FIRST SECTION
CASE OF FERRIERI AND BONASSISA v. ITALY
(Applications nos. 40607/19 and 34583/20)
 
JUDGMENT
 
Art 8 • Private life • Access and examination of applicants’ banking data, including bank account information, transaction histories, and other financial operations related to or traceable to them, by the Tax Authority for tax audit purposes • “Quality of law” requirements not met • Legal framework afforded domestic authorities unfettered discretion with regard to contested measures’ scope and conditions • Lack of sufficient procedural safeguards • Contested measures not subject to an effective ex post judicial or independent review • Interferences “not in accordance with the law”
Art 46 • General measures • Systemic problem • Respondent State to bring its legislation and practice into line with Court’s findings • Need for specific rules in domestic law, indicating circumstances in which and conditions on which the domestic authorities were allowed to have access to taxpayers’ banking data, providing for effective judicial or independent review, and taking into account the context of international cooperation between tax authorities
 
Prepared by the Registry. Does not bind the Court. STRASBOURG
8 January 2026
 
FINAL
 
11/05/2026
 
This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Ferrieri and Bonassisa v. Italy,
The European Court of Human Rights (First Section), sitting as a Chamber composed of:
 Ivana Jelić, President,
 Erik Wennerström,
 Raffaele Sabato,
 Frédéric Krenc,
 Davor Derenčinović,
 Alain Chablais,
 Anna Adamska-Gallant, judges,
and Ilse Freiwirth, Section Registrar,
Having regard to:
the applications (nos. 40607/19 and 34583/20) against the Italian Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Italian nationals, Mr Matteo Ferrieri and Mrs Ornella Bonassisa (“the applicants”), on 23 July 2019 and 1 August 2020 respectively;
the decision to give notice of the applications to the Italian Government (“the Government”);
the parties’ observations;
Having deliberated in private on 2 December 2025,
Delivers the following judgment, which was adopted on that date:
INTRODUCTION
1. The case concerns access to and the examination of the applicants’ banking data, including bank account information, transaction histories, and details of other financial operations either related to the applicants or traceable to them. Those measures (hereinafter “the contested measures”) were implemented by the Tax Authority (Agenzia delle Entrate) for tax audit purposes. The applicants complained of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures. THE FACTS
2. The first applicant (application no. 40607/19), Mr M. Ferrieri, was born in 1965 and lives Cerignola. He was represented by Mr C. Stasi, a lawyer practicing in Foggia. The second applicant (application no. 34583/20), Mrs O. Bonassisa, was born in 1977 and lives in Foggia. She is an accountant representing herself before the Court. 3. The Government were represented by their Agent, Mr L. D’Ascia, Avvocato dello Stato. 4. The facts of the case may be summarised as follows. 5. On 15 July 2019 the first applicant and on 16 July 2020 the second applicant were notified by their banks that the banks had received requests from the Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them, for a specified period of time, in respect of the first applicant from 1 January to 31 December 2017 and in respect of the second applicant from 1 January 2016 to 31 December 2017. The banks informed the applicants that they were going to comply with their legal obligation to provide the requested information. 6. The authorisation to obtain such data directly from banking institutions had been issued by directors of the Tax Authority under Article 51 § 2 (7) of Presidential Decree no. 633 of 26 October 1972 (“Decree no. 633/1972”, see paragraph 7 below) and Article 32 § 1 (7) of Presidential Decree no. 600 of 29 September 1973 (“Decree no. 600/1973”, see paragraph 9 below). RELEVANT LEGAL FRAMEWORK AND PRACTICE
I. DOMESTIC LAW
A. Presidential Decree no. 633 of 26 October 1972 (Establishment and regulation of value-added tax)
7. The measures at issue in the present case are regulated by Article 51 of Decree no. 633/1972, as in force at the relevant time, which reads as follows:
“1. The value-added tax offices check the declarations submitted and the payments made by taxpayers, detect any omissions and proceed to the assessment and collection of the taxes or additional taxes due; they supervise compliance with the obligations relating to the invoicing and registration of transactions, the keeping of accounting records, and the other obligations set out in this Decree; [and] they impose fines and surcharges and submit reports to the judicial authorities for violations sanctioned under criminal law. The appropriate risk analysis activities are carried out to check the declarations submitted and identify the persons who have failed to submit them. 2. For the purpose of carrying out their functions [as set out in the previous paragraph], the tax offices can:
... (7)  having obtained prior authorisation from the central director of assessment of the Tax Authority or its regional director, or, as concerns the Revenue Police, from [the] regional head [of the Revenue Police], request that banks provide ... data, information and documents relating to any [financial] relationship or transactions ..., including services rendered, [involving] their clients, as well as the guarantees given by third parties or the financial operators mentioned above, and the particulars of the persons for whom the same financial operators have carried out the above-mentioned transactions ... The request should be addressed to the head of the centralised structure or the head of the office [which receives the request], who shall immediately notify the person concerned; the relevant response must be sent to the head of the office [which has initiated the proceedings].
... 4. Requests under paragraph 2 point (7), as well as the relevant responses, even if negative, shall be submitted exclusively by electronic means. A provision of the Director of the Revenue Agency shall lay down the implementing provisions and the procedures for transmitting the requests [and] replies, as well as the data and information concerning the relationships and transactions indicated in point (7) above.”
