Vergi Denetiminde Banka Verilerine Erişim Güvenceleri

FIRST SECTION

CASE OF FERRIERI AND BONASSISA v. ITALY

(Applications nos. 40607/19 and 34583/20)

JUDGMENT

Art 8 • Private life • Access and examination of applicants’ banking data, including bank account information, transaction histories, and other financial operations related to or traceable to them, by the Tax Authority for tax audit purposes • “Quality of law” requirements not met • Legal framework afforded domestic authorities unfettered discretion with regard to contested measures’ scope and conditions • Lack of sufficient procedural safeguards • Contested measures not subject to an effective ex post judicial or independent review • Interferences “not in accordance with the law” Art 46 • General measures • Systemic problem • Respondent State to bring its legislation and practice into line with Court’s findings • Need for specific rules in domestic law, indicating circumstances in which and conditions on which the domestic authorities were allowed to have access to taxpayers’ banking data, providing for effective judicial or independent review, and taking into account the context of international cooperation between tax authorities

Prepared by the Registry. Does not bind the Court.

STRASBOURG

8 January 2026

FINAL 11/05/2026 This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision.  FERRIERI AND BONASSISA v. ITALY JUDGMENT

In the case of Ferrieri and Bonassisa v. Italy, The European Court of Human Rights (First Section), sitting as a Chamber composed of: Ivana Jelić, President, Erik Wennerström, Raffaele Sabato, Frédéric Krenc, Davor Derenčinović, Alain Chablais, Anna Adamska-Gallant, judges, and Ilse Freiwirth, Section Registrar, Having regard to: the applications (nos. 40607/19 and 34583/20) against the Italian Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Italian nationals, Mr Matteo Ferrieri and Mrs Ornella Bonassisa (“the applicants”), on 23 July 2019 and 1 August 2020 respectively; the decision to give notice of the applications to the Italian Government (“the Government”); the parties’ observations; Having deliberated in private on 2 December 2025, Delivers the following judgment, which was adopted on that date:

INTRODUCTION 1. The case concerns access to and the examination of the applicants’ banking data, including bank account information, transaction histories, and details of other financial operations either related to the applicants or traceable to them. Those measures (hereinafter “the contested measures”) were implemented by the Tax Authority (Agenzia delle Entrate) for tax audit purposes. The applicants complained of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures.

THE FACTS 2. The first applicant (application no. 40607/19), Mr M. Ferrieri, was born in 1965 and lives Cerignola. He was represented by Mr C. Stasi, a lawyer practicing in Foggia. The second applicant (application no. 34583/20), Mrs O. Bonassisa, was born in 1977 and lives in Foggia. She is an accountant representing herself before the Court.

1  FERRIERI AND BONASSISA v. ITALY JUDGMENT

3. The Government were represented by their Agent, Mr L. D’Ascia, Avvocato dello Stato. 4. The facts of the case may be summarised as follows. 5. On 15 July 2019 the first applicant and on 16 July 2020 the second applicant were notified by their banks that the banks had received requests from the Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them, for a specified period of time, in respect of the first applicant from 1 January to 31 December 2017 and in respect of the second applicant from 1 January 2016 to 31 December 2017. The banks informed the applicants that they were going to comply with their legal obligation to provide the requested information. 6. The authorisation to obtain such data directly from banking institutions had been issued by directors of the Tax Authority under Article 51 § 2 (7) of Presidential Decree no. 633 of 26 October 1972 (“Decree no. 633/1972”, see paragraph 7 below) and Article 32 § 1 (7) of Presidential Decree no. 600 of 29 September 1973 (“Decree no. 600/1973”, see paragraph 9 below).

RELEVANT LEGAL FRAMEWORK AND PRACTICE I. DOMESTIC LAW

A. Presidential Decree no. 633 of 26 October 1972 (Establishment and regulation of value-added tax)

7. The measures at issue in the present case are regulated by Article 51 of Decree no. 633/1972, as in force at the relevant time, which reads as follows: “1. The value-added tax offices check the declarations submitted and the payments made by taxpayers, detect any omissions and proceed to the assessment and collection of the taxes or additional taxes due; they supervise compliance with the obligations relating to the invoicing and registration of transactions, the keeping of accounting records, and the other obligations set out in this Decree; [and] they impose fines and surcharges and submit reports to the judicial authorities for violations sanctioned under criminal law. The appropriate risk analysis activities are carried out to check the declarations submitted and identify the persons who have failed to submit them. 2. For the purpose of carrying out their functions [as set out in the previous paragraph], the tax offices can: ... (7) having obtained prior authorisation from the central director of assessment of the Tax Authority or its regional director, or, as concerns the Revenue Police, from [the] regional head [of the Revenue Police], request that banks provide ... data, information and documents relating to any [financial] relationship or transactions ..., including services rendered, [involving] their clients, as well as the guarantees given by third parties or the financial operators mentioned above, and the particulars of the persons for whom the same financial operators have carried out the above-mentioned transactions ... The request should be addressed to the head of the centralised structure

2  FERRIERI AND BONASSISA v. ITALY JUDGMENT

or the head of the office [which receives the request], who shall immediately notify the person concerned; the relevant response must be sent to the head of the office [which has initiated the proceedings]. ... 4. Requests under paragraph 2 point (7), as well as the relevant responses, even if negative, shall be submitted exclusively by electronic means. A provision of the Director of the Revenue Agency shall lay down the implementing provisions and the procedures for transmitting the requests [and] replies, as well as the data and information concerning the relationships and transactions indicated in point (7) above.” 8. Article 57 establishes the time-limits for issuing a tax assessment notice finding that a taxpayer failed to comply with the relevant tax obligations in a specific fiscal year. Its first paragraph, as in force at the relevant time, provides that the taxpayer must be notified of the assessment by 31 December of the fifth year following the year in which the tax declaration was filed. The second paragraph states that in the event of a complete omission to file a declaration, the taxpayer can be notified of the tax assessment by 31 December of the seventh year following the year in which the declaration should have been filed.

B. Presidential Decree no. 600 of 29 September 1973 (Common provisions concerning the assessment of income taxes)

9. Article 32 § 1 (7) of Decree no. 600/1973, concerning the assessment of income taxes, reproduces the provision set out in Article 51 § 2 (7) of Decree no. 633/1972 in relation to the assessment of value-added tax (VAT) (see paragraph 7 above). 10. Article 43 reiterates the same time-limits for issuing a tax assessment notice as those set out in Article 57 of Decree no. 633/1972 (see paragraph 8 above).

C. Legislative Decree no. 546 of 31 December 1992 (Provisions concerning tax judicial proceedings)

11. Article 19 of Decree no. 546/1992, as in force at the material time, included an exhaustive list of the acts that could be challenged before the tax courts. Its relevant parts read as follows:

Article 19: Acts that can be challenged and the subject of the complaint “1. Complaints [to the tax courts] can be lodged against: (a) a tax assessment notice; (b) a tax liquidation notice; (c) an order imposing sanctions; (d) a tax collection notice;

3  FERRIERI AND BONASSISA v. ITALY JUDGMENT

... (i) any other act which the law expressly states can be challenged independently. ... 2. Acts other than those expressly provided for cannot be challenged independently. Any act that can be challenged independently may be challenged solely on the basis of its own irregularities ...”

D. Law no. 212 of 27 July 2000 (the Act on Taxpayers’ Rights)

12. The relevant provisions of Law no. 212/2000 read as follows:

Section 13: Taxpayer’s Guarantor “1. A Taxpayer’s Guarantor is established at each directorate of revenues in the regions and autonomous provinces. 2. The Taxpayer’s Guarantor, operating in full autonomy, is an [individual person acting as a] body [who is] chosen and appointed by the president of the regional tax court or its detached section in whose district the regional directorate of the tax authority is based ... 6. The Taxpayer’s Guarantor addresses requests for documents or clarifications to the competent offices, [and does so] also on the basis of reports submitted in writing by the taxpayer or any other interested party who complains of malfunctions, irregularities, incorrectness, abnormal or unreasonable administrative practices, or any other behaviour likely to undermine the relationship of trust between citizens and the financial administration. [The competent offices] respond within thirty days, and [this] activates the self-correction procedures (autotutela) in respect of administrative assessments or collection notices of which the taxpayer has been notified. The Taxpayer’s Guarantor communicates the outcome of the activity carried out to the regional or district directorates [of the tax authorities] or to the area headquarters of the Revenue Police, as well as to supervisory bodies, informing the person who reported [the irregularity]. 7. The Taxpayer’s Guarantor makes recommendations to tax office managers to protect the taxpayer and organise services in the best way. ...”

