The European Court of Human Rights has upheld the weaponisation of privacy to restrict tax authorities’ access to banking data 

There is weaponisation of privacy, and then there are cases that take it a step further. One thing is to close “public” access to information, as the infamous ruling of the European Court of Justice did to beneficial ownership information in 2022. But restricting routine access to information by tax authorities is another matter entirely. The European Court of Justice also did this in 2024, when it prevented Luxembourg tax authorities from accessing information held by a law firm to respond to a request from Spain. In that case at least, legal professional privilege (a sharp double-edged sword against privacy) was also at play. Now, the European Court of Human Rights (ECHR) has taken a similar approach. In the ruling Ferrieri and Bonassisa v. Italy of May 2026, it prevented Italian tax authorities from accessing local banking data on Italian taxpayers because it breached the right to privacy. 

Again, the tax authority didn’t want to access medical records, WhatsApp messages or personal photos. Italian tax authorities only sought information from banks including bank account details, transaction histories, and details of other financial operations. 

Importantly, the ECHR ruling also notes that, based on domestic regulations, these access powers are not a blank check, but based on objective criteria, mainly upon any indication of tax evasion or high-risk transactions: 

“the Tax Authority established criteria for selecting taxpayers and investigation methods in relation to checks on income tax and value-added tax. In respect of the criteria for carrying out tax audits of banking data, the relevant part of the circular read as follows: 

‘Tax audits of banking data will, in particular, be carried out in respect of 

-  total or near-total tax evaders; 

-  persons with no accounting records or with accounting records that are obviously unreliable; 

-  persons carrying out import-export transactions; 

-  persons who have issued and/or used invoices for non-existent transactions; [and] 

-  persons whose financial capacity is clearly in stark contrast to the[ir] declared income.” 

The ruling also described that Italian regulations require requests to be substantiated before tax directors can authorise them, and that these directors must check that those conditions are met: 

“Circular no. 131/1994 further stated that tax offices asking for authorisation to carry out tax audits of banking data “[had to] sufficiently substantiate requests for authorisation to the regional directorates, in order to provide them with useful elements of evaluation”. In particular, a request had to indicate the following elements: 

“-  the data aimed at identifying the taxpayer; 

-  the reasons for undertaking the inquiry; 

-  the elements aimed at assessing the fiscal situation of the taxpayer; 

-  the reasons for considering that a tax audit of banking data would be useful in respect of the tax inquiry; 

-  the time period in respect of which the tax audit of banking data should be carried out; 

-  the banks … to which the request should be submitted …;” 

Circular no. 131/1994 clarified that, on the basis of that information, the regional directorates had to check the formal and substantial legality (controllo sia di legittimità che di merito) of the request before issuing the requested authorisation. 

The ruling’s description of Italian circulars also suggests that Italian tax authorities do not seem too eager to access banking data, because doing so involves more time and resources to finish the audit. For that reason, directors should only authorise such requests where the likely benefits justify the costs: 

As regards a decision to carry out a tax audit of banking data, the circular further stated that the domestic authorities had to undertake a cost‑benefit analysis: 

“It must be stressed that tax audits of banking data should be initiated in cases [where] the fruitfulness of the tax audit [in question] has been assessed. So, on the basis of common experience, the ‘costs’ of the tax audit (represented by the inevitable extension of the inquiry in terms of time and the complexity of the analysis of the accounts) must be weighed against the relative ‘benefits’ of an evidential nature, relating to the presumed size of the recoverable taxable amounts. The principle of economy of action (in terms of cost-benefit) must, moreover, strongly guide all the tax audit activity of the offices.” 

And again: 

“With specific regard to … financial investigations, it is reiterated that [they] must be used only after carefully assessing the risk of significant discrepancies in [a] tax declaration (significative anomalie dichiarative), and ideally only when the tax office has already instituted a tax inquiry.” 

Taken together, these provisions suggest that Italian tax authorities are not particularly inclined to obtain banking information unless it offers substantive benefits compared to the costs involved. 

However, the ruling focused on another issue. The ECHR ruling cited an Italian court decision suggesting that the final authorisation (likely from a director of a tax office) to request information from a bank did not need to be reasoned. In the court’s view, this gave the authorities unfettered discretion and made the measure incompatible with the right to privacy: 

27. In judgment no. 8849 of 30 April 2015, the Court of Cassation observed that authorisation did not have to contain reasons, as no such requirement had been imposed under the applicable domestic provisions. The court held that such authorisation was merely an internal administrative act which could not be challenged by the bank that had been asked to provide the information, and the taxpayer concerned did not have to be notified of it. Since the authorisation could not be challenged, in the Court of Cassation’s view, it did not need to include any kind of reasoning. 