8. Article 57 establishes the time-limits for issuing a tax assessment notice finding that a taxpayer failed to comply with the relevant tax obligations in a specific fiscal year. Its first paragraph, as in force at the relevant time, provides that the taxpayer must be notified of the assessment by 31 December of the fifth year following the year in which the tax declaration was filed. The second paragraph states that in the event of a complete omission to file a declaration, the taxpayer can be notified of the tax assessment by 31 December of the seventh year following the year in which the declaration should have been filed. B. Presidential Decree no. 600 of 29 September 1973 (Common provisions concerning the assessment of income taxes)
9. Article 32 § 1 (7) of Decree no. 600/1973, concerning the assessment of income taxes, reproduces the provision set out in Article 51 § 2 (7) of Decree no. 633/1972 in relation to the assessment of value-added tax (VAT) (see paragraph 7 above). 10. Article 43 reiterates the same time-limits for issuing a tax assessment notice as those set out in Article 57 of Decree no. 633/1972 (see paragraph 8 above). C. Legislative Decree no. 546 of 31 December 1992 (Provisions concerning tax judicial proceedings)
11. Article 19 of Decree no. 546/1992, as in force at the material time, included an exhaustive list of the acts that could be challenged before the tax courts. Its relevant parts read as follows:
Article 19: Acts that can be challenged and the subject of the complaint
“1. Complaints [to the tax courts] can be lodged against:
(a)  a tax assessment notice;
(b)  a tax liquidation notice;
(c)  an order imposing sanctions;
(d)  a tax collection notice;
... (i)  any other act which the law expressly states can be challenged independently.
... 2. Acts other than those expressly provided for cannot be challenged independently. Any act that can be challenged independently may be challenged solely on the basis of its own irregularities ...”
D. Law no. 212 of 27 July 2000 (the Act on Taxpayers’ Rights)
12. The relevant provisions of Law no. 212/2000 read as follows:
Section 13: Taxpayer’s Guarantor
“1. A Taxpayer’s Guarantor is established at each directorate of revenues in the regions and autonomous provinces. 2. The Taxpayer’s Guarantor, operating in full autonomy, is an [individual person acting as a] body [who is] chosen and appointed by the president of the regional tax court or its detached section in whose district the regional directorate of the tax authority is based ... 6. The Taxpayer’s Guarantor addresses requests for documents or clarifications to the competent offices, [and does so] also on the basis of reports submitted in writing by the taxpayer or any other interested party who complains of malfunctions, irregularities, incorrectness, abnormal or unreasonable administrative practices, or any other behaviour likely to undermine the relationship of trust between citizens and the financial administration. [The competent offices] respond within thirty days, and [this] activates the self-correction procedures (autotutela) in respect of administrative assessments or collection notices of which the taxpayer has been notified. The Taxpayer’s Guarantor communicates the outcome of the activity carried out to the regional or district directorates [of the tax authorities] or to the area headquarters of the Revenue Police, as well as to supervisory bodies, informing the person who reported [the irregularity]. 7. The Taxpayer’s Guarantor makes recommendations to tax office managers to protect the taxpayer and organise services in the best way.
...”
E. The power of self-correction (autotutela)
13. As part of its power of “self-correction” (autotutela), a public administrative body can annul or revoke decisions that have already been made, without the intervention of a judicial authority. II. DOMESTIC PRACTICE
14. Over the years, the Tax Authority has issued several administrative circulars aimed at clarifying the conditions under which the power to carry out tax audits of banking data may be exercised, and the procedure to be followed by tax offices for that purpose (see also Italgomme Pneumatici S.r.l. v. Italy, nos. 36617/18 and 12 others, §§ 55-59, 6 February 2025). A. Circular no. 131 of 30 July 1994
15. In Circular no. 131 of 30 July 1994 (“Circular no. 131/1994”), the Tax Authority established criteria for selecting taxpayers and investigation methods in relation to checks on income tax and value-added tax. 16. In respect of the criteria for carrying out tax audits of banking data, the relevant part of the circular read as follows:
“Tax audits of banking data will, in particular, be carried out in respect of
-  total or near-total tax evaders;
-  persons with no accounting records or with accounting records that are obviously unreliable;
-  persons carrying out import-export transactions;
-  persons who have issued and/or used invoices for non-existent transactions; [and]
-  persons whose financial capacity is clearly in stark contrast to the[ir] declared income.”
