Banking and financial inspections and uncontrolled tax powers: the European Court of Human Rights recommends greater safeguards for taxpayers
With the Ferrieri and Bonasissa v. Italy judgment (applications nos. 40607/19 and 34583/20) the ECHR once again highlights the structural anomalies of the Italian tax investigation system, this time relating to access to bank data, and denounces its insufficient regulation, as well as the absence of adequate judicial safeguards. In line with the previous ‘Italgomme’ and ‘Agrisud’ judgments, the Court challenges a system that allows excessive administrative discretion in the exercise of investigative powers, together with only apparent guarantees for taxpayers. The Court's decision requires a fundamental review of the relationship between tax powers and fundamental rights (which should be) guaranteed by a State governed by the rule of law.
The European Court of Human Rights (ECHR) in the cases of Ferrieri and Bonasissa v. Italy (applications nos. 40607/19 and 34583/20) has once again condemned Italy for violating Article 8 [1] of the Convention for the Protection of Human Rights and Fundamental Freedoms (“European Convention”).
This ruling is part of a series of three decisions [2] criticizing Italian tax provisions relating to access, inspections, and audits; in this case, it concerns banking and financial investigations (including information on bank accounts, transaction histories, and details of other financial transactions of the applicants or attributable to them) regulated by Articles 32 of Presidential Decree No. 600 of 1973 and 51 of Presidential Decree No. 633 of 1972.
The Court proceeds from the assumption, now established in its case law [3], that the information obtained by the tax authorities from banking and financial documents, although classified as information of public interest under national law, constitutes personal data relating to private life, regardless of whether it relates to professional or business activities [4]; for this reason, their processing by the tax authorities constitutes an interference with private life that violates Article 8 of the European Convention and must therefore be justified according to the criteria of legality, necessity, and proportionality.
What is nonetheless decisive - consistently with the earlier Italgomme and Agrisud cases - is the intensity of the investigative powers exercised, determined by the disproportion between the aims pursued and the methods used (access to and acquisition of documents without adequate and specific justification) and, consequently, the degree of intrusion into the private sphere of the person concerned.
The Court's assessment therefore focuses on the quality of the legal framework governing the powers of the financial authority and the existence of appropriate safeguards to prevent arbitrary actions and abuses.
In this regard, the Court of Strasbourg reaffirms that the requirement of “conformity with the law” under Article 8(2) of the Europea Convention cannot be understood in a purely formal sense, i.e., as the mere existence of a legal basis, but must be interpreted in terms of substantive legality.
Although Article 8 does not contain explicit procedural requirements, the concepts of legitimacy and the rule of law in a democratic society require that measures affecting human rights must be subject to some form of adversarial proceedings before an independent authority competent to review the reasons for the decision in a timely manner (although not necessarily ex ante) [5].
Therefore, according to the Court, the power granted to the tax authorities to request data and information relating to taxpayers' banking and financial accounts does not, once again, meet this qualitative test, since the conditions for access are expressed in extremely broad and general terms, without being subject to a concrete assessment of their necessity and proportionality in the specific case [6].
The resulting discretion takes on the characteristics of essentially unlimited discretion; nor can administrative practices and internal circulars be said to be sufficient to stem the phenomenon, which, although relevant at the operational level, cannot replace the lack of specific legislative regulations and do not guarantee the legal certainty that is an essential element of the rule of law [7].
In this context, the principle of proportionality – which should operate as a criterion for rationalizing power and as a tool for balancing fiscal interests and individual rights – remains without any real conformative capacity, resulting in a purely formal ex post control, entrusted to judges required to assess the final act of investigation and not the interference itself.
The Court's assessment of the absence of effective remedies is therefore particularly incisive. Indeed, although it is legitimate for Authorities to access and even disclose [8], within the formal procedures, banking and financial data in order to assess whether an applicant has fulfilled their tax obligations and, if not, to take the necessary legal action, the Court must nevertheless ensure that there are sufficient and adequate safeguards against arbitrariness, including the possibility of an effective review of the measure in question [9].
This conclusion conflicts with the classification of authorization to access the data, in the Italian legal system, as an internal procedural act and therefore not independently contestable, with the possibility of reviewing its legitimacy only indirectly (and often belatedly) by challenging an eventual assessment notice before the tax court, pursuant to Article 19 of Legislative Decree No. 546/1992.
In this respect, therefore, the protection provided by the Italian tax system is a model of deferred and conditional protection, which the ECHR considers incompatible not only with Article 8 but also with Article 13 of the European Convention.
Nor can this deficit be compensated for by a complaint to the Taxpayers' Ombudsman pursuant to Article 13 of Law No. 212/2000 (Taxpayers' Charter), which has no binding powers as recognized by the case law of the Supreme Court [10].
In light of the above, the conclusion is that Italy – as in the case of Italgomme[11] – will have to comply systematically with the ruling of the ECHR, providing an adequate system not only of safeguards limiting the discretion of the tax authorities, but also of procedural guarantees for taxpayers, otherwise Italy risks a further increase in the number of judgments from Strasbourg.
[1] The article is entitled “Right to respect for private and family life” and paragraph 2 states “There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”. The violation of Articles 6 and 13 is covered by the assessment of the violation of Article 8 of the European Convention.
[2] See also the judgments of 2025 in the cases of Italgomme Pneumatici S.r.l. et al. v. Italy, no. 36617/18, and Agrisud 2014 S.r.l. semplificata et al. v. Italy, no. 32539/18.
[3] See G.S.B. v. Switzerland, no. 28601/11, § 93, December 22, 2015.
[4] See Samoylova v. Russia, no. 49108/11, § 62, December 14, 2021; M.N. and Others v. San Marino, no. 28005/12, § 51, July 7, 2015, and Brito Ferrinho Bexiga Villa-Nova v. Portugal, no. 69436/10, § 43, December 1, 2015.
[5] See § 72 of the judgment in question.
[6] See § 71 of the judgment in question: “For domestic law to meet these requirements, it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention. In matters affecting fundamental rights, it would be contrary to the rule of law, one of the basic principles of a democratic society enshrined in the Convention, for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise”.
[7] See Circular No. 16/E/2016; Circular No. 25/E/2014; Circular No. 32/E/2006.
[8] See Directive 2011/16/EU (DAC).
[9] See § 73 of the judgment in question.
[10] See Cass. No. 25121/22.
[11] Following the Italgomme ruling, Italy amended Article 12 of Law No. 212/2000 with Article 13-bis of Decree Law No. 84/2025, introducing the obligation to provide more detailed reasons for granting authorisation and in the related official reports for access to company offices.