23/03/22

US: Bank to pay damages after ‘inaccurate’ client data sent.

As published on international-adviser.com, Wednesday 23 March, 2022.

Societe Generale subsidiary Banque Rhone-Alps (BRA) has been ordered to work with US tax authorities to erase a customer’s inaccurate personal data transferred under the US’ Foreign Account Tax Compliance Act (Fatca).

The ruling by the judicial tribunal of Grenoble stated that the bank will also need to pay damages to the unnamed client, law firm Orrick Herrington & Sutcliffe explained.

Failure to comply with the order will result in a daily fine for the bank.

The law firm said that the customer, who opened an account with BRA in 2005, was born in Ottawa, Canada, not in the US as the bank believed.

In 2014, the bank contacted the client to inform him it was going to share his account details with US tax authorities as he met the criteria of “Americaness”, meaning BRA was bound to transfer his data under Fatca.

But in 2017, the client submitted a request for rectification to the French bank, including an in-person meeting where he presented his passport and national identity card to prove he was not an American citizen. But the bank still did not recognise the customer was not born in the US.

This led to the client seeking a court order in 2018 requiring BRA to erase all of his personal data processed under Fatca up until 2017, or face a penalty of €1,000 (£843, $1,143) per day if it didn’t comply within 15 days.

The bank was also required to have the US tax authorities erase the Fatca declarations involving the client, or it would have been subject to a similar financial penalty.

BRA appealed the decision, but it was upheld by the court of appeal in Grenoble in March 2019.

The bank, however, did not execute the court order, but rather amended its internal records in 2018 and did not erase the “erroneous” data relating to the Fatca registration until 2019, and it only requested a rectification, under court order, in 2018, the law firm said.

As a result, in 2019 the client filed a further claim seeking substantial damages, quoting a breach of the General Data Protection Regulation (GDPR).

On 7 February 2022, the judicial tribunal of Grenoble stated that the bank could not contest the client’s place of birth after being provided with the necessary documentation, and it couldn’t either demonstrate the sum held in the client’s account exceeded $50,000 (£37,000, €44,000) – the minimum sum necessary for Fatca reporting.

As a result, the law firm said, the court found BRA failed to comply with its legal obligations, including:

• Not taking the necessary precautions to ensure the accuracy of the personal data processed regarding the client;
• Using the personal data for wrongful purposes since it was shared with a third party when it shouldn’t have been; and,
• As BRA claimed it could not ensure the erasure of the Fatca registration, it should have been even more careful regarding the initial registration conditions given that, as a legal entity bound by a duty of vigilance, it would have been aware of the claimant’s right to erasure, protected under French and EU law.

The bank has now been ordered to pay the client €15,000 in damages, €5,000 in costs and a daily fine of €1,500 starting from 60 days after the decision, if BRA fails to take the necessary steps to ensure the total erasure of the Fatca declarations until 2017 from the US tax authorities’ records.

The bank also has a month to communicate the decision to all its group of entities that might have submitted a Fatca declaration as well, or face an additionally daily fine of €500 per entity not notified.

International Adviser contacted Banque Rhone-Alpes for comment, but the bank did not reply in time for publication.