17. Circular no. 131/1994 further stated that tax offices asking for authorisation to carry out tax audits of banking data “[had to] sufficiently substantiate requests for authorisation to the regional directorates, in order to provide them with useful elements of evaluation”. In particular, a request had to indicate the following elements:
“-  the data aimed at identifying the taxpayer;
-  the reasons for undertaking the inquiry;
-  the elements aimed at assessing the fiscal situation of the taxpayer;
-  the reasons for considering that a tax audit of banking data would be useful in respect of the tax inquiry;
-  the time period in respect of which the tax audit of banking data should be carried out;
-  the banks ... to which the request should be submitted ...;”
18. Circular no. 131/1994 clarified that, on the basis of that information, the regional directorates had to check the formal and substantial legality (controllo sia di legittimità che di merito) of the request before issuing the requested authorisation. 19. As regards a decision to carry out a tax audit of banking data, the circular further stated that the domestic authorities had to undertake a cost‑benefit analysis:
“It must be stressed that tax audits of banking data should be initiated in cases [where] the fruitfulness of the tax audit [in question] has been assessed. So, on the basis of common experience, the ‘costs’ of the tax audit (represented by the inevitable extension of the inquiry in terms of time and the complexity of the analysis of the accounts) must be weighed against the relative ‘benefits’ of an evidential nature, relating to the presumed size of the recoverable taxable amounts. The principle of economy of action (in terms of cost-benefit) must, moreover, strongly guide all the tax audit activity of the offices.”
B. Circular no. 32/E of 19 October 2006
20. In Circular no. 32/E of 19 October 2006 (“Circular no. 32/E/2006”), the Tax Authority provided clarifications concerning the powers of tax offices in the context of tax inquiries, including the power to request that banks provide information and data concerning transaction histories and transactions in taxpayers’ bank accounts. 21. The circular confirmed that authorisation to undertake tax audits of banking data had to be requested in the context of a formalised procedure designed to safeguard taxpayers’ rights and the transparent and impartial exercise of administrative action, in conformity with the principles enshrined in the Act on Taxpayers’ Rights (see paragraph 12 above). C. Circular no. 25/E of 26 August 2014
22. In Circular no. 25/E of 26 August 2014 (“Circular no. 25/E/2014”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2014. 23. In respect of tax audits of banking data, the circular read as follows:
“With specific regard to ... financial investigations, it is reiterated that [they] must be used only after carefully assessing the risk of significant discrepancies in [a] tax declaration (significative anomalie dichiarative), and ideally only when the tax office has already instituted a tax inquiry.”
D. Circular no. 16 of 28 April 2016
24. In Circular no. 16 of 28 April 2016 (“Circular no. 16/2016”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2016. 25. In respect of tax audits of banking data, the circular read as follows:
“The use of financial investigations, which should be used only after carefully considering the risk of significant discrepancies in [a] tax declaration, and when the tax office has already instituted a tax inquiry, must be appropriate and designed to obtain credible and reliable assessments.”
III. DOMESTIC CASE-LAW
A. Case-law on authorisation to obtain taxpayers’ banking data
26. In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation issued by a director of a tax office to obtain information directly from banks concerning taxpayers’ transaction histories, transactions and other dispositions was an act of a merely internal and procedural nature (carattere meramente endoprocedimentale) which could not be challenged independently before the tax courts. 27. In judgment no. 8849 of 30 April 2015, the Court of Cassation observed that authorisation did not have to contain reasons, as no such requirement had been imposed under the applicable domestic provisions. The court held that such authorisation was merely an internal administrative act which could not be challenged by the bank that had been asked to provide the information, and the taxpayer concerned did not have to be notified of it. Since the authorisation could not be challenged, in the Court of Cassation’s view, it did not need to include any kind of reasoning. 28. Similarly, in judgment no. 19564 of 24 July 2018, the Court of Cassation defined authorisation as a “mere preparatory act” (atto meramente preparatorio) which served an “organisational function” (funzione organizzativa) within the hierarchical structure of offices, but had no effect on a taxpayer. B. Case-law on ex post remedies
1. Tax courts
29. In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation to obtain taxpayers’ banking data could be challenged by lodging a complaint with the tax courts against a tax assessment notice based on information obtained through such a measure. 30. As regards the reasons for challenging authorisation, in judgment no. 17158 of 28 June 2018, the Court of Cassation held that failure to notify a taxpayer of such authorisation could not affect its validity (see also judgment no. 16874 of 21 July 2009 and judgment no. 20420 of 26 September 2014 of the Court of Cassation). Given that authorisation was merely an administrative act issued by the Tax Authority, only a complete lack of such authorisation could be challenged by means of a complaint against a tax assessment notice based on information acquired in the absence of any authorisation, provided that it could be demonstrated that the lack of authorisation had caused specific prejudice to the taxpayer concerned (see judgment no. 14026 of 3 August 2012 and judgment no. 3628 of 10 February 2017 of the Court of Cassation). 31. More recently, the Court of Cassation clarified that a tax assessment notice could not be invalidated merely because it was based on banking data obtained in the absence of any authorisation issued by the competent management body. Similarly, a taxpayer would need to demonstrate that the lack of authorisation had caused him or her specific prejudice in relation to a constitutionally protected right or interest (see judgment no. 3242 of 10 February 2021 and judgment no. 10576 of 1 April 2022 of the Court of Cassation). 2. The Taxpayer’s Guarantor
32. In judgment no. 25212 of 24 August 2022, the Court of Cassation clarified, although not in the context of tax audits of banking data but in the context of reimbursement of tax paid in excess of the amount legally due in relation to inheritance matters, that the Taxpayer’s Guarantor could not adopt binding decisions. The Court of Cassation held as follows:
“The legal system currently in force does not expressly provide for the Tax Authority or the entities which are entitled to collect taxes being obliged to implement a self- correction (autotutela) measure requested by the Taxpayer’s Guarantor, or to comply with the decisions taken by the Taxpayer’s Guarantor. Indeed, the [decisions] of the Taxpayer’s Guarantor are not binding and therefore do not produce legal effects, but only constitute warnings entailing at most only an obligation to respond to the request for self-correction and/or review the file presented by the taxpayer. Ultimately, the Taxpayer’s Guarantor is not recognised as having any active management powers. [The body] cannot therefore exercise authoritative or sanctioning powers in respect of tax administration offices or, following the activation of a self-correction procedure, replace the tax administration in reviewing any illegitimate [notice]. In this regard, it has been said that the legislation establishing [the Taxpayer’s Guarantor] does not give [that body] the power to cancel tax notices by way of self-correction, nor does it establish a duty for the tax administration to decide [a case] in the manner requested by the Guarantor. According to the most acceptable interpretation, [the legislation] seems to limit itself to giving the Taxpayer’s Guarantor the power to merely initiate the [self- correction] procedure. However, [once the relevant procedure has been initiated], the tax services would therefore be required to respond to the request of the Taxpayer’s Guarantor by issuing, at the very least, a notice indicating why they do not intend to follow up on [that request].”
