A recent decision by the U.S. Court of Appeals for the Sixth Circuit that granted the IRS access to certain EU personal data has created potential legal compliance implications for multinational organizations subject to EU privacy laws.  The Court ruled in favor of the IRS, authorizing the IRS to issue summonses to Eaton Corporation (“Eaton”) for employee performance reviews from Eaton’s Irish affiliate as part of a government audit to assess whether Eaton’s transfer of intellectual property was intended for tax evasion. The decision highlights the growing tension between U.S. tax compliance requirements and EU privacy laws.

The IRS’s demands were met with strong resistance from Eaton’s legal team, who asserted that complying with the court order would contravene the EU General Data Protection Regulation (“GDPR”). The GDPR prohibits the sharing of personal data (including employee performance reviews) outside of the EU to “third countries” unless certain conditions are met. Eaton argued that every unredacted detail shared with the IRS may be subject to intense examination by EU regulators, who could require justification for the disclosure and impose penalties on Eaton if the company were found to be in violation of the GDPR. The Court held that any potential GDPR implications may be minimal, given that the employee performance reviews lacked sensitive personal information. The Court stated, “European regulators would surprise the court even if they issued anything more than a marginal fine,” given that Eaton’s transfer of EU personal data to the IRS in the U.S. would be in furtherance of its compliance with a U.S. court order.

The case is United States v. Eaton Corp., 2025 BL 280566, 6th Cir., No. 24-3732, 8/8/25.