E. The power of self-correction (autotutela)

13. As part of its power of “self-correction” (autotutela), a public administrative body can annul or revoke decisions that have already been made, without the intervention of a judicial authority.

II. DOMESTIC PRACTICE

14. Over the years, the Tax Authority has issued several administrative circulars aimed at clarifying the conditions under which the power to carry out tax audits of banking data may be exercised, and the procedure to be

4  FERRIERI AND BONASSISA v. ITALY JUDGMENT

followed by tax offices for that purpose (see also Italgomme Pneumatici S.r.l. v. Italy, nos. 36617/18 and 12 others, §§ 55-59, 6 February 2025).

A. Circular no. 131 of 30 July 1994

15. In Circular no. 131 of 30 July 1994 (“Circular no. 131/1994”), the Tax Authority established criteria for selecting taxpayers and investigation methods in relation to checks on income tax and value-added tax. 16. In respect of the criteria for carrying out tax audits of banking data, the relevant part of the circular read as follows: “Tax audits of banking data will, in particular, be carried out in respect of - total or near-total tax evaders; - persons with no accounting records or with accounting records that are obviously unreliable; - persons carrying out import-export transactions; - persons who have issued and/or used invoices for non-existent transactions; [and] - persons whose financial capacity is clearly in stark contrast to the[ir] declared income.” 17. Circular no. 131/1994 further stated that tax offices asking for authorisation to carry out tax audits of banking data “[had to] sufficiently substantiate requests for authorisation to the regional directorates, in order to provide them with useful elements of evaluation”. In particular, a request had to indicate the following elements: “- the data aimed at identifying the taxpayer; - the reasons for undertaking the inquiry; - the elements aimed at assessing the fiscal situation of the taxpayer; - the reasons for considering that a tax audit of banking data would be useful in respect of the tax inquiry; - the time period in respect of which the tax audit of banking data should be carried out; - the banks ... to which the request should be submitted ...;” 18. Circular no. 131/1994 clarified that, on the basis of that information, the regional directorates had to check the formal and substantial legality (controllo sia di legittimità che di merito) of the request before issuing the requested authorisation. 19. As regards a decision to carry out a tax audit of banking data, the circular further stated that the domestic authorities had to undertake a cost-benefit analysis: “It must be stressed that tax audits of banking data should be initiated in cases [where] the fruitfulness of the tax audit [in question] has been assessed. So, on the basis of common experience, the ‘costs’ of the tax audit (represented by the inevitable extension

5  FERRIERI AND BONASSISA v. ITALY JUDGMENT

of the inquiry in terms of time and the complexity of the analysis of the accounts) must be weighed against the relative ‘benefits’ of an evidential nature, relating to the presumed size of the recoverable taxable amounts. The principle of economy of action (in terms of cost-benefit) must, moreover, strongly guide all the tax audit activity of the offices.”

B. Circular no. 32/E of 19 October 2006

20. In Circular no. 32/E of 19 October 2006 (“Circular no. 32/E/2006”), the Tax Authority provided clarifications concerning the powers of tax offices in the context of tax inquiries, including the power to request that banks provide information and data concerning transaction histories and transactions in taxpayers’ bank accounts. 21. The circular confirmed that authorisation to undertake tax audits of banking data had to be requested in the context of a formalised procedure designed to safeguard taxpayers’ rights and the transparent and impartial exercise of administrative action, in conformity with the principles enshrined in the Act on Taxpayers’ Rights (see paragraph 12 above).

C. Circular no. 25/E of 26 August 2014

22. In Circular no. 25/E of 26 August 2014 (“Circular no. 25/E/2014”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2014. 23. In respect of tax audits of banking data, the circular read as follows: “With specific regard to ... financial investigations, it is reiterated that [they] must be used only after carefully assessing the risk of significant discrepancies in [a] tax declaration (significative anomalie dichiarative), and ideally only when the tax office has already instituted a tax inquiry.”

D. Circular no. 16 of 28 April 2016

24. In Circular no. 16 of 28 April 2016 (“Circular no. 16/2016”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2016. 25. In respect of tax audits of banking data, the circular read as follows: “The use of financial investigations, which should be used only after carefully considering the risk of significant discrepancies in [a] tax declaration, and when the tax office has already instituted a tax inquiry, must be appropriate and designed to obtain credible and reliable assessments.”

6  FERRIERI AND BONASSISA v. ITALY JUDGMENT

III. DOMESTIC CASE-LAW

A. Case-law on authorisation to obtain taxpayers’ banking data

26. In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation issued by a director of a tax office to obtain information directly from banks concerning taxpayers’ transaction histories, transactions and other dispositions was an act of a merely internal and procedural nature (carattere meramente endoprocedimentale) which could not be challenged independently before the tax courts. 27. In judgment no. 8849 of 30 April 2015, the Court of Cassation observed that authorisation did not have to contain reasons, as no such requirement had been imposed under the applicable domestic provisions. The court held that such authorisation was merely an internal administrative act which could not be challenged by the bank that had been asked to provide the information, and the taxpayer concerned did not have to be notified of it. Since the authorisation could not be challenged, in the Court of Cassation’s view, it did not need to include any kind of reasoning. 28. Similarly, in judgment no. 19564 of 24 July 2018, the Court of Cassation defined authorisation as a “mere preparatory act” (atto meramente preparatorio) which served an “organisational function” (funzione organizzativa) within the hierarchical structure of offices, but had no effect on a taxpayer.

B. Case-law on ex post remedies

1. Tax courts 29. In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation to obtain taxpayers’ banking data could be challenged by lodging a complaint with the tax courts against a tax assessment notice based on information obtained through such a measure. 30. As regards the reasons for challenging authorisation, in judgment no. 17158 of 28 June 2018, the Court of Cassation held that failure to notify a taxpayer of such authorisation could not affect its validity (see also judgment no. 16874 of 21 July 2009 and judgment no. 20420 of 26 September 2014 of the Court of Cassation). Given that authorisation was merely an administrative act issued by the Tax Authority, only a complete lack of such authorisation could be challenged by means of a complaint against a tax assessment notice based on information acquired in the absence of any authorisation, provided that it could be demonstrated that the lack of authorisation had caused specific prejudice to the taxpayer concerned (see judgment no. 14026 of 3 August 2012 and judgment no. 3628 of 10 February 2017 of the Court of Cassation).

7  FERRIERI AND BONASSISA v. ITALY JUDGMENT

31. More recently, the Court of Cassation clarified that a tax assessment notice could not be invalidated merely because it was based on banking data obtained in the absence of any authorisation issued by the competent management body. Similarly, a taxpayer would need to demonstrate that the lack of authorisation had caused him or her specific prejudice in relation to a constitutionally protected right or interest (see judgment no. 3242 of 10 February 2021 and judgment no. 10576 of 1 April 2022 of the Court of Cassation).

2. The Taxpayer’s Guarantor 32. In judgment no. 25212 of 24 August 2022, the Court of Cassation clarified, although not in the context of tax audits of banking data but in the context of reimbursement of tax paid in excess of the amount legally due in relation to inheritance matters, that the Taxpayer’s Guarantor could not adopt binding decisions. The Court of Cassation held as follows: “The legal system currently in force does not expressly provide for the Tax Authority or the entities which are entitled to collect taxes being obliged to implement a self- correction (autotutela) measure requested by the Taxpayer’s Guarantor, or to comply with the decisions taken by the Taxpayer’s Guarantor. Indeed, the [decisions] of the Taxpayer’s Guarantor are not binding and therefore do not produce legal effects, but only constitute warnings entailing at most only an obligation to respond to the request for self-correction and/or review the file presented by the taxpayer. Ultimately, the Taxpayer’s Guarantor is not recognised as having any active management powers. [The body] cannot therefore exercise authoritative or sanctioning powers in respect of tax administration offices or, following the activation of a self-correction procedure, replace the tax administration in reviewing any illegitimate [notice]. In this regard, it has been said that the legislation establishing [the Taxpayer’s Guarantor] does not give [that body] the power to cancel tax notices by way of self-correction, nor does it establish a duty for the tax administration to decide [a case] in the manner requested by the Guarantor. According to the most acceptable interpretation, [the legislation] seems to limit itself to giving the Taxpayer’s Guarantor the power to merely initiate the [self- correction] procedure. However, [once the relevant procedure has been initiated], the tax services would therefore be required to respond to the request of the Taxpayer’s Guarantor by issuing, at the very least, a notice indicating why they do not intend to follow up on [that request].”