IV. EUROPEAN UNION LAW
A. Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC
33. Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation (the Directive on Administrative Cooperation, “the DAC”) repealed Directive 77/799/ECC in force until then. The DAC has been amended several times, the most recent directive being DAC8 in 2023[1]. DAC9 has entered into force on 7 May 2025 and must be transposed no later than 31 December 2025. Through the DAC, EU countries can make use of mechanisms like the automatic exchange of information and the exchange of information on request to ensure that foreign income is subject to tax. The automatic exchange of information means the systematic communication of pre-defined information from the tax administration of an EU country to the tax administration of another EU country. The exchange of information comes in three forms – automatic, on-request and spontaneous – that are specific to the type of information to be exchanged. Information is exchanged between one competent authority and another through a secured network, ensuring confidentiality and privacy. 34. Recital 20 of the DAC reads as follows:
“However, a Member State should not refuse to transmit information because it has no domestic interest or because the information is held by a bank, other financial institution, nominee or person acting in an agency or fiduciary capacity or because it relates to ownership interests in a person.”
35. The relevant provisions of the DAC read as follows:
Article 5: Procedure for exchange of information on request
“At the request of the requesting authority, the requested authority shall communicate to the requesting authority any information referred to in Article 1(1) that it has in its possession or that it obtains as a result of administrative enquiries.”
Article 8: Scope and conditions of mandatory automatic exchange of information
“1. The competent authority of each Member State shall, by automatic exchange, communicate to the competent authority of any other Member State, information regarding taxable periods as from 1 January 2014 that is available concerning residents in that other Member State, on the following specific categories of income and capital as they are to be understood under the national legislation of the Member State which communicates the information:
(a)  income from employment;
(b)  director’s fees;
(c)  life insurance products not covered by other Union legal instruments on exchange of information and other similar measures;
(d)  pensions;
(e)  ownership of and income from immovable property.
...”
Article 18: Obligations
“1. If information is requested by a Member State in accordance with this Directive, the requested Member State shall use its measures aimed at gathering information to obtain the requested information, even though that Member State may not need such information for its own tax purposes. That obligation is without prejudice to paragraphs 2, 3 and 4 of Article 17, the invocation of which shall in no case be construed as permitting a requested Member State to decline to supply information solely because it has no domestic interest in such information. 2. In no case shall Article 17(2) and (4) be construed as permitting a requested authority of a Member State to decline to supply information solely because this information is held by a bank, other financial institution, nominee or person acting in an agency or a fiduciary capacity or because it relates to ownership interests in a person. 3. Notwithstanding paragraph 2, a Member State may refuse the transmission of requested information where such information concerns taxable periods prior to 1 January 2011 and where the transmission of such information could have been refused on the basis of Article 8(1) of Directive 77/799/EEC if it had been requested before 11 March 2011.”
36. Commission Implementing Regulation (EU) 2025/648 of 2 April 2025 on amending Implementing Regulation (EU) 2015/2378 provides standard forms and computerised formats to be used in relation to Council Directive 2011/16/EU as amended by Council Directive 2021/514/EU, specifically setting out when member States have to submit statistical data in relation to information reported by digital platform operators and the types of statistics to be provided in relation to joint audits. B. Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
37. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, “the GDPR”) (OJ 2016 L 119/1) entered into force on 24 May 2016 and has applied since 25 May 2018. 38. Article 5 of the GDPR establishes the principles relating to processing of personal data, such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Pursuant to Article 13 of the GDPR, data controllers have the obligation to inform a data subject of the collection of their personal data and provide the data subject with certain information relevant thereto as specified in the provision. Article 15 of the GDPR further provides that the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed and, where that is the case, access to the personal data and other relevant information as set out in the provision. 39. Recital 31 of the GDPR reads as follows:
Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, or financial market authorities responsible for the regulation and supervision of securities markets should not be regarded as recipients if they receive personal data which are necessary to carry out a particular inquiry in the general interest, in accordance with Union or Member State law. The requests for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing. 40. Within the context of the aforementioned rules, Article 23 provides as follows:
Article 23: Restrictions
“1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
... (e)  other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
...”
