1. The right to privacy in the European Convention on Human Rights and the Charter of Fundamental Rights of European Union

The right to respect for private life and the family, and the related right to protection of personal data, also defined as the right to privacy,^[3] derives from international agreements and European law. In particular, the right to privacy^[4] is guaranteed by the European Convention on Human Rights of 1950 (ECHR)^[5] which establishes that this right cannot be curtailed by the State, unless a number of conditions are complied with^[6]. More specifically, exemptions may be allowed provided: 1) they are “prescribed by law”,^[7] which is essentially the principle of legal reservation; 2) they are deemed to be necessary in a democratic society for the protection of the public interest^[8] (principle of proportionality).

The right to privacy also implies the right to protection of personal data, laid down in the Charter of Fundamental Rights of the European Union of 2000^[9]. After restating the right to privacy in private life,^[10] the Charter expressly recognized the right to protection of personal data^[11]. The Charter, like the ECHR, established that these rights may be restricted by the State^[12]. In particular, any restrictive measure must: 1) be “provided for by law”; 2) give rise to a “proportionate” and “necessary” limitation to the achievement of “general interest recognized by the Union” or to the need to protect the rights and freedoms of others (the “social function” of the exception).

The right to respect for private and family life and the related right to protection of personal data, laid down in the ECHR, are considered to be general principles of the European Union^[13] and, since they are safeguarded by the Charter, they have the same legal value as the Treaties^[14]. This means that the application of European Union law implies the application of these principles.  

2. Italian and European regulation of the right to protection of personal data

The right to protection of personal data is regulated by a specific European Directive^[15]. It requires that the treatment (e.g. collection, processing, storage)^[16] of personal data should: 1) take place in a legal manner;^[17] 2) include the verification of their accuracy and subsequent updating (the “principle of accuracy”)^[18]; 3) be inherent to the purposes for which it is performed^[19] (the principle of relevance); 4) be avoided as much as possible^[20] (the principle of proportionality). Violation of these principles implies, by express provision of the national legislature, the inadmissibility in a court of law of the personal data processed^[21].

In implementing the Directive, the Italian Privacy Code also provides that, before adopting a regulation affecting the right to protection of personal data, the Minister concerned must consult the Italian Data Protection Regulator (Garante) for the protection of personal data^[22]. As a rule, the protection of personal data (not of a “sensitive” kind),^[23] requires the prior consent of those involved, but derogations are permitted and Member States also have the option to introduce further exemptions to protect the legitimate interests of the entity processing  the data. In Italy, in particular, when it is a public entity (such as the tax authorities) collecting, processing and storing personal data, the protection relating to the processing of personal data is normally limited to “disclosure” to the person concerned. However, in the case of sensitive personal data, the information cannot be processed without consent, except in specific cases. Under certain conditions,^[24] Member States are allowed to make further exemptions.

Within these limits, Italy has stated that a public entity may proceed with the processing of sensitive data if and to the extent authorized by legislative provisions identifying the existence of a purpose of “overriding public interest”^[25]. It is also specified that, with regard to tax matters, this interest is established by definition,^[26] though the tax authorities are required to comply with the opinion of the Italian Data Protection Regulator on the protection of personal data in relation to the types of sensitive data that can be processed (relating to health, sexuality, and so on) and to the implementation of procedures (collection, processing, storage) in compliance with the provisions of the Italian Privacy Code.

3. Banking investigation and right to privacy     

In 2013, the Italian Courts^[27] and the Italian Data Protection Regulator^[28] limited the systematic intrusion of the tax authorities into the privacy of taxpayers, slowing down the trend towards total transparency in relation to the bank accounts of millions of citizens.

The Belgian Constitutional Court addressed similar issues in two decisions focusing on the proportionality of the obligations of collaboration and intrusion into the private sphere^[29]. The Belgian Court dealt with the issue of access to bank data, and handed down some significant rulings. In particular, it ruled on the constitutionality of the law regulating banking investigation procedures, deeming it to be compatible with the right to privacy laid down in Article 22 of the Belgian Constitution and Article 8 of the ECHR.

The two judgments establish a connection between banking secrecy and a number of issues and, in particular, whether the protection of banking information falls within the broader scope of the protection of privacy; whether and to what extent privacy should be balanced against the financial interests of the State; whether and to what extent the taxpayer can invoke the right to remain silent.

Prior to these questions is the one of whether the taxpayer can cite safeguards upheld not only by internal laws, including constitutional guarantees, but also by the European Convention on Human Rights and the case-law of the European Court of Human Rights. On this last point, the Court ruled that the Belgian tax investigations must respect the limits and principles of the Convention. The case-law of the ECHR^[30] is clear in considering the power of the State to raise taxes as bound by the limits derived from fundamental human rights, such as core property rights, including the right to privacy.

4. Conclusions

In this comparative study taking account of both the Italian and the Belgian experience, it is important to highlight that in Belgium, unlike Italy,^[31] the legislation allows tax inspections only if there are specific and detailed conditions; it requires prior notice by the tax administration to the taxpayer; and the taxpayer can appeal to the competent court. It is on the basis of these robust safeguards that the Belgian Court deems tax inspections to be reasonably justified.

On the other hand, the Italian legislator, in abolishing banking secrecy, has left the tax authorities as the arbiters of when to initiate this type of assessment^[32]. The tax administration has stated that banking investigations are allowed only if there is “strong evidence of tax evasion”: this condition, however, is not laid down by law.

In short, the present legislative framework gives rise to a risk that banking investigations may be carried out without any effective need. As a result, it must be concluded that the Italian regulation of banking investigations is not aligned with the right to privacy as regulated by the ECHR and by the European Charter of Fundamental Rights. Considering that the legislative provisions permitting the collection and processing of certain types of information can result in an infringement of human rights, how can this type of infringement be avoided? Information should be used by the tax authorities in a proportionate manner: otherwise a law seems to be needed to strike a balance between the constitutional rights concerned.

© Copyright Seast – All rights reserved