IV. EUROPEAN UNION LAW

A. Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC

33. Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation (the Directive on Administrative Cooperation, “the DAC”) repealed Directive 77/799/ECC in force until then. The DAC has been amended several times, the most recent directive being

8  FERRIERI AND BONASSISA v. ITALY JUDGMENT

DAC8 in 20231. DAC9 has entered into force on 7 May 2025 and must be transposed no later than 31 December 2025. Through the DAC, EU countries can make use of mechanisms like the automatic exchange of information and the exchange of information on request to ensure that foreign income is subject to tax. The automatic exchange of information means the systematic communication of pre-defined information from the tax administration of an EU country to the tax administration of another EU country. The exchange of information comes in three forms – automatic, on-request and spontaneous – that are specific to the type of information to be exchanged. Information is exchanged between one competent authority and another through a secured network, ensuring confidentiality and privacy. 34. Recital 20 of the DAC reads as follows: “However, a Member State should not refuse to transmit information because it has no domestic interest or because the information is held by a bank, other financial institution, nominee or person acting in an agency or fiduciary capacity or because it relates to ownership interests in a person.” 35. The relevant provisions of the DAC read as follows:

Article 5: Procedure for exchange of information on request “At the request of the requesting authority, the requested authority shall communicate to the requesting authority any information referred to in Article 1(1) that it has in its possession or that it obtains as a result of administrative enquiries.”

Article 8: Scope and conditions of mandatory automatic exchange of information “1. The competent authority of each Member State shall, by automatic exchange, communicate to the competent authority of any other Member State, information regarding taxable periods as from 1 January 2014 that is available concerning residents in that other Member State, on the following specific categories of income and capital as they are to be understood under the national legislation of the Member State which communicates the information: (a) income from employment; (b) director’s fees; (c) life insurance products not covered by other Union legal instruments on exchange of information and other similar measures; (d) pensions; (e) ownership of and income from immovable property. ...”

1 More information on the DAC and further modifications are available at: https://taxation-

customs.ec.europa.eu/taxation/tax-transparencycooperation/administrative-co-operation- and-mutual-assistance/directive- administrative- cooperation-dac_en

9  FERRIERI AND BONASSISA v. ITALY JUDGMENT

Article 18: Obligations “1. If information is requested by a Member State in accordance with this Directive, the requested Member State shall use its measures aimed at gathering information to obtain the requested information, even though that Member State may not need such information for its own tax purposes. That obligation is without prejudice to paragraphs 2, 3 and 4 of Article 17, the invocation of which shall in no case be construed as permitting a requested Member State to decline to supply information solely because it has no domestic interest in such information. 2. In no case shall Article 17(2) and (4) be construed as permitting a requested authority of a Member State to decline to supply information solely because this information is held by a bank, other financial institution, nominee or person acting in an agency or a fiduciary capacity or because it relates to ownership interests in a person. 3. Notwithstanding paragraph 2, a Member State may refuse the transmission of requested information where such information concerns taxable periods prior to 1 January 2011 and where the transmission of such information could have been refused on the basis of Article 8(1) of Directive 77/799/EEC if it had been requested before 11 March 2011.” 36. Commission Implementing Regulation (EU) 2025/648 of 2 April 2025 on amending Implementing Regulation (EU) 2015/2378 provides standard forms and computerised formats to be used in relation to Council Directive 2011/16/EU as amended by Council Directive 2021/514/EU, specifically setting out when member States have to submit statistical data in relation to information reported by digital platform operators and the types of statistics to be provided in relation to joint audits.

B. Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

37. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, “the GDPR”) (OJ 2016 L 119/1) entered into force on 24 May 2016 and has applied since 25 May 2018. 38. Article 5 of the GDPR establishes the principles relating to processing of personal data, such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Pursuant to Article 13 of the GDPR, data controllers have the obligation to inform a data subject of the collection of their personal data and provide the data subject with certain information relevant thereto as specified in the provision. Article 15 of the GDPR further provides that the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being

10  FERRIERI AND BONASSISA v. ITALY JUDGMENT

processed and, where that is the case, access to the personal data and other relevant information as set out in the provision. 39. Recital 31 of the GDPR reads as follows: Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, or financial market authorities responsible for the regulation and supervision of securities markets should not be regarded as recipients if they receive personal data which are necessary to carry out a particular inquiry in the general interest, in accordance with Union or Member State law. The requests for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing.

40. Within the context of the aforementioned rules, Article 23 provides as follows:

Article 23: Restrictions “1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: ... (e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; ...”

C. Case-law of the Court of Justice of the European Union

41. In its judgment of 22 October 2013 in Sabou (C-276/12, EU:C:2013:678), the Grand Chamber of the Court of Justice of the European Union (CJEU) held as follows: “38. The Court has previously ruled that observance of the rights of the defence is a general principle of European Union law which applies where the authorities are minded to adopt a measure which will adversely affect an individual (see [Case C-349/07 Sopropé [2008] ECR I-10369], paragraph 36). [...] 39. The question arises as to whether the decision of a competent authority of a Member State to request assistance from a competent authority of another Member State and the latter’s decision to examine witnesses for the purposes of responding to that request constitute acts which, because of their consequences for the taxpayer, make it necessary for him to be heard.

11  FERRIERI AND BONASSISA v. ITALY JUDGMENT

40. All the Member States which submitted observations to the Court argued that a request for information by one Member State sent to the tax authorities of another Member State does not constitute an act giving rise to such an obligation. They rightly consider that, in tax inspection procedures, the investigation stage, during which information is collected and which includes the request for information by one tax authority to another, must be distinguished from the contentious stage, between the tax authorities and the taxpayer, which begins when the taxpayer is sent the proposed adjustment. [...] 46. Accordingly, the answer to the first and second questions is that European Union law, as it results in particular from Directive 77/799 and the fundamental right to be heard, must be interpreted as not conferring on a taxpayer of a Member State either the right to be informed of a request for assistance from that Member State addressed to another Member State, in particular in order to verify the information provided by that taxpayer in his income tax return, or the right to take part in formulating the request addressed to the requested Member State, or the right to take part in examinations of witnesses organised by the requested Member State.” 42. In its judgment of 6 October 2020 in Luxembourg State (C-245/19 and C-246/19, EU:C:2020:795), the CJEU ruled as follows: “1. Article 47 of the Charter of Fundamental Rights of the European Union, read in conjunction with Articles 7 and 8 and Article 52(1) thereof, must be interpreted as: – precluding legislation of a Member State implementing the procedure for the exchange of information on request established by Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC, as amended by Council Directive 2014/107/EU of 9 December 2014, which prevents a person holding information from bringing an action against a decision by which the competent authority of that Member State orders that person to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, and as – not precluding such legislation from preventing the taxpayer concerned, in that other Member State, by the investigation giving rise to that request for exchange of information and the third parties concerned by the information in question from bringing actions against that decision. 2. Article 1(1) and Article 5 of Directive 2011/16, as amended by Directive 2014/107, must be interpreted as meaning that a decision by which the competent authority of a Member State orders a person holding information to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, is to be considered, taken together with that request, as concerning information which is not manifestly devoid of any foreseeable relevance where it states the identity of the person holding the information in question, that of the taxpayer concerned by the investigation giving rise to the request for exchange of information, and the period covered by that investigation, and where it relates to contracts, invoices and payments which, although not specifically identified, are defined by criteria relating, first, to the fact that they were concluded or carried out by the person holding the information, secondly, to the fact that they took place during the period covered by that investigation and, thirdly, to their connection with the taxpayer concerned.”