C. Case-law of the Court of Justice of the European Union
41. In its judgment of 22 October 2013 in Sabou (C‑276/12, EU:C:2013:678), the Grand Chamber of the Court of Justice of the European Union (CJEU) held as follows:
“38. The Court has previously ruled that observance of the rights of the defence is a general principle of European Union law which applies where the authorities are minded to adopt a measure which will adversely affect an individual (see [Case C‑349/07 Sopropé [2008] ECR I‑10369], paragraph 36). [...]
39. The question arises as to whether the decision of a competent authority of a Member State to request assistance from a competent authority of another Member State and the latter’s decision to examine witnesses for the purposes of responding to that request constitute acts which, because of their consequences for the taxpayer, make it necessary for him to be heard. 40. All the Member States which submitted observations to the Court argued that a request for information by one Member State sent to the tax authorities of another Member State does not constitute an act giving rise to such an obligation. They rightly consider that, in tax inspection procedures, the investigation stage, during which information is collected and which includes the request for information by one tax authority to another, must be distinguished from the contentious stage, between the tax authorities and the taxpayer, which begins when the taxpayer is sent the proposed adjustment.
[...]
46. Accordingly, the answer to the first and second questions is that European Union law, as it results in particular from Directive 77/799 and the fundamental right to be heard, must be interpreted as not conferring on a taxpayer of a Member State either the right to be informed of a request for assistance from that Member State addressed to another Member State, in particular in order to verify the information provided by that taxpayer in his income tax return, or the right to take part in formulating the request addressed to the requested Member State, or the right to take part in examinations of witnesses organised by the requested Member State.”
42. In its judgment of 6 October 2020 in Luxembourg State (C‑245/19 and C-246/19, EU:C:2020:795), the CJEU ruled as follows:
“1. Article 47 of the Charter of Fundamental Rights of the European Union, read in conjunction with Articles 7 and 8 and Article 52(1) thereof, must be interpreted as:
–  precluding legislation of a Member State implementing the procedure for the exchange of information on request established by Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC, as amended by Council Directive 2014/107/EU of 9 December 2014, which prevents a person holding information from bringing an action against a decision by which the competent authority of that Member State orders that person to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, and as
–  not precluding such legislation from preventing the taxpayer concerned, in that other Member State, by the investigation giving rise to that request for exchange of information and the third parties concerned by the information in question from bringing actions against that decision. 2. Article 1(1) and Article 5 of Directive 2011/16, as amended by Directive 2014/107, must be interpreted as meaning that a decision by which the competent authority of a Member State orders a person holding information to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, is to be considered, taken together with that request, as concerning information which is not manifestly devoid of any foreseeable relevance where it states the identity of the person holding the information in question, that of the taxpayer concerned by the investigation giving rise to the request for exchange of information, and the period covered by that investigation, and where it relates to contracts, invoices and payments which, although not specifically identified, are defined by criteria relating, first, to the fact that they were concluded or carried out by the person holding the information, secondly, to the fact that they took place during the period covered by that investigation and, thirdly, to their connection with the taxpayer concerned.”
V. INTERNATIONAL LAW
The Convention on Mutual Administrative Assistance in Tax Matters
43. The Convention on Mutual Administrative Assistance in Tax Matters was developed jointly by the Organisation for Economic Co-operation and Development (OECD) and the Council of Europe. It was concluded in Strasbourg on 25 January 1988 and amended by the Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters, which entered into force on 1 June 2011. Italy ratified the Convention on 31 January 2006 and the amending Protocol on 17 January 2012. The latter entered into force in respect of Italy on 1 May 2012. 44. The relevant parts of the Explanatory Report to the 2010 Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters clarified:
“1. The object of this Convention is to promote international co operation for a better operation of national tax laws, while respecting the fundamental rights of taxpayers.
... 6. In this context, the Convention attempts to reconcile the respective legitimate interests of those involved: in particular, the requirements of mutual international assistance in tax assessment and enforcement, respect for special features of national legal systems, the confidential nature of information exchanged between national authorities and the fundamental rights of taxpayers. 7. Taxpayers have especially the right to respect for their privacy and the right to a proper procedure in the determination of their rights and obligations in tax matters, including appropriate protection against discrimination and double taxation. 8. In applying the Convention, tax authorities will be bound to operate within the framework of national laws. The Convention specifically ensures that taxpayers’ rights under national laws are fully safeguarded. However, national laws should not be applied in a manner that undermines the object and purpose of the Convention. In other words, the Parties are expected not to unduly prevent or delay effective administrative assistance.”
45. The relevant provisions of the Convention on Mutual Administrative Assistance in Tax Matters read as follows:
Article 1: Object of the Convention and persons covered
“1. The Parties shall, subject to the provisions of Chapter IV, provide administrative assistance to each other in tax matters. Such assistance may involve, where appropriate, measures taken by judicial bodies. 2. Such administrative assistance shall comprise:
a.  exchange of information, including simultaneous tax examinations and participation in tax examinations abroad;
b.  assistance in recovery, including measures of conservancy; and
c.  service of documents. 3. A Party shall provide administrative assistance whether the person affected is a resident or national of a Party or of any other State.”
