rules are not essentially equivalent to corresponding EU rules.⁶ FATCA could have a problem if (or when) the same concepts are extended to the governmental bodies that collect and transmit tax, banking, and financial data. There’s no privacy shield for tax collectors, but the many countries that signed intergovernmental agreements act as if one exists.

Globally, there’s an unavoidable tension between statutory data protection and the desire for efficient sharing of tax information between national revenue bodies. Jenny’s case is compelling because it lies on the fault line between these colliding forces. Here, the taxpayer’s claim holds an intuitive appeal. That’s because the battle over individual privacy resembles tidal erosion; once an element of privacy is gone, it’s rarely taken back. The entropy of the modern world is that privacy erodes more quickly than it is restored. All of this makes Jenny’s case a battle worth fighting, both at the High Court and beyond.

World, Meet Jenny

Jenny was born and raised in the United States, making her a U.S. citizen. She spent the early part of her life in Maryland. In 2000, at age 22, she traveled to the United Kingdom to complete her undergraduate studies in journalism. There, she met a British man, got married, and settled down. She has resided in the county of Lancashire in northwest England ever since.

Jenny works as a self-employed editor. She supplements her income by working part-time as a researcher at the University of Central Lancashire. Her annual earnings are around £30,000.⁷ She’s been fully compliant with U.K. tax law. She is also fully compliant with U.S. tax law, although she didn’t learn of her ongoing U.S. tax obligations until 2016, when she was notified of them through her local bank. She promptly submitted foreign bank account reports for the previous six years and U.S. income tax returns for the previous three years. She didn’t owe any back taxes to the IRS because her gross income was well below the foreign earned income exclusion amount under IRC section 911 ($108,700).

Jenny is now 43 years old. She ceased being a U.S. resident more than two decades ago. She became a U.K. citizen in 2010, which is not surprising, as all aspects of her personal life centered around her home in England. This has resulted in Jenny holding dual citizenship for many years. Nothing odd about that. People do not necessarily forfeit the citizenship of their birthplaces by acquiring citizenship in their adoptive home countries.

In 2019 Jenny renounced her U.S. citizenship. It was not done as a political statement, but out of practical necessity to avoid the complications of FATCA. As a U.S. citizen living abroad, she was unable to open a simple investment account. Since giving up her U.S. citizenship, she no longer needs to file a U.S. income tax return. Her record as a law-abiding taxpayer is clean so far as the IRS and HMRC are concerned.

Dual citizenship should not create legal headaches for the individuals involved, not even when it comes to the thorny matter of income taxation. That’s because of a long-standing international norm to which almost every government in the world adheres: residence-based taxation, a straightforward rule that provides that people should primarily pay income tax where they reside. This follows from an economic doctrine known as the benefit principle, which dictates that people should generally pay income tax where they consume public services. If only life were that simple.

The problem is that the United States is one of only two countries that decline to follow residence-based taxation. The other is Eritrea, which historically needed to extract revenue from the global diaspora of Eritreans to fund the country’s lengthy military conflict with Ethiopia. The reasons why the United States finds it necessary to extract revenue from its expat community are less clear.

What justifies U.S. adherence to citizenship-based taxation in the face of contrary international norms? One response I often hear is that expats might return someday, choosing to take a renewed U.S. residence later in life. That’s a weak argument. The possibility of a return is always there, but it’s hardly a justification for taxing expats while they reside overseas. Taxation based on residence would kick in as soon as an expat returned; you don’t need citizenship-based taxation to address that situation.

Another response is that, as citizens, members of the expat community retain their U.S. passports and are free to access U.S. embassies around the world, perhaps availing themselves of consular services should the need ever arise. Those services aren’t trivial, but a blanket policy of citizenship-based taxation seems grossly disproportional to the benefits (real or hypothetical) of holding a U.S. passport. One imagines that the associated costs could be easily covered by charging an appropriate user fee when passports come up for periodic renewal. I have difficulty with the suggestion that citizenship-based taxation is necessary to prevent a sort of free-rider problem for expats with passports.

Alternatively, you might be tempted to think that citizenship-based taxation is necessary to prevent offshore tax evasion. I’m not buying it. As much as anyone, I’m bothered by the possibility of billionaires evading their U.S. income taxes by stashing private wealth in an overseas privacy haven and failing to declare the income on their U.S. tax returns. To be clear, that is not what occurred in Jenny’s case — and it’s not what occurs for the vast majority of expats.