12  FERRIERI AND BONASSISA v. ITALY JUDGMENT

V. INTERNATIONAL LAW

The Convention on Mutual Administrative Assistance in Tax Matters

43. The Convention on Mutual Administrative Assistance in Tax Matters was developed jointly by the Organisation for Economic Co-operation and Development (OECD) and the Council of Europe. It was concluded in Strasbourg on 25 January 1988 and amended by the Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters, which entered into force on 1 June 2011. Italy ratified the Convention on 31 January 2006 and the amending Protocol on 17 January 2012. The latter entered into force in respect of Italy on 1 May 2012. 44. The relevant parts of the Explanatory Report to the 2010 Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters clarified: “1. The object of this Convention is to promote international co operation for a better operation of national tax laws, while respecting the fundamental rights of taxpayers. ... 6. In this context, the Convention attempts to reconcile the respective legitimate interests of those involved: in particular, the requirements of mutual international assistance in tax assessment and enforcement, respect for special features of national legal systems, the confidential nature of information exchanged between national authorities and the fundamental rights of taxpayers. 7. Taxpayers have especially the right to respect for their privacy and the right to a proper procedure in the determination of their rights and obligations in tax matters, including appropriate protection against discrimination and double taxation. 8. In applying the Convention, tax authorities will be bound to operate within the framework of national laws. The Convention specifically ensures that taxpayers’ rights under national laws are fully safeguarded. However, national laws should not be applied in a manner that undermines the object and purpose of the Convention. In other words, the Parties are expected not to unduly prevent or delay effective administrative assistance.” 45. The relevant provisions of the Convention on Mutual Administrative Assistance in Tax Matters read as follows:

Article 1: Object of the Convention and persons covered “1. The Parties shall, subject to the provisions of Chapter IV, provide administrative assistance to each other in tax matters. Such assistance may involve, where appropriate, measures taken by judicial bodies. 2. Such administrative assistance shall comprise: a. exchange of information, including simultaneous tax examinations and participation in tax examinations abroad; b. assistance in recovery, including measures of conservancy; and c. service of documents.

13  FERRIERI AND BONASSISA v. ITALY JUDGMENT

3. A Party shall provide administrative assistance whether the person affected is a resident or national of a Party or of any other State.”

Article 4: General provision “1. The Parties shall exchange any information, in particular as provided in this section, that is foreseeably relevant for the administration or enforcement of their domestic laws concerning the taxes covered by this Convention. 2. Deleted. 3. Any Party may, by a declaration addressed to one of the Depositaries, indicate that, according to its internal legislation, its authorities may inform its resident or national before transmitting information concerning him, in conformity with Articles 5 and 7.”

Article 21: Protection of persons and limits to the obligation to provide assistance “1. Nothing in this Convention shall affect the rights and safeguards secured to persons by the laws or administrative practice of the requested State. 2. Except in the case of Article 14, the provisions of this Convention shall not be construed so as to impose on the requested State the obligation: a. to carry out measures at variance with its own laws or administrative practice or the laws or administrative practice of the applicant State; b. to carry out measures which would be contrary to public policy (ordre public); c. to supply information which is not obtainable under its own laws or its administrative practice or under the laws of the applicant State or its administrative practice; d. to supply information which would disclose any trade, business, industrial, commercial or professional secret, or trade process, or information the disclosure of which would be contrary to public policy (ordre public); e. to provide administrative assistance if and insofar as it considers the taxation in the applicant State to be contrary to generally accepted taxation principles or to the provisions of a convention for the avoidance of double taxation, or of any other convention which the requested State has concluded with the applicant State; f. to provide administrative assistance for the purpose of administering or enforcing a provision of the tax law of the applicant State, or any requirement connected therewith, which discriminates against a national of the requested State as compared with a national of the applicant State in the same circumstances; g. to provide administrative assistance if the applicant State has not pursued all reasonable measures available under its laws or administrative practice, except where recourse to such measures would give rise to disproportionate difficulty; h. to provide assistance in recovery in those cases where the administrative burden for that State is clearly disproportionate to the benefit to be derived by the applicant State. 3. If information is requested by the applicant State in accordance with this Convention, the requested State shall use its information gathering measures to obtain the requested information, even though the requested State may not need such information for its own tax purposes. The obligation contained in the preceding sentence is subject to the limitations contained in this Convention, but in no case shall

14  FERRIERI AND BONASSISA v. ITALY JUDGMENT

such limitations, including in particular those of paragraphs 1 and 2, be construed to permit a requested State to decline to supply information solely because it has no domestic interest in such information. 4. In no case shall the provisions of this Convention, including in particular those of paragraphs 1 and 2, be construed to permit a requested State to decline to supply information solely because the information is held by a bank, other financial institution, nominee or person acting in an agency or a fiduciary capacity or because it relates to ownership interests in a person.”

THE LAW

I. JOINDER OF THE APPLICATIONS

46. Having regard to the similar subject matter of the applications, the Court finds it appropriate to examine them jointly in a single judgment.

II. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

47. The applicants complained under Article 8 of the Convention of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures. 48. Article 8 of the Convention reads as follows: “1. Everyone has the right to respect for his private ... life ... 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

A. Admissibility

1. The Government’s non-exhaustion objection (a) The parties’ submissions 49. The Government submitted that the applicants had failed to exhaust domestic remedies, as they had not challenged the measures in question before the tax courts or the civil courts. 50. The applicants argued that a complaint to the tax courts would have been ineffective, as the availability of such a complaint had been uncertain and in any event would not have become available until some point in the future. As regards the civil courts, they submitted that the Government had failed to prove that such a remedy was available in practice, as they had not

15  FERRIERI AND BONASSISA v. ITALY JUDGMENT

provided any case-law example in which the remedy had been used successfully in a similar case.

(b) The Court’s assessment 51. The Court notes that the Government’s objection as to whether the applicants had at their disposal an effective remedy to challenge the contested measures is closely related to the substance of the applicants’ complaints. Accordingly, it finds that this objection should be joined to the merits.

2. Conclusions as to admissibility 52. The Court notes that the complaint cannot be declared manifestly ill- founded within the meaning of Article 35 § 3 of the Convention. It further finds that there are no other grounds at this stage for declaring this complaint inadmissible, and therefore declares it admissible.

B. Merits

1. Applicability of Article 8 and existence of an interference 53. In the present case, the Government did not dispute that the impugned measures had constituted interferences with the applicants’ right to respect for their private life within the meaning of Article 8 of the Convention. On the basis of the following observations, the Court sees no reason to find otherwise. 54. The Court has already held that the information which tax authorities obtain from banking documents undoubtedly amounts to personal data concerning an individual, regardless of whether it is sensitive information or not (see G.S.B. v. Switzerland, no. 28601/11, § 93, 22 December 2015). Moreover, such information may also concern professional dealings, and there is no reason of principle to justify excluding activities of a professional or business nature from the notion of “private life” (see, in the context of obtaining and copying banking data, M.N. and Others v. San Marino, no. 28005/12, § 51, 7 July 2015, and Brito Ferrinho Bexiga Villa-Nova v. Portugal, no. 69436/10, § 43, 1 December 2015). The Court has also held that details of taxable earned and unearned income, as well as taxable net assets, concern the “private life” of the individuals in question (see Samoylova v. Russia, no. 49108/11, § 62, 14 December 2021, and the cases cited therein), and that data such as a taxpayer’s name and home address, processed and published by the Tax Authority in connection with the fact that he or she has failed to fulfil his or her tax payment obligations, clearly concern information about “private life”, notwithstanding the fact that under domestic law, the data have been classified as information in the public interest (see L.B. v. Hungary [GC], no. 36345/16, § 104, 9 March 2023).

16  FERRIERI AND BONASSISA v. ITALY JUDGMENT

55. Furthermore, the Court has already found that consulting an individual’s bank account amounts to an interference with his or her right to respect for private life (see, in the context of consulting the banking data of a lawyer, Brito Ferrinho Bexiga Villa-Nova, cited above, § 44, and Sommer v. Germany, no. 73607/13, § 48, 27 April 2017). 56. It follows that, in the present case, the Tax Authority’s act of accessing the applicants’ banking data amounted to an interference with their right to respect for their “private life”. 57. The Court reiterates that an interference breaches Article 8 unless it is “in accordance with the law”, pursues one or more of the legitimate aims referred to in paragraph 2 and is, in addition, “necessary in a democratic society” to achieve those aims (see, among other authorities, Vinks and Ribicka v. Latvia, no. 28926/10, § 93, 30 January 2020). The exceptions provided for in Article 8 § 2 are to be interpreted narrowly, and the need for them in a given case must be convincingly established (ibid., § 101, with further references). 58. That said, it should be borne in mind that the Court has already considered that bank data, that is to say purely financial information, do not involve the transmission of intimate details or data closely linked to identity do not merit enhanced protection, and that accordingly, States enjoy a broad margin of appreciation in this field (see L.B. v. Hungary, § 119, and G.S.B. v. Switzerland, § 93, both cited above).