… 

81.  The Court is prepared to accept that the clear and detailed criteria laid down in the circulars adopted and published by the Tax Authority [mentioned in the quotes above] might be sufficient to complement the applicable domestic provisions and delimit the scope of discretion conferred on the domestic authorities, provided that they are binding on the authorities. 

However, this does not appear to be the case. In particular, the Court cannot but note that in the light of the Court of Cassation’s case‑law, authorisation does not have to contain reasoning (see paragraph 27 above). It follows that the authorities are not required to justify the exercise of their powers by giving reasons for their decisions and thereby showing that they are following the criteria laid down in the relevant domestic provisions, including the administrative circulars, resulting in them exercising unfettered discretion (see Bernh Larsen Holding AS and Others, cited above, § 130). 

82.  In the light of the above, the Court considers that the legal basis for the contested measures was incapable of sufficiently delimiting the scope of discretion conferred on the domestic authorities, and accordingly did not meet the “quality-of-law” requirement under Article 8 of the Convention.” (emphasis added). 

Let’s recap. Tax authorities in all cases struggle to detect tax evasion. Tax evasion is not a binary issue. It’s not like mining for gold and you either find something yellow and shiny or you don’t. Tax evasion is determined after looking at what the taxpayer declared, the risk of transactions, and many other factors. Even then, it can only be confirmed after getting access to additional documentation (e.g. banking data) to verify the taxpayer’s declarations. 

Even then, Italian tax authorities do not seem too eager about banking data. In addition to taxpayer rights’ concerns, Italian tax authorities’ circulars suggest that accessing banking information is mostly discouraged in the tax administrations’ own interest. It should not be done on a routine basis but only after a cost-benefit analysis because of the extra resources and time it will demand. For this reason, the tax auditor should provide reasons why access to banking data is necessary before the tax office director will authorise it. Once the director authorises it, however, the authorisation does not add to or explain the reasoning behind the request when asking the bank to provide the information (luckily, as the bank then tells its clients, as in this ruling). So, because this final authorisation does not require reasoning or justification, the ECHR found it to be discretionary and thus lacking a sufficient legal basis to justify interference with the right to privacy enshrined in Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms. 

We could be more sympathetic to the case if the tax authorities seemed to be exceeding their need for data, or going after political opponents or vulnerable populations. However, based on the limited information available in this case (the ruling also anonymises the full names of the taxpayers), it appears that they are ordinary taxpayers and that the tax authority only sought routine banking information.  

While Italian law could perhaps be drafted more effectively, supranational courts need to understand the crippling effect of their rulings, especially at a time when inequality is soaring, tax authorities are being diminished (including in Italy), and tax transparency is being challenged on privacy, data protection and taxpayers’ rights grounds. After the European Court of Justice ruling of 2022, many European countries closed their beneficial ownership registries, including secrecy jurisdictions where the ruling was not even binding. The weaponisation of privacy, whether through court rulings or concerns about the EU’s General Data Protection Regulation (GDPR), can also result in self-censorship. A report by Transparency International described the challenges of investigating grand corruption when it comes to privacy: 

“Privacy concerns compound the problem. Across EU member states, enforcement authorities have pointed to data protection rules, particularly the General Data Protection Regulation, as a major obstacle. Unclear or overly strict interpretations have fostered a climate of caution among data providers, who fear heavy fines for non-compliance. This has created a legal paradox: investigators need access to ownership and financial data to substantiate suspicion but cannot access that data until suspicion already exists.” (emphasis added) 

In other words, this ruling is a new bump in the road in the fight against tax evasion and illicit financial flows, especially considering that the road is already in poor shape. Although this case dealt with access to information for domestic tax purposes, there have also been lawsuits seeking to stop the exchange of information for tax purposes. 

If this weaponisation of privacy or abuse of taxpayers’ rights continues, it may not be long before new lawsuits or rulings begin requiring suspicion of tax evasion or the existence of a tax audit in order to narrow the scope of automatic exchange of information. Currently, automatic exchanges such as the OECD’s Common Reporting Standard and the Crypto-Asset Reporting Framework are useful precisely because they apply to all taxpayers. One could also imagine attempts to narrow access by tax authorities to domestic data based on conditions that apply to exchange of information on request, such as the “foreseeable relevance” requirement.  

To address these secrecy risks, a UN Tax Convention may help strengthen tax transparency, particularly on access to and exchange of information, and counter the weaponisation of privacy. Countries in the Global South may also offer useful alternatives to current European approaches to privacy, data protection and tax transparency. For instance, in Argentina the tax authority routinely has access to bank account and credit card information on taxpayers above a relatively low threshold. Better examples need to be identified to counter the weaponisation of privacy in Europe. 

Donate to Tax Justice Network

We rely on donations from people like you who value our research and campaigning to keep our work going. Help us do more work like the work above with a donation.