Article 4: General provision
“1. The Parties shall exchange any information, in particular as provided in this section, that is foreseeably relevant for the administration or enforcement of their domestic laws concerning the taxes covered by this Convention. 2. Deleted. 3. Any Party may, by a declaration addressed to one of the Depositaries, indicate that, according to its internal legislation, its authorities may inform its resident or national before transmitting information concerning him, in conformity with Articles 5 and 7.”
Article 21: Protection of persons and limits to the obligation to provide assistance
“1. Nothing in this Convention shall affect the rights and safeguards secured to persons by the laws or administrative practice of the requested State. 2. Except in the case of Article 14, the provisions of this Convention shall not be construed so as to impose on the requested State the obligation:
a.  to carry out measures at variance with its own laws or administrative practice or the laws or administrative practice of the applicant State;
b.  to carry out measures which would be contrary to public policy (ordre public);
c.  to supply information which is not obtainable under its own laws or its administrative practice or under the laws of the applicant State or its administrative practice;
d.  to supply information which would disclose any trade, business, industrial, commercial or professional secret, or trade process, or information the disclosure of which would be contrary to public policy (ordre public);
e.  to provide administrative assistance if and insofar as it considers the taxation in the applicant State to be contrary to generally accepted taxation principles or to the provisions of a convention for the avoidance of double taxation, or of any other convention which the requested State has concluded with the applicant State;
f.  to provide administrative assistance for the purpose of administering or enforcing a provision of the tax law of the applicant State, or any requirement connected therewith, which discriminates against a national of the requested State as compared with a national of the applicant State in the same circumstances;
g.  to provide administrative assistance if the applicant State has not pursued all reasonable measures available under its laws or administrative practice, except where recourse to such measures would give rise to disproportionate difficulty;
h.  to provide assistance in recovery in those cases where the administrative burden for that State is clearly disproportionate to the benefit to be derived by the applicant State. 3. If information is requested by the applicant State in accordance with this Convention, the requested State shall use its information gathering measures to obtain the requested information, even though the requested State may not need such information for its own tax purposes. The obligation contained in the preceding sentence is subject to the limitations contained in this Convention, but in no case shall such limitations, including in particular those of paragraphs 1 and 2, be construed to permit a requested State to decline to supply information solely because it has no domestic interest in such information. 4. In no case shall the provisions of this Convention, including in particular those of paragraphs 1 and 2, be construed to permit a requested State to decline to supply information solely because the information is held by a bank, other financial institution, nominee or person acting in an agency or a fiduciary capacity or because it relates to ownership interests in a person.”
THE LAW
JOINDER OF THE APPLICATIONS
46. Having regard to the similar subject matter of the applications, the Court finds it appropriate to examine them jointly in a single judgment. II. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
47. The applicants complained under Article 8 of the Convention of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures. 48. Article 8 of the Convention reads as follows:
“1. Everyone has the right to respect for his private ... life ... 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
A. Admissibility
1. The Government’s non-exhaustion objection
(a)   The parties’ submissions
49. The Government submitted that the applicants had failed to exhaust domestic remedies, as they had not challenged the measures in question before the tax courts or the civil courts. 50. The applicants argued that a complaint to the tax courts would have been ineffective, as the availability of such a complaint had been uncertain and in any event would not have become available until some point in the future. As regards the civil courts, they submitted that the Government had failed to prove that such a remedy was available in practice, as they had not provided any case-law example in which the remedy had been used successfully in a similar case. (b)   The Court’s assessment
51. The Court notes that the Government’s objection as to whether the applicants had at their disposal an effective remedy to challenge the contested measures is closely related to the substance of the applicants’ complaints. Accordingly, it finds that this objection should be joined to the merits. 2. Conclusions as to admissibility
52. The Court notes that the complaint cannot be declared manifestly ill- founded within the meaning of Article 35 § 3 of the Convention. It further finds that there are no other grounds at this stage for declaring this complaint inadmissible, and therefore declares it admissible. B. Merits
1. Applicability of Article 8 and existence of an interference
53. In the present case, the Government did not dispute that the impugned measures had constituted interferences with the applicants’ right to respect for their private life within the meaning of Article 8 of the Convention. On the basis of the following observations, the Court sees no reason to find otherwise. 54. The Court has already held that the information which tax authorities obtain from banking documents undoubtedly amounts to personal data concerning an individual, regardless of whether it is sensitive information or not (see G.S.B. v. Switzerland, no. 28601/11, § 93, 22 December 2015). Moreover, such information may also concern professional dealings, and there is no reason of principle to justify excluding activities of a professional or business nature from the notion of “private life” (see, in the context of obtaining and copying banking data, M.N. and Others v. San Marino, no. 28005/12, § 51, 7 July 2015, and Brito Ferrinho Bexiga Villa-Nova v. Portugal, no. 69436/10, § 43, 1 December 2015). The Court has also held that details of taxable earned and unearned income, as well as taxable net assets, concern the “private life” of the individuals in question (see Samoylova v. Russia, no. 49108/11, § 62, 14 December 2021, and the cases cited therein), and that data such as a taxpayer’s name and home address, processed and published by the Tax Authority in connection with the fact that he or she has failed to fulfil his or her tax payment obligations, clearly concern information about “private life”, notwithstanding the fact that under domestic law, the data have been classified as information in the public interest (see L.B. v. Hungary [GC], no. 36345/16, § 104, 9 March 2023). 