2. Whether the interference was “in accordance with the law” (a) The parties’ submissions (i) The applicants 59. The applicants submitted that the contested measures had been implemented on the basis of a “law” which did not comply with the quality requirements imposed by the principles of legality and the rule of law. 60. They highlighted that the applicable domestic provisions did not provide for an ex ante independent or judicial review of such measures, as they had to be authorised by a higher authority within the same Tax Authority which, in their view, was not independent. 61. The applicants further argued that the applicable provisions did not indicate the circumstances in which or the conditions on which the contested measures could be implemented, thereby giving the domestic authorities an unfettered margin of discretion. In their view, the criteria established in the circulars provided by the Government (see paragraphs 15-22 above) were very generic and left a wide margin of discretion. Moreover, they submitted that those criteria had not been fulfilled in their case, as they had not been suspected of or found liable of any of the serious tax offences referred to in those circulars.

17  FERRIERI AND BONASSISA v. ITALY JUDGMENT

62. They also contended that domestic law did not provide for any effective ex post checking of the measures. In their view, the possibility of lodging a complaint with the civil courts was merely theoretical, as there were no case-law examples of this. Moreover, a complaint to the civil courts would not have been an effective remedy, as those courts could not implement precautionary and urgent measures. As regards the possibility of challenging the measures before the tax courts, the applicants submitted that such an action could be brought only in respect of a tax assessment notice, which a person could be notified of several years after the alleged violation. Furthermore, the applicants would have been prevented from raising their complaints before the tax courts, as the well-established case-law of the Court of Cassation provided that a lack of authorisation or a lack of reasoning in authorisation did not justify the annulment of a tax assessment notice. As regards a complaint to the Taxpayer’s Guarantor, the applicants argued that that body would have had no power to assess the complaints raised in the present applications, and in any case, did not have the power to adopt binding decisions. 63. The applicants further submitted that they had not been notified of the authorisation to access their bank accounts, and that therefore they had not known why the measures had been implemented. In particular, they had not known whether they had been implemented for purely preventive and exploratory purposes, without indicating the offences of which they had been suspected. In their view, the failure to notify them of the authorisation had completely prevented them from subjecting the measures to effective checks.

(ii) The Government 64. The Government submitted that the procedure, conditions and scope of application of the contested measures were clearly provided for in Article 32 § 1 (7) of Decree no. 600/1973 and Article 51 § 2 (7) of Decree no. 633/1972, which, in their view, were sufficiently accessible, clear and foreseeable in their application. Moreover, the fourth paragraph of both provisions clarified that a request to implement the contested measures and responses to such a request had to be submitted by electronic means, thereby allowing the procedure to be checked. 65. The Government considered that the measures had been subjected to a sufficient ex ante check, given that a request for authorisation had to be submitted to the competent management body of the Tax Authority or the Revenue Police. Such a request had to refer to the relevant facts, the years being audited and the results of tax audits already undertaken, and to elaborate on the reasons justifying the requested access to bank accounts. The authorising body had to assess whether, in the light of the information provided, the conditions established under the law had been satisfied and the measure was proportionate and adequate in respect of the aim pursued. Moreover, Circular no. 131/1994 of the Tax Authority clarified that the

18  FERRIERI AND BONASSISA v. ITALY JUDGMENT

contested measures could be authorised where there had been no tax declarations for several tax periods, where accounting records were not reliable, or where invoices for non-existent transactions had been identified (see paragraphs 15-16 above). It also stated that a request for authorisation had to be substantiated. Furthermore, Circular no. 25/E/2014 and Circular no. 16/2016 added that the measures could be authorised in cases where the expected tax returns exceeded a certain amount (see paragraphs 23 and 25 above). In accordance with the relevant domestic law and practice, the reasons justifying the contested measures could not, therefore, be generic or standardised. 66. The Government contended that the competent management body could be considered independent, as it had different functions and was usually located in a different office from the one requesting the authorisation. 67. They argued that the measures had a clear purpose – verifying effective compliance with taxpayers’ tax obligations, as provided for in Article 53 of the Italian Constitution. In order to be authorised, the measures had to comply with the following conditions: they had to prevent, identify and repress tax evasion; and they had to respect the criteria of legality, cost-effectiveness, efficiency and transparency, and be carried out with full respect for the rights and guarantees granted to taxpayers. 68. As regards the existence of an ex post judicial review, the Government pointed out that authorisation to undertake financial tax audits of bank accounts was a “preparatory act” which could not be challenged in court immediately. It had to be challenged by lodging a complaint with the competent tax court against the final tax assessment notice, and by demonstrating that an irregularity in the authorisation process had affected the validity of that notice. In the Government’s view, several other countries had adopted a similar approach. By contrast, in cases in which tax assessment proceedings did not lead to the issuance of a tax assessment notice, the relevant authorisation to consult bank accounts could be challenged before the ordinary civil courts. Lastly, a taxpayer could report allegedly unlawful access to his or her bank account to the Taxpayer’s Guarantor, under Article 13 of Law no. 212/2000. That body could exercise its tax audit powers, remind the competent domestic authorities to comply with the applicable provisions, and report the identified shortcomings to the head of the competent office with a view to possibly instituting disciplinary proceedings.

(b) The Court’s assessment (i) General principles 69. The Court reiterates at the outset that the expression “in accordance with the law”, within the meaning of Article 8 § 2 of the Convention, requires firstly that the impugned measure should have some basis in domestic law.

19  FERRIERI AND BONASSISA v. ITALY JUDGMENT

Secondly, the domestic law must be accessible to the person concerned. Thirdly, the person affected must be able, if need be with appropriate legal advice, to foresee the consequences of the domestic law for him, and fourthly, the domestic law must be compatible with the rule of law (see, among other authorities, De Tommaso v. Italy [GC], no. 43395/09, § 107, 23 February 2017). 70. The Court further points out that the concept of “law” must be understood in its “substantive” sense, not its “formal” one. It therefore includes everything that goes to make up the written law, including enactments of lower rank than statutes, and the relevant case-law authority (see, for example, National Federation of Sportspersons’ Associations and Unions (FNASS) and Others v. France, nos. 48151/11 and 77769/13, § 160, 18 January 2018). Accordingly, in assessing the lawfulness of an interference, and in particular the foreseeability of the domestic law in question, the Court has regard to both the text of the law and the manner in which it was applied and interpreted by the domestic authorities. It is the practical interpretation and application of the law by the domestic courts that must give individuals protection against arbitrary interference (see Italgomme Pneumatici S.r.l. and Others v. Italy, nos. 36617/18 and 12 others, § 96, 6 February 2025). 71. For domestic law to meet these requirements, it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention. In matters affecting fundamental rights, it would be contrary to the rule of law, one of the basic principles of a democratic society enshrined in the Convention, for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise. The level of precision required of domestic legislation – which cannot in any case provide for every eventuality – depends to a considerable degree on the content of the instrument in question, the field it is designed to cover and the number and status of those to whom it is addressed (see Italgomme Pneumatici S.r.l. and Others, cited above, § 97, and Bernh Larsen Holding AS and Others v. Norway, no. 24117/08, § 130, 14 March 2013, with further references). 72. The Court notes that while Article 8 contains no explicit procedural requirements, in applications lodged under this provision, it has emphasised that the concepts of lawfulness and the rule of law in a democratic society also require that measures affecting human rights must be subject to some form of adversarial proceedings before an independent body competent to review in a timely fashion the reasons for the decision and the relevant evidence (see Ivashchenko v. Russia, no. 61064/10, § 74, 13 February 2018, with further references).

20  FERRIERI AND BONASSISA v. ITALY JUDGMENT

73. With specific regard to the measures at issue in the present case, the Court has already found that it is legitimate for State authorities to access and even disclose, within formalised procedures, bank details in order to assess whether an applicant has complied with his or her tax obligations and, if not, to take the requisite legal action (see G.S.B. v. Switzerland, cited above, § 95). However, in such circumstances, the Court must be satisfied that there were sufficient and adequate guarantees against arbitrariness (ibid., § 96), including the possibility of an effective review of the measure at issue. 74. In this context, the Court has found that a subsequent judicial review can offer sufficient protection if a review procedure at an earlier stage would jeopardise the purpose of an investigation or surveillance.

(ii) Application of the above principles to the present case 75. The Court observes that the measures at issue were prescribed by law, notably Article 51 § 2 (7) of Decree no. 633/1972 (see paragraph 7 above) and Article 32 § 1 (7) of Decree no. 600/1973 and (see paragraph 9 above), and that the parties did not dispute that such provisions were accessible. However, the parties disagreed as to whether the legal basis for the contested measures, as derived from the cited domestic provisions, complied with the “quality-of-law” requirements imposed under Article 8 of the Convention. 76. Taking into account the scope of the applicants’ complaints, the Court deems it necessary to assess whether the legal basis delimited the scope of discretion conferred on the domestic authorities, and whether it provided for sufficient procedural safeguards capable of protecting the applicants against any abuse or arbitrariness.

