Print Article

Crownjustice funded GDPR claim filed against HMRC by Jenny because of FATCA.


Jenny Webster is taking action against HMRC because of FATCA using funding


Why I am taking HMRC to court and need your help

Hi, I'm Jenny.  I am a US-born British citizen. I moved to the UK more than 20 years ago, when I was 22 years old. I am married, and I work with deaf students at the local university where I am a research associate.

I have a UK bank account where I receive my salary and pay my taxes on my earnings.

Like many Americans, I have found myself caught up in a piece of legislation called FATCA (Foreign Account Tax Compliance Act).

You may not have heard of it before, I hadn't either until I received a letter from my bank out of the blue saying that I "may have tax obligations in the US" and that the bank was going to send information about me to the Internal Revenue Service (IRS).

Under FATCA, banks are required to send all of my personal and financial information – and that of all those like me - to US authorities on an annual basis.


Today, 27 October 2021, Mishcon de Reya filed a claim before the High Court in London on behalf of Jenny for breaches of her individual rights under the EU's data protection legislation in connection with the processing of her sensitive personal and financial information under FATCA, causing personal damage and distress.

The defendant is HM Revenue & Customs (HMRC), the UK tax authority entrusted with carrying out data processing under regulations enacted to implement a bilateral agreement with the US, known as 'Inter-Governmental Agreement' or 'IGA'.

Commenting on the case, Filippo Noseda, who has been representing Jenny in the claim said:

  • "Jenny's claim is symptomatic of the steady erosion of individuals' data-privacy rights by governments"

As the alleged data breaches took place before Brexit,

  • Jenny's claim engages the GDPR as well as the previous EU Data Protection Directive, which was at the heart of the recent "Schrems II" judgment on the transfer of personal data to the US.
  • In that case, the Court of Justice of the European Union held that US data protection rules are not essentially equivalent to those required under EU law.

Jenny's claim is a reminder that individuals' data protection rights are relevant in the context of e-commerce, as well as data processing by governments.