Besides, every other country in the world (except Eritrea) practices residence-based taxation and is doing fine by it. They share the same concerns about cross-border tax evasion and manage to satisfactorily police the matter without resorting to taxation based on citizenship. Residence-based taxation is not some kind of lax treatment that gives license to scofflaws. Rather, it is what normalcy looks like as far as international tax standards are concerned. Congress should abandon citizenship-based taxation, but efforts to do so have failed to get traction.

David Versus Goliath

FATCA relies on a vast network of IGAs, which the United States signed with foreign governments about a decade ago. The IGAs were thrown together hastily, driven by the needs of administrative expediency rather than deliberative rigor. There’s a boilerplate nature to the IGAs. For the most part, foreign governments were shown the various models and told to sign one of them — or suffer the consequences of punitive withholding taxes. Life without an IGA wouldn’t be so pleasant for a foreign government.

So effective was this effort that other countries — taken with FATCA envy — soon launched a parallel initiative through the OECD’s common reporting standard (CRS). CRS achieves the same information exchange objectives, but through less thuggish means.

That a far-reaching network of bilateral agreements was developed over such a short period is impressive, but none of the IGA prototypes were drafted with data protection requirements in mind. The GDPR didn’t come into effect until May 2018, and the IGAs were concluded several years before that. The GDPR replaced an early EU directive on data protection from the mid-1990s, but nobody in Washington was worried about that, either. U.S. lawmakers are not in the habit of thinking about EU directives when drafting their legal documents. Those things tend to be dismissed as somebody else’s problem.

As mentioned, Jenny filed a complaint with HMRC claiming that the agency’s sharing of her personal data under FATCA violated her privacy rights. The matter was referred to the ICO, which is nominally charged with protecting citizens’ rights. The ICO’s mission statement reads as follows:

The U.K.’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data protection for individuals.

However, in a May 2020 letter issued to Jenny’s attorney, Filippo Noseda of Mishcon de Reya LLP, the ICO stated that HMRC was not required to consider the lawfulness of FATCA. Also, the ICO refused a Freedom of Information Act request directed to HMRC seeking materials relating to the FATCA regime and any internal concerns about inadequate data protection. In declining the FOIA request, the ICO cites the United Kingdom’s special relationship with the United States.⁸

Since when is that a basis for turning down an otherwise legitimate FOIA request? We’re not talking about nuclear codes. We’re talking about a bump in the road for automatic information exchange — which didn’t exist in any organized manner just a few years ago.

What kind of responsive documents might be in HMRC’s possession? Let’s start with correspondence in which the country’s tax officials discuss their concerns about the IGA and data protection. We know, for example, that EU data protection authorities raised concerns about FATCA as early as 2012. Noseda has unearthed documents in which the British Bankers’ Association raised concerns about FATCA and data privacy in October 2011. At trial, it may become relevant that U.K. officials — not to mention the rest of Europe — suspected early on that FATCA was going to have issues with privacy rights.

Where does that leave things? No part of the U.K. government apparatus is willing to scrutinize the IGA it signed with the United States. It’s classic stonewalling, in the hope that Jenny will give up and go away.

If the IGA were declared invalid, the result might be uncomfortable for U.K. banks. The statutory language of FATCA calls for a degree of withholding that would be disruptive. Is there any reason to think that the 27 IGAs signed by the EU member states — also subject to the GDPR — are substantively different? None of that baggage should be Jenny’s problem. The best scenario for her is that the High Court be guided exclusively by the law, without an eye on transatlantic politics.

How desperate is the U.K. government to keep these issues from being aired out in open court? Enough that HMRC’s defense includes a frivolous allegation that Jenny has engaged in an abuse of process by bringing her case, a position that conflicts with section 176 of the U.K. Data Protection Act of 2018, which allows redress against infringements.

As a spectator, I can’t wait for Jenny’s case to be argued before an independent court. Better still, any questions of European law might be referred to the CJEU — where the temptation to placate local sensitivities will be absent. After all, Jenny is going up against a government that’s actively seeking ways to curtail judicial review of its actions. You know it’s bad when a pro-Brexit Conservative member of Parliament is writing opinion pieces for The Guardian, warning his fellow citizens that the government is “robbing you of your right to challenge the state.”⁹

FATCA does have some defenders, and I do not wish to gloss over their arguments about the merits of automatic exchange of tax information. There’s a legitimate debate to be had about whether FATCA is sound policy, or whether the same compliance objectives could be better served through the alternative CRS framework, based on reciprocity. A two-way flow of information is presumably more equitable, and more sustainable, than a one-way street. Then again, CRS may have its own data protection issues.

The reason so many people are cheering on Jenny is simple. If the world must have disclosure regimes like FATCA or CRS, shouldn’t they be crafted to comply with the applicable laws governing data protection? To ask for anything less is to circumvent the rule of law.