(α) The delimitation of the scope of discretion conferred on the domestic authorities 77. The Court notes at the outset that under Article 51 § 2 (7) of Decree no. 633/1972 (see paragraph 7 above) and Article 32 § 1 (7) of Decree no. 600/1973 (see paragraph 9 above) access to a taxpayer’s banking data can be authorised for the purpose of performing tax office functions which, as defined in Article 51 § 1 of Decree no. 633/1972 (see paragraph 7 above), relate to verifying compliance with taxpayers’ tax obligations. 78. In the Court’s view, the conditions indicated in the above legislative provisions, taken alone, are insufficient to delimit the scope of discretion conferred on the domestic authorities. In particular, mere reference to the need to assess taxpayers’ compliance with their tax obligations confers an unfettered discretion on the tax offices, as they have unregulated authority to assess whether to implement the contested measures and to define the scope of the information to be requested, which, by definition, is very wide (see paragraph 65 above). 79. However, reiterating that the concept of “law”, within the meaning of the Convention, includes enactments of lower rank than statutes

21  FERRIERI AND BONASSISA v. ITALY JUDGMENT

(see paragraph 70 above), the Court finds that in the field of taxation, the conditions laid down in the applicable legislative provisions may be wider and generic, provided that they are subsequently specified and clarified in other instruments of lower rank or in the relevant domestic case-law. 80. In this context, the Court notes that some additional criteria were established in the administrative circulars adopted and published by the Tax Authority (see paragraph 14 above) and submitted by the Government. In particular, Circular no. 131/1994 stated that tax audits of banking data could be undertaken in respect of certain taxpayers: total or near-total tax evaders, persons with no accounting records or with accounting records that were obviously unreliable, persons carrying out import-export transactions, persons who had issued and/or used invoices for non-existent transactions, and persons whose financial capacity was clearly in stark contrast to their declared income (see paragraph 16 above). It also clarified that a request for authorisation to implement the contested measures should be reasoned, in order to provide the authorising body with useful elements of evaluation (see paragraph 17 above) to allow it to check the formal and substantive legality of the request (see paragraph 18 above). Moreover, the same circular stated that tax audits of banking data could be carried out only when other means of assessing compliance with tax obligations had proved ineffective, and on the basis of a cost-benefit analysis (see paragraph 19 above). Furthermore, Circular no. 25/E/2014 established that tax audits of banking data should be carried out only where there were significant discrepancies in a tax declaration (significative anomalie dichiarative), and ideally when a tax office had already instituted a tax inquiry (see paragraph 23 above), while Circular no. 16/2016 added that the use of such audits should be “appropriate” and “aimed at obtaining credible and reliable assessments” (see paragraph 25 above). 81. The Court is prepared to accept that the clear and detailed criteria laid down in the circulars adopted and published by the Tax Authority might be sufficient to complement the applicable domestic provisions and delimit the scope of discretion conferred on the domestic authorities, provided that they are binding on the authorities. However, this does not appear to be the case. In particular, the Court cannot but note that in the light of the Court of Cassation’s case-law, authorisation does not have to contain reasoning (see paragraph 27 above). It follows that the authorities are not required to justify the exercise of their powers by giving reasons for their decisions and thereby showing that they are following the criteria laid down in the relevant domestic provisions, including the administrative circulars, resulting in them exercising unfettered discretion (see Bernh Larsen Holding AS and Others, cited above, § 130). 82. In the light of the above, the Court considers that the legal basis for the contested measures was incapable of sufficiently delimiting the scope of

22  FERRIERI AND BONASSISA v. ITALY JUDGMENT

discretion conferred on the domestic authorities, and accordingly did not meet the “quality-of-law” requirement under Article 8 of the Convention.

(β) The existence of sufficient procedural safeguards capable of protecting the applicants against any abuse or arbitrariness 83. The Court must now assess whether domestic law provided for sufficient procedural safeguards capable of protecting the applicants against any abuse or arbitrariness. 84. The applicants complained that the Tax Authority had not informed them of the requests to obtain banking data directly from banking institutions. In this regard, the Court reiterates its finding that Article 8 cannot be interpreted as giving all persons who are potentially implicated in such matters, including the interested taxpayer, a right to prior notice of lawful tax audits or exchanges of tax-related information (see Othymia Investments B.V. v. the Netherlands (dec.), no. 75292/10, § 44, 16 June 2015). Nor may such a right be inferred from European Union law as interpreted by the CJEU, in circumstances in which it may be applicable in situations that have a cross-border nature or where mutual assistance between authorities is requested (see paragraphs 41-42 above). 85. As regards the applicants’ complaint that the contested measures had not been subjected to ex ante judicial or independent scrutiny, the Court notes that in the instant case, under domestic law, prior judicial authorisation was not required. In particular, the domestic legal framework required that the measures be authorised by the central director of assessment of the Tax Authority or its regional director, or by the regional head of the Revenue Police (see paragraphs 7 and 9 above). 86. The Court finds that considerations of efficiency in the field of taxation (see Bernh Larsen Holding AS and Others, cited above, § 130) and the need to not jeopardise the purpose of the contested measures (see Italgomme Pneumatici S.r.l. and Others, cited above, § 122) might justify the lack of ex ante judicial or independent review. However, in this context, the Court must assess whether there were other effective and adequate safeguards against abuse and arbitrariness, notably a subsequent independent or judicial review (see paragraphs 73-74 above). 87. In particular, and taking into account the applicants’ complaints, the Court must assess whether the contested measures were subjected to an ex post judicial or independent review. It will therefore examine whether the remedies relied on by the Government – a complaint to the tax courts, a complaint to the civil courts, and a complaint to the Taxpayer’s Guarantor – complied with the requirements imposed under the Convention.

‒ Complaint to the tax courts 88. As regards a complaint to the tax courts, the Court notes that under Article 19 § 2 of Decree no. 546/1992 (see paragraph 11 above), authorisation

23  FERRIERI AND BONASSISA v. ITALY JUDGMENT

to access a taxpayer’s banking data is not an act that can be challenged independently before the tax courts. As clarified in the domestic case-law, such authorisation cannot be challenged independently before the tax courts because it is considered to be a mere preparatory act (see paragraph 26-27 above). 89. The Court takes note of the case-law submitted by the Government, according to which where the measures at issue in the present case lead to a tax assessment notice, the taxpayer in question is allowed to challenge the authorisation to consult his or her bank account before the tax courts. In particular, as such authorisation is considered to be a preparatory act whose unlawfulness affects the validity of the tax assessment notice, the taxpayer is allowed to raise his or her complaints against the act authorising the consultation of his or her bank data by challenging the tax assessment notice under Article 19 § 2 of Decree no. 546/1992 (see paragraph 29 above). 90. Having carefully examined the material submitted to it, the Court is not persuaded by the Government’s argument that this would amount to an effective ex post judicial remedy within the meaning of its case-law (see Italgomme Pneumatici S.r.l. and Others, cited above, § 126, which concerns a different context – access to and inspection of business premises). 91. Firstly, the domestic case-law clarified that an act authorising the contested measures did not have to contain reasons (see paragraph 27 above), and that the validity of a tax assessment notice could not be affected by an irregularity (see paragraph 30 above) or even by a lack of authorisation (see paragraph 31 above). In addition, the Government did not provide any case- law examples where such a remedy – challenging authorisation – had been used successfully. Taking these factors into account, the Court does not see how authorisation could be found to affect the lawfulness of a tax assessment notice. 92. Secondly, the Government observed that the availability of such a remedy would depend on whether the measures in question had led to the issuance of a tax assessment notice which was challenged by the taxpayer, and whether that notice was based on evidence obtained by consulting a bank account. Therefore, the Court finds that the existence of and accessibility to such a remedy is uncertain and may only exist at some point in the future (see Société Canal Plus and Others v. France, no. 29408/08, § 40, 21 December 2010). 93. Lastly, under Article 57 of Decree no. 633/1972 (see paragraph 8 above) and Article 43 of Decree no. 600/1973 (see paragraph 10 above), a tax assessment notice can be issued several years after the filing of a tax return or the moment when a tax return should have been filed. In this regard, the Court reiterates that an effective remedy must become available within a reasonable period of time (see, mutatis mutandis, Compagnie des gaz de pétrole Primagaz v. France, no. 29613/08, § 28, 21 December 2010, and Société Canal Plus and Others, cited above, § 40), and considers that a

24  FERRIERI AND BONASSISA v. ITALY JUDGMENT

remedy which would (possibly) become available after several years cannot be considered to be sufficiently prompt (see Italgomme Pneumatici S.r.l. and Others, cited above, § 129). 94. The above is sufficient to conclude that a complaint to the tax courts would not amount to an effective ex post judicial remedy. There is therefore no need for the Court to examine whether the domestic legal framework provided for appropriate and sufficient redress in the event of a finding of an irregularity. In any case, the Court reiterates that the question of whether redress is appropriate and sufficient has generally been considered to be dependent on all the circumstances of the case, having regard, in particular, to the nature of the Convention violation at stake (see, in a different context, Gäfgen v. Germany [GC], no. 22978/05, § 116, ECHR 2010, and Contrada v. Italy (no. 4), no. 2507/19, §§ 55 and 62-65, 23 May 2024).

