Privacy and tax information powers

In an era where tax administrations seek increasing amounts of information from taxpayers and others, and where the routinely exchange information with each other, a recent decision of the European Court of Human Rights on scope of  tax administrations’ powers to demand such information and procedural safeguards, is timely. In the case of Ferrieri and Bonassisa v Italy (Application nos. 40607/19 and 34583/20) 8 January 2026, ECLI:CE:ECHR:2026:0108JUD004060719,  the court ruled on the compatibility of Italian information gathering powers with Article 8 of the European Convention on Human Rights- the right to privacy. 

Facts

The facts followed a familiar pattern: the applicants, two Italian residents, were notified by their banks that the banks had received requests from the Italian Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them and that the banks were going to comply with their obligation to provide the requested information.

The applicants contended that he scope of the discretion  given to the Italian Tax Authority under national law was excessively broad. The law also lacked sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, notably the absence of judicial or independent review of the measures in question.

The applicants also said that they had not been notified of the authorisation to access their bank accounts, and therefore they had not known why the information had been sought. They did not known whether the information demanded  was only for preventive and exploratory purposes, without  any offences  being indicated. These failures had completely prevented them from effective checks over the measures taken.

By a majority, the court held that the right to privacy had been infringed. In doing so, the court provided a useful reminder of the application of this right to information powers of tax authorities.

The right to privacy

The right to respect for private and family life is set out in Article 8(1) as follows:

“Everyone has the right to respect for his private and family life, his home and his correspondence.”

Article 8(2) specifies the principle that “[t]here shall be no interference by a public authority with the exercise of this right…”

There was no dispute that the tax authority’s information powers in obtaining information from banks on their customers interfered with the right to respect for private life. Information from bank documents amounts to personal data concerning an individual, regardless of whether it is sensitive information or not. This includes  information on business activities earned and unearned income, as well as net assets.

However  Article 8(2) contains exceptions that may limit the scope of the right. Thus  interference with privacy may be justified if “in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

The court observed that these exceptions must be interpreted narrowly, and their need in a particular case must be convincingly established. Nonetheless, States enjoy a broad margin of appreciation in relation to purely financial information, do not involve the transmission of intimate details or data closely linked to identity.

Principles of legality and the rule of law

The applicants argued that the measures had been implemented on the basis of a “law” which did not comply with the quality requirements imposed by the principles of legality and the rule of law.

The Court confirmed that the expression “in accordance with the law”, imposed four requirements:

·         the measure must have some basis in domestic law;

·         that  law must be accessible to the person concerned;

·         the person affected must be able to foresee the consequences of that law, if necessary, with appropriate legal advice; and

·         that law must be compatible with the rule of law (one of the basic principles of a democratic society).

The  concept of “law” must be understood in a substantive and not a formal sense and includes statutes,  subordinate rules and case-law as well as the way it is applied and interpreted by the domestic authorities. Thus individuals must be protected against arbitrary interference by the practical interpretation and application of the law by the domestic courts. The rule of law,  requires:

·         discretion granted to the executive  cannot be unfettered and so the law must indicate, with sufficient clarity, the scope and  manner of exercise of any such discretion, and

·         measures affecting human rights must be subject to some form of adversarial proceedings before an independent body competent to review in a timely fashion the reasons for the decision and the relevant evidence. Judicial review after the fact may provide sufficient protection if an earlier review would jeopardise the purpose of an investigation.

While he court had previously ruled that it is legitimate for tax authorities to access and also disclose bank details for tax compliance purposes, such power must be exercised within the above legal framework.

Ruling

The Court decided that the mere fact that access to a taxpayer’s banking data tax purposes is permitted by statute confers an unfettered discretion on the tax authorities and is itself insufficient to delimit the scope of that discretion. Additional criteria contained in administrative circulars adopted and published by the Tax Authority could in principle delimit the scope of the discretion if they are binding on the Tax Authority. The court found that they were not so binding and therefore did not limit the discretion. The Italian law therefore did not meet the principle of legality.

The role of Domestic courts

Access a taxpayer’s banking data by a the tax authority cannot be challenged before the tax courts as it is considered to be merely preparatory to assessment. Such access can however be challenged in contesting a resulting tax assessment. The court ruled that this right did not  constitute an effective after-the-fact judicial remedy. This was on the basis that reasons for accessing the information did not have to be provided and an irregularity in information gathering  could affect the validity of a tax assessment. Furthermore,  an assessment could be issued several years after filing of a tax return and an effective remedy must become available within a reasonable period of time. Recourse to the civil courts would not provide a remedy  as the absence of a requirement to give  reasons before seeking the information would deprive a civil court of the ability scrutinise the action.

In the same vein the court considered that a complaint to the Taxpayer’s Guarantor (an ombudsman) which simply supervises the activity of the tax authorities and cannot issue binding decisions, would not constitute an effective remedy to guarantee against arbitrariness required by Article 8.

Dissenting judgement

Two of the seven judges dissented on the basis that the applicants made no attempt to seek a domestic remedy and thus did not exhaust domestic remedies. This, the minority considered, should render the  applications inadmissible.

International aspects

While the case concerned information powers used for domestic tax purposes, the case has significance for international exchange of information. The privacy issues where information is exchanged between tax authorities is doubled.  The Ferrieri and Bonassisa case only concerned information that was used for domestic purposes. Nonetheless,  Article 26(3)(c) of the OECD and UN Model treaties  would appear to preclude the supply of information either collected or held in breach of Article 8 of the ECHR on grounds of public policy. The same should apply where the State receiving the information would breach Article 8 or other provisions of the ECHR.

The ECHR will also be engaged in cases where a State sending  information has to consider whether to consent to information being used by  the receiving State for purposes other than those permitted by Article 26(2) of the OECD and UN Model treaties (“the assessment or collection of, the enforcement or prosecution in respect of, the determination of appeals in relation to the taxes”). In my view it would be unlawful to consent to a use that is outside the privacy exceptions in Article 8(2) of the ECHR.

This is not idle speculation in the current international environment where, for example, state capture by private interests is present, or where the  coercive power of the state is weaponised to pursue political rivals or settle personal grievances of individuals in the incumbent government.