The so-called common reporting standard (CRS) was introduced in 2015 as part of a worldwide effort to fight tax evasion but Mischon de Reya claims that the process is “excessive, as information is exchanged indiscriminately and affects all account holders regardless of the size of the account".
The complaint was filed on behalf of an EU citizen who used to live in the UK and now lives in Italy.
The law firm believes that CRS “goes beyond what is necessary to achieve the legitimate objective of fighting tax evasion” and therefore infringes data protection and privacy rights.
“In a democratic society, the rights to privacy and data protection are an essential safeguard to protect compliant citizens against potential abuses and must be treated with the appropriate seriousness by the authorities,” the company added.
In response, HMRC said that the organisation did not discuss individual cases but added: “HMRC shares some personal data with overseas tax authorities to ensure that the right tax is being paid, and the Organisation for Economic Co-operation & Development (OECD) ensures all recipient countries have high data security standards.
“HMRC only ever shares information when it’s lawful to do so. This includes complying with applicable GDPR requirements.”
Commenting on the complaint, a spokesperson for the ICO said: “Once a complaint has been made, we consider the details and whether any further action is necessary under GDPR. There is no set time frame for how long investigations take."