‒ Complaint to the civil courts 95. As regards a complaint to the civil courts, the Court notes that the Government mentioned such a remedy without referring to any case-law example where its availability and accessibility had been envisaged by the Court of Cassation, or where it had been used successfully before the lower courts. 96. In this regard, the Court reiterates that only remedies which are likely to provide redress for an applicant’s complaints need to be taken into account. In particular, the existence of such remedies must be sufficiently certain, not only in theory but also in practice, failing which they will lack the requisite accessibility and effectiveness. Furthermore, it falls to the respondent State to establish that these conditions are satisfied (see Janosevic v. Sweden (dec.), no. 34619/97, 26 September 2000). 97. In the present case, notwithstanding the applicants’ objection regarding the effectiveness of such a remedy, the Government failed to show, with reference to demonstrably established consistent case-law in cases similar to those of the applicants, that the remedy was sufficiently certain not only in theory but also in practice, and offered at least some prospects of success (see Mikolajova v. Slovakia, no. 4479/03, § 34, 18 January 2011, and Brazzi v. Italy, no. 57278/11, § 49, 27 September 2018). 98. In any event, even assuming that the remedy of a complaint to the civil courts did exist in practice, in the present case, where the applicable domestic provisions did not require that there be any reasons given for the contested measures prior to such measures being implemented, the Court does not see what kind of scrutiny those courts would have been able to ensure. 99. In the light of the above, the Court concludes that the Government have failed to demonstrate the existence in practice of the remedy in question, and that in any case, such a remedy would not have been effective within the meaning of Article 8 of the Convention.

25  FERRIERI AND BONASSISA v. ITALY JUDGMENT

‒ Complaint to the Taxpayer’s Guarantor 100. As regards a complaint to the Taxpayer’s Guarantor under section 13 of Law no. 212/2000 (see paragraph 12 above), the Court notes that as stated in judgment no. 25212 of 24 August 2022 of the Court of Cassation (see paragraph 32 above), that authority does not issue binding decisions, but merely makes recommendations to the tax authorities. 101. The Court reiterates that the powers and procedural guarantees an authority possesses are relevant in determining whether a remedy is effective (see Tagayeva and Others v. Russia, nos. 26562/07 and 6 others, § 620, 13 April 2017, and Centre for Legal Resources on behalf of Valentin Câmpeanu v. Romania [GC], no. 47848/08, § 149, ECHR 2014). Therefore, it is imperative that the remedy should be before a body which, while not necessarily judicial, is independent of the executive and ensures the fairness of the proceedings, offering, in so far as possible, an adversarial process. The decisions of such an authority shall be reasoned and legally binding (see, mutatis mutandis, Centrum för rättvisa v. Sweden [GC], no. 35252/08, § 273, 25 May 2021; Big Brother Watch and Others v. the United Kingdom [GC], nos. 58170/13 and 2 others, § 359, 25 May 2021; and Segerstedt- Wiberg and Others v. Sweden, no. 62332/00, § 120, ECHR 2006‑VII). 102. Therefore, the Court finds that a complaint to the Taxpayer’s Guarantor – a body which merely supervises the activity of the tax authorities and cannot issue binding decisions – would not constitute an effective remedy for the purpose of the guarantees against arbitrariness demanded by Article 8 of the Convention.

(iii) Overall conclusions 103. In the light of the above, the Court finds that the contested measures were not subjected to an effective ex post judicial or independent review. 104. For the above reasons, the Court dismisses the Government’s preliminary objection based on the non-exhaustion of domestic remedies. 105. The Court concludes that even if there could be said to be a general legal basis for the impugned measures in Italian law, that law does not meet the quality requirements imposed under the Convention. In particular, even taking into account the Contracting States’ broad margin of appreciation in respect of bank data, that is to say purely financial information (see paragraph 58 above), and the importance of the aim of similar measures in the field of taxation (see paragraph 73 above), the Court considers that the domestic legal framework afforded the domestic authorities unfettered discretion with regard to both the conditions in which the contested measures could be implemented and the scope of those measures. At the same time, that framework did not provide sufficient procedural safeguards, as the contested measures were not subjected to a judicial or independent review. Therefore, the domestic legal framework did not provide the applicants with the minimum degree of

26  FERRIERI AND BONASSISA v. ITALY JUDGMENT

protection to which they were entitled under the Convention. The Court finds that in these circumstances, it cannot be said that the interferences in question were “in accordance with the law” as required by Article 8 § 2 of the Convention. 106. There has accordingly been a violation of Article 8 of the Convention. 107. Having regard to the above conclusion, the Court does not consider it necessary to review compliance with the other requirements of Article 8 § 2 (see De Tommaso, § 127, and Brazzi, § 51, both cited above).

III. OTHER ALLEGED VIOLATIONS OF THE CONVENTION

108. The applicants further complained that the absence of an effective judicial remedy to complain of interferences with the right to respect for their private life violated their right of access to justice under Article 6 § 1 and Article 13 of the Convention. 109. Having regard to the facts of the case, the submissions of the parties and its findings above (see paragraphs 103 and 105), the Court considers that it has dealt with the main legal questions raised by the case and that there is no need to examine the admissibility and merits of the remaining complaints (see Centre for Legal Resources on behalf of Valentin Câmpeanu, cited above, § 156).

IV. APPLICATION OF ARTICLE 46 OF THE CONVENTION

110. The relevant parts of Article 46 of the Convention read: “1. The High Contracting Parties undertake to abide by the final judgment of the Court in any case to which they are parties. 2. The final judgment of the Court shall be transmitted to the Committee of Ministers, which shall supervise its execution ...” 111. Under Article 46 §§ 1 and 2 of the Convention, a judgment in which the Court finds a violation of the Convention or its Protocols imposes on the respondent State a duty to choose, subject to supervision by the Committee of Ministers, the general and/or, if appropriate, individual measures to be taken in its domestic legal order to end the violation and make all feasible reparation for its consequences by restoring as far as possible the situation which would have obtained if it had not taken place. Furthermore, it follows from the Convention, and from its Article 1 in particular, that in ratifying the Convention and its Protocols the Contracting States undertake to ensure that their domestic law is compatible with them (see, among other authorities, Maestri v. Italy [GC], no. 39748/98, § 47, ECHR 2004-I, and Ekimdzhiev and Others v. Bulgaria, no. 70078/12, § 427, 11 January 2022). With a view to helping the respondent State to fulfil its obligations under Article 46, the Court may seek to indicate the type of individual and/or general measures that

