ITALY – Court Ruling (European Union, 2026)

Events Giving Rise to the Application The data subjects, Ferrieri and Bonassisa, were subjected to tax audits during which the Italian Tax Authority (the controller) requested and obtained their banking and financial transaction data from banks on the basis of tax audit purposes, without prior judicial scrutiny and without providing reasons. The applicants were notified from their banks only after the data had been accessed and used. The banks informed them that they had received legally binding requests to disclose information relating to their bank accounts and that they were obliged to comply. The data subjects complained of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures, arguing that any available remedies under national law, were ineffective in practice. More specific, the data subjects argued that Italian law lacked any effective ex post review of the measures. Civil remedies were merely theoretical, because there were no case-law examples of this, and unable to provide urgent protection, challenges before tax courts were only possible years later and could not invalidate tax assessments even if authorization was unlawful, and the Taxpayer’s Guarantor had no power to issue binding decisions. They therefore lodged an application before the European Court of Human Rights, alleging a violation of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8 of the Convention]. The data subjects also claimed compensation for the non-pecuniary damage they had suffered and asked the Court to determine the amount it deemed to be appropriate. Domestic Legislation Under [https://def.finanze.it/DocTribFrontend/getAttoNormativoDetail.do?ACTION=getSommario&id=%7B75A4827C-3766-4ECC-9C45-00C8D6CDC552%7D Italian tax law], the Tax Authority is empowered to access taxpayers’ banking data for the purposes of tax audits and assessments. Such access is authorized through an internal administrative decision, which is considered a preparatory administrative act, is not subject to prior judicial authorization, and cannot be challenged independently before the tax courts. Taxpayers are generally informed only after their banking data has already been obtained. While taxpayers may challenge the resulting tax assessment before the tax courts, domestic case-law consistently holds that these tax assessments are not automatically invalid even where banking data was obtained unlawfully, unless the taxpayer can demonstrate concrete harm to a constitutionally protected right. The Taxpayer’s Guarantor, an independent body intended to safeguard taxpayers’ rights, may issue recommendations or invite the tax authority to reconsider its actions, but has no binding powers. The European Court of Human Rights found that the Italian legal framework governing tax authorities’ access to taxpayers’ banking data gave rise to a violation of Article 8 ECHR. While the interference pursued a legitimate aim, namely the prevention of tax evasion and the protection of the economic well-being of the State,and was based on domestic law, the Court held that it was not in accordance with the law” within the meaning of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8 ECHR]. In particular, the Court emphasized that Italian law conferred very broad discretionary powers on the tax authorities to obtain extensive banking and financial data, without requiring prior judicial authorization or a reasoned decision. The authorization to access banking data was classified in domestic law as a purely internal, preparatory administrative act, which neither had to be justified nor could be independently challenged by the taxpayer. Moreover, taxpayers were generally informed only after their data had already been obtained and processed. The Court held that the domestic framework failed to provide effective ex remedies as safeguards against abuse. Authorizations to access banking data did not need to be reasoned and could not invalidate a tax assessment even if the data were unlawfully obtained, making challenges before the tax courts ineffective, uncertain, and potentially available only years later. Although administrative guidelines required banking audits to be necessary, proportionate, and targeted, these safeguards were non-binding and lacked legal force. Moreover, civil remedies were merely theoretical, as Italy failed to demonstrate their existence and effectiveness in practice, no relevant case-law examples were provided, and such remedies were in any event incapable of offering urgent or precautionary protection. Finally, the Taxpayer’s Guarantor lacked binding powers, but rather merely supervises the activity of the tax authorities. The Court found that the contested measures were not subject to effective ex post judicial or independent review and therefore rejected the Government’s objection of non-exhaustion of domestic remedies. It concluded that, although Italian law provided a general legal basis for accessing banking data, the framework failed to meet the Convention’s quality-of-law requirements, as it granted the authorities unfettered discretion and lacked sufficient procedural safeguards. Consequently, the interference could not be regarded as “in accordance with the law” under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8 § 2 of the Convention.] The data subjects also claimed that the lack of an effective judicial remedy violated their right of access to justice, [https://www.echr.coe.int/documents/d/echr/convention_ENG Articles 6 § 1 and 13 ECHR,] but the Court considered the main legal issues already addressed and did not examine these separately. Under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 46 ECHR,] Italy must adopt measures to align its law and practice with the Court’s findings, as the violation of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8] was systemic, stemming from the domestic legal framework. The Court emphasized that the law should clearly define when and under what conditions authorities may access taxpayers’ banking data, requiring justification for such measures. Effective judicial or independent review must be available, assessing both compliance and the scope of measures, without waiting for a tax assessment notice. The framework should also consider international tax cooperation while safeguarding taxpayer rights. Under [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 41 ECHR], the Court held that the finding of a violation alone suffices to compensate the data subjects for non-pecuniary damage, dismissing the government’s objection.