55. Furthermore, the Court has already found that consulting an individual’s bank account amounts to an interference with his or her right to respect for private life (see, in the context of consulting the banking data of a lawyer, Brito Ferrinho Bexiga Villa-Nova, cited above, § 44, and Sommer v. Germany, no. 73607/13, § 48, 27 April 2017). 56. It follows that, in the present case, the Tax Authority’s act of accessing the applicants’ banking data amounted to an interference with their right to respect for their “private life”. 57. The Court reiterates that an interference breaches Article 8 unless it is “in accordance with the law”, pursues one or more of the legitimate aims referred to in paragraph 2 and is, in addition, “necessary in a democratic society” to achieve those aims (see, among other authorities, Vinks and Ribicka v. Latvia, no. 28926/10, § 93, 30 January 2020). The exceptions provided for in Article 8 § 2 are to be interpreted narrowly, and the need for them in a given case must be convincingly established (ibid., § 101, with further references). 58. That said, it should be borne in mind that the Court has already considered that bank data, that is to say purely financial information, do not involve the transmission of intimate details or data closely linked to identity do not merit enhanced protection, and that accordingly, States enjoy a broad margin of appreciation in this field (see L.B. v. Hungary, § 119, and G.S.B. v. Switzerland, § 93, both cited above). 2. Whether the interference was “in accordance with the law”
(a)   The parties’ submissions
(i)      The applicants
59. The applicants submitted that the contested measures had been implemented on the basis of a “law” which did not comply with the quality requirements imposed by the principles of legality and the rule of law. 60. They highlighted that the applicable domestic provisions did not provide for an ex ante independent or judicial review of such measures, as they had to be authorised by a higher authority within the same Tax Authority which, in their view, was not independent. 61. The applicants further argued that the applicable provisions did not indicate the circumstances in which or the conditions on which the contested measures could be implemented, thereby giving the domestic authorities an unfettered margin of discretion. In their view, the criteria established in the circulars provided by the Government (see paragraphs 15-22 above) were very generic and left a wide margin of discretion. Moreover, they submitted that those criteria had not been fulfilled in their case, as they had not been suspected of or found liable of any of the serious tax offences referred to in those circulars. 62. They also contended that domestic law did not provide for any effective ex post checking of the measures. In their view, the possibility of lodging a complaint with the civil courts was merely theoretical, as there were no case-law examples of this. Moreover, a complaint to the civil courts would not have been an effective remedy, as those courts could not implement precautionary and urgent measures. As regards the possibility of challenging the measures before the tax courts, the applicants submitted that such an action could be brought only in respect of a tax assessment notice, which a person could be notified of several years after the alleged violation. Furthermore, the applicants would have been prevented from raising their complaints before the tax courts, as the well-established case-law of the Court of Cassation provided that a lack of authorisation or a lack of reasoning in authorisation did not justify the annulment of a tax assessment notice. As regards a complaint to the Taxpayer’s Guarantor, the applicants argued that that body would have had no power to assess the complaints raised in the present applications, and in any case, did not have the power to adopt binding decisions. 63. The applicants further submitted that they had not been notified of the authorisation to access their bank accounts, and that therefore they had not known why the measures had been implemented. In particular, they had not known whether they had been implemented for purely preventive and exploratory purposes, without indicating the offences of which they had been suspected. In their view, the failure to notify them of the authorisation had completely prevented them from subjecting the measures to effective checks. (ii)    The Government
64. The Government submitted that the procedure, conditions and scope of application of the contested measures were clearly provided for in Article 32 § 1 (7) of Decree no. 600/1973 and Article 51 § 2 (7) of Decree no. 633/1972, which, in their view, were sufficiently accessible, clear and foreseeable in their application. Moreover, the fourth paragraph of both provisions clarified that a request to implement the contested measures and responses to such a request had to be submitted by electronic means, thereby allowing the procedure to be checked. 65. The Government considered that the measures had been subjected to a sufficient ex ante check, given that a request for authorisation had to be submitted to the competent management body of the Tax Authority or the Revenue Police. Such a request had to refer to the relevant facts, the years being audited and the results of tax audits already undertaken, and to elaborate on the reasons justifying the requested access to bank accounts. The authorising body had to assess whether, in the light of the information provided, the conditions established under the law had been satisfied and the measure was proportionate and adequate in respect of the aim pursued. Moreover, Circular no. 131/1994 of the Tax Authority clarified that the contested measures could be authorised where there had been no tax declarations for several tax periods, where accounting records were not reliable, or where invoices for non-existent transactions had been identified (see paragraphs 15-16 above). It also stated that a request for authorisation had to be substantiated. Furthermore, Circular no. 25/E/2014 and Circular no. 16/2016 added that the measures could be authorised in cases where the expected tax returns exceeded a certain amount (see paragraphs 23 and 25 above). In accordance with the relevant domestic law and practice, the reasons justifying the contested measures could not, therefore, be generic or standardised. 