27  FERRIERI AND BONASSISA v. ITALY JUDGMENT

might be taken in order to put an end to the situation it has found to exist (see Stanev v. Bulgaria [GC], no. 36760/06, § 255, ECHR 2012, with further references). 112. In the present case, the Court is of the view that the shortcomings identified are liable to give rise to further justified applications in the future (see, mutatis mutandis, N. v. Romania (no. 2), no. 38048/18, § 84, 16 November 2021). Since the breach of Article 8 found in this case appears to be of a systemic character, in the sense that it resulted from the content of the relevant domestic law, as interpreted and applied by the domestic courts, it seems appropriate for the Court to give some indications on how breaches of this kind are to be avoided in the future (see Stoyanova v. Bulgaria, no. 56070/18, § 78, 14 June 2022). 113. For these reasons, in the light of its findings of a violation of Article 8 of the Convention (see paragraph 105 above), the Court finds it crucial that the respondent State adopt the appropriate general measures with a view to bringing its legislation and practice into line with the Court’s findings. In particular, the Court considers that the following issues must be clearly regulated in the domestic legal framework. 114. First, the domestic legal framework, if necessary by means of relevant administrative practice directions, should indicate the circumstances in which and conditions on which the domestic authorities are allowed to have access to taxpayers’ banking data (see paragraph 71 above). The stringency of the criteria imposed by the law can take into account that in the field of taxation, the conditions laid down in the applicable legislative provisions may be wider and generic, provided that they are subsequently specified and clarified in other instruments of lower rank or in the relevant domestic case- law (see paragraph 79 above), as appears to be the case (see paragraph 81 above). However, the domestic legal framework must oblige the authorities to respect those conditions, provide reasons for such measures and accordingly justify the measures in the light of such criteria (see paragraph 81 above). 115. Secondly, the domestic legal framework should provide for an effective judicial or independent review of such measures, and in particular a review of the domestic authorities’ compliance with the criteria and restrictions concerning the conditions justifying those measures and their scope (see paragraph 73 above). The Court, having noted the various restrictions on the jurisdiction of the tax courts and the civil courts, as well as the inability of the Taxpayer’s Guarantor to issue binding decisions (see paragraphs 91-94, 97-99 and 102 above), considers that the existence and availability of such remedies should not be conditional on whether a measure has led to the issuing of a tax assessment notice (see paragraph 92 above), nor should they become available only when tax assessment proceedings have been concluded (see paragraph 93 above). A judicial or independent

28  FERRIERI AND BONASSISA v. ITALY JUDGMENT

authority’s powers to determine the consequences of any breach must also be defined by law (see paragraph 114 above). 116. Thirdly, such a regulatory framework should take into account the context of international cooperation between tax authorities. The law should be framed with a view to considering the interests of the authorities in disclosing and having access to bank details in order to allow a third country to assess whether a taxpayer has complied with his or her tax obligations abroad (see paragraph 12 above). 117. The Court considers that some of the necessary measures are already provided for in the domestic legislation, in particular section 13 of Law no. 212/2000 (see paragraph 12 above), but the general principles affirmed in this legislation need to be implemented by means of specific rules in the domestic statute law, while the case-law should be brought in line with these principles and those established by the Court (see, mutatis mutandis, Italgomme and Others, cited above, § 147).

V. APPLICATION OF ARTICLE 41 OF THE CONVENTION

118. Article 41 of the Convention provides: “If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”

A. Damage

119. The applicants claimed compensation for the non-pecuniary damage they had suffered and asked the Court to determine the amount it deemed to be appropriate. 120. The Government submitted that the applicants’ claim was unsubstantiated and should therefore be dismissed. 121. Having regard to the circumstances of the case, the Court considers that the finding of a violation is sufficient to compensate for the non-pecuniary damage sustained.

B. Costs and expenses

122. The applicants did not submit any claim in respect of costs and expenses. Accordingly, the Court makes no award.

FOR THESE REASONS, THE COURT,

1. Decides, unanimously, to join the applications;

29  FERRIERI AND BONASSISA v. ITALY JUDGMENT

2. Decides, by five votes to two, to join the preliminary objections concerning non-exhaustion of domestic remedies to the merits, and dismisses them;

3. Declares, by five votes to two, the complaint concerning Article 8 of the Convention admissible;

4. Holds, by five votes to two, that there has been a violation of Article 8 of the Convention;

5. Holds, by five votes to two, that there is no need to examine the complaints under Article 6 § 1 and Article 13 of the Convention;

6. Holds, by five votes to two, that the finding of a violation constitutes in itself sufficient just satisfaction for any non-pecuniary damage sustained by the applicants.

Done in English, and notified in writing on 8 January 2026, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

Ilse Freiwirth Ivana Jelić Registrar President

In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the Rules of Court, the separate opinion of Judges Krenc and Adamska-Gallant is annexed to this judgment.

30  FERRIERI AND BONASSISA v. ITALY JUDGMENT - SEPARATE OPINION

JOINT DISSENTING OPINION OF JUDGES KRENC AND ADAMSKA-GALLANT 1. Regrettably, we are unable to agree with the present judgment as regards the approach taken by our esteemed colleagues to the admissibility of the applications. We are of the view that the applicants did not exhaust domestic remedies in the present case and that both applications should therefore have been declared inadmissible. 2. We cannot but note that the applicants brought their case directly to Strasbourg after being notified by their banks of the requests received from the Tax Authority to provide information relating to their banking data. The applicants did not use any remedy at the domestic level before applying to the Court, nor make any attempt to do so. They took no steps whatsoever before the national authorities. The Court was therefore invited to act as a court of first instance. This is, in our view, incompatible with the subsidiary character of the Court’s supervision. Our review cannot pre-empt that which the domestic authorities are called upon to carry out. Subsidiarity lies at the very heart of the Convention system: domestic authorities are best placed to address alleged violations first, being closer to individuals and to reality, and the Court may only intervene when domestic authorities have failed to provide the minimum protection required by the Convention. This balance is essential for preserving both the effectiveness of the Convention and respect for States’ sovereignty. 3. In the case at hand, it is particularly striking that the first applicant lodged his application with the Court barely eight days after receiving the notification in issue, and that the second applicant did so two weeks after receiving a similar notification. Are we to accept that any taxpayer who receives such a notification can bring his or her case directly to the Court in the same way? With all due respect, we do not believe this is the correct approach. 4. Recently, in other circumstances, the Court showed a strong commitment to the principle of subsidiarity and to the corresponding requirement of exhaustion of domestic remedies, whether in the context of the pandemic (see Communauté genevoise d’action syndicale (CGAS) v. Switzerland [GC], no. 21881/20, 27 November 2023), climate change (see Duarte Agostinho and Others v. Portugal and 32 Others (dec.) [GC], no. 39371/20, 9 April 2024) or migration (see Mansouri v. Italy (dec.) [GC], no. 63386/16, 29 April 2025). In our view, a coherent approach should have led the Court to reject the present applications in favour of a prior examination of the issues at stake at the domestic level. 5. We are not persuaded by the majority’s stance that a remedy before the civil courts would have been ineffective in the present situation. In particular,

31  FERRIERI v. ITALY JUDGMENT - SEPARATE OPINION

we fail to see how the fact that the authorisation to access a taxpayer’s banking data did not have to contain reasons (see paragraph 97 of the present judgment) would prevent domestic judges from examining the applicants’ complaint under Article 8 of the Convention. On the contrary, this constitutes the crux of the complaint (namely the excessively broad scope of the discretion enjoyed by the domestic authorities and the lack of sufficient procedural safeguards). To be honest, we do not understand the link being made here. The judgment notes that the Government have not provided any examples of domestic case-law concerning the complaints raised by the applicants (see paragraphs 94-96 of the present judgment). It would appear, however, difficult to provide examples of case-law if applicants fail to bring their cases before the domestic courts and choose to apply directly to the Court (see, mutatis mutandis, Casarini v. Italy, no. 25578/11, §§ 100-05, 5 November 2024). We consider that the applicants should at least have tried to give the domestic courts the opportunity which the rule of exhaustion of domestic remedies is designed to afford States, namely, to determine the issue of the compatibility of the impugned national measures with the Convention. In the present case, the applicants failed to take appropriate steps to enable the national courts to fulfil their fundamental role in the Convention protection system, the Court’s role being subsidiary to theirs. As a result, we lose the benefit of the findings and assessments of the national courts, which are of crucial importance in our review (see Duarte Agostinho and Others, cited above, § 226). What is more, in the absence of any proceedings before them, the Italian courts have had no opportunity to examine – whether on the basis of the parties’ submissions or of their own motion – any issue relating to the application and interpretation of EU law provisions (in particular, the General Data Protection Regulation (Regulation (EU) 2016/679)), seeking, where appropriate, a preliminary ruling from the CJEU (see, mutatis mutandis, Mansouri, cited above, § 115). The Court’s review must remain secondary to that of national courts and to the Court of Justice of the European Union, which serves as a constitutional court within an integrated legal order. 6. To conclude, we firmly believe that the principle of subsidiarity cannot be understood as the Court relinquishing its fundamental mission. It is not intended to curtail or limit the Court’s review – this point deserves to be made with absolute clarity. It is rather to underscore, through the requirement of exhaustion of domestic remedies, the primary role of national authorities in ensuring compliance with the Convention.

32