66. The Government contended that the competent management body could be considered independent, as it had different functions and was usually located in a different office from the one requesting the authorisation. 67. They argued that the measures had a clear purpose – verifying effective compliance with taxpayers’ tax obligations, as provided for in Article 53 of the Italian Constitution. In order to be authorised, the measures had to comply with the following conditions: they had to prevent, identify and repress tax evasion; and they had to respect the criteria of legality, cost‑effectiveness, efficiency and transparency, and be carried out with full respect for the rights and guarantees granted to taxpayers. 68. As regards the existence of an ex post judicial review, the Government pointed out that authorisation to undertake financial tax audits of bank accounts was a “preparatory act” which could not be challenged in court immediately. It had to be challenged by lodging a complaint with the competent tax court against the final tax assessment notice, and by demonstrating that an irregularity in the authorisation process had affected the validity of that notice. In the Government’s view, several other countries had adopted a similar approach. By contrast, in cases in which tax assessment proceedings did not lead to the issuance of a tax assessment notice, the relevant authorisation to consult bank accounts could be challenged before the ordinary civil courts. Lastly, a taxpayer could report allegedly unlawful access to his or her bank account to the Taxpayer’s Guarantor, under Article 13 of Law no. 212/2000. That body could exercise its tax audit powers, remind the competent domestic authorities to comply with the applicable provisions, and report the identified shortcomings to the head of the competent office with a view to possibly instituting disciplinary proceedings. (b)   The Court’s assessment
(i)      General principles
69. The Court reiterates at the outset that the expression “in accordance with the law”, within the meaning of Article 8 § 2 of the Convention, requires firstly that the impugned measure should have some basis in domestic law. Secondly, the domestic law must be accessible to the person concerned. Thirdly, the person affected must be able, if need be with appropriate legal advice, to foresee the consequences of the domestic law for him, and fourthly, the domestic law must be compatible with the rule of law (see, among other authorities, De Tommaso v. Italy [GC], no. 43395/09, § 107, 23 February 2017). 70. The Court further points out that the concept of “law” must be understood in its “substantive” sense, not its “formal” one. It therefore includes everything that goes to make up the written law, including enactments of lower rank than statutes, and the relevant case-law authority (see, for example, National Federation of Sportspersons’ Associations and Unions (FNASS) and Others v. France, nos. 48151/11 and 77769/13, § 160, 18 January 2018). Accordingly, in assessing the lawfulness of an interference, and in particular the foreseeability of the domestic law in question, the Court has regard to both the text of the law and the manner in which it was applied and interpreted by the domestic authorities. It is the practical interpretation and application of the law by the domestic courts that must give individuals protection against arbitrary interference (see Italgomme Pneumatici S.r.l. and Others v. Italy, nos. 36617/18 and 12 others, § 96, 6 February 2025). 71. For domestic law to meet these requirements, it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention. In matters affecting fundamental rights, it would be contrary to the rule of law, one of the basic principles of a democratic society enshrined in the Convention, for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise. The level of precision required of domestic legislation – which cannot in any case provide for every eventuality – depends to a considerable degree on the content of the instrument in question, the field it is designed to cover and the number and status of those to whom it is addressed (see Italgomme Pneumatici S.r.l. and Others, cited above, § 97, and Bernh Larsen Holding AS and Others v. Norway, no. 24117/08, § 130, 14 March 2013, with further references). 72. The Court notes that while Article 8 contains no explicit procedural requirements, in applications lodged under this provision, it has emphasised that the concepts of lawfulness and the rule of law in a democratic society also require that measures affecting human rights must be subject to some form of adversarial proceedings before an independent body competent to review in a timely fashion the reasons for the decision and the relevant evidence (see Ivashchenko v. Russia, no. 61064/10, § 74, 13 February 2018, with further references). 73. With specific regard to the measures at issue in the present case, the Court has already found that it is legitimate for State authorities to access and even disclose, within formalised procedures, bank details in order to assess whether an applicant has complied with his or her tax obligations and, if not, to take the requisite legal action (see G.S.B. v. Switzerland, cited above, § 95). However, in such circumstances, the Court must be satisfied that there were sufficient and adequate guarantees against arbitrariness (ibid., § 96), including the possibility of an effective review of the measure at issue. 74. In this context, the Court has found that a subsequent judicial review can offer sufficient protection if a review procedure at an earlier stage would jeopardise the purpose of an investigation or surveillance. (ii)    Application of the above principles to the present case
75. The Court observes that the measures at issue were prescribed by law, notably Article 51 § 2 (7) of Decree no. 633/1972 (see paragraph 7 above) and Article 32 § 1 (7) of Decree no. 600/1973 and (see paragraph 9 above), and that the parties did not dispute that such provisions were accessible. However, the parties disagreed as to whether the legal basis for the contested measures, as derived from the cited domestic provisions, complied with the “quality-of-law” requirements imposed under Article 8 of the Convention. 76. Taking into account the scope of the applicants’ complaints, the Court deems it necessary to assess whether the legal basis delimited the scope of discretion conferred on the domestic authorities, and whether it provided for sufficient procedural safeguards capable of protecting the applicants against any abuse or arbitrariness. (α)     The delimitation of the scope of discretion conferred on the domestic authorities
77.

Outcome for Article 8: violation