Vergi Denetiminde Bankacılık Verilerine Erişim

FIRST SECTION

CASE OF FERRIERI AND BONASSISA v. ITALY

(Applications nos. 40607/19 and 34583/20)

JUDGMENT

Art 8 • Private life • Access and examination of applicants’ banking data, including
bank account information, transaction histories, and other financial operations related
to or traceable to them, by the Tax Authority for tax audit purposes • “Quality of law”
requirements not met • Legal framework afforded domestic authorities unfettered
discretion with regard to contested measures’ scope and conditions • Lack of sufficient
procedural safeguards • Contested measures not subject to an effective ex post judicial
or independent review • Interferences “not in accordance with the law”
Art 46 • General measures • Systemic problem • Respondent State to bring its
legislation and practice into line with Court’s findings • Need for specific rules in
domestic law, indicating circumstances in which and conditions on which the
domestic authorities were allowed to have access to taxpayers’ banking data,
providing for effective judicial or independent review, and taking into account the
context of international cooperation between tax authorities

Prepared by the Registry. Does not bind the Court.

STRASBOURG

8 January 2026

FINAL
11/05/2026
This judgment has become final under Article 44 § 2 of the Convention.
It may be subject to editorial revision.

FERRIERI AND BONASSISA v. ITALY JUDGMENT

In the case of Ferrieri and Bonassisa v. Italy,
The European Court of Human Rights (First Section), sitting as a Chamber
composed of:
Ivana Jelić, President,
Erik Wennerström,
Raffaele Sabato,
Frédéric Krenc,
Davor Derenčinović,
Alain Chablais,
Anna Adamska-Gallant, judges,
and Ilse Freiwirth, Section Registrar,
Having regard to:
the applications (nos. 40607/19 and 34583/20) against the Italian Republic
lodged with the Court under Article 34 of the Convention for the Protection
of Human Rights and Fundamental Freedoms (“the Convention”) by two
Italian nationals, Mr Matteo Ferrieri and Mrs Ornella Bonassisa (“the
applicants”), on 23 July 2019 and 1 August 2020 respectively;
the decision to give notice of the applications to the Italian Government
(“the Government”);
the parties’ observations;
Having deliberated in private on 2 December 2025,
Delivers the following judgment, which was adopted on that date:

INTRODUCTION
1. The case concerns access to and the examination of the applicants’
banking data, including bank account information, transaction histories, and
details of other financial operations either related to the applicants or
traceable to them. Those measures (hereinafter “the contested measures”)
were implemented by the Tax Authority (Agenzia delle Entrate) for tax audit
purposes. The applicants complained of the excessively broad scope of the
discretion conferred on the domestic authorities by the national legislation,
and of the lack of sufficient procedural safeguards capable of protecting them
against any abuse or arbitrariness, in particular the lack of ex ante and/or
ex post judicial or independent review of the contested measures.

THE FACTS
2. The first applicant (application no. 40607/19), Mr M. Ferrieri, was born
in 1965 and lives Cerignola. He was represented by Mr C. Stasi, a lawyer
practicing in Foggia. The second applicant (application no. 34583/20),
Mrs O. Bonassisa, was born in 1977 and lives in Foggia. She is an accountant
representing herself before the Court.

1

FERRIERI AND BONASSISA v. ITALY JUDGMENT

3. The Government were represented by their Agent, Mr L. D’Ascia,
Avvocato dello Stato.
4. The facts of the case may be summarised as follows.
5. On 15 July 2019 the first applicant and on 16 July 2020 the second
applicant were notified by their banks that the banks had received requests
from the Tax Authority to provide information about their bank accounts,
transaction histories, and other financial operations either related to them or
traceable to them, for a specified period of time, in respect of the first
applicant from 1 January to 31 December 2017 and in respect of the second
applicant from 1 January 2016 to 31 December 2017. The banks informed the
applicants that they were going to comply with their legal obligation to
provide the requested information.
6. The authorisation to obtain such data directly from banking institutions
had been issued by directors of the Tax Authority under Article 51 § 2 (7) of
Presidential Decree no. 633 of 26 October 1972 (“Decree no. 633/1972”,
see paragraph 7 below) and Article 32 § 1 (7) of Presidential Decree no. 600
of 29 September 1973 (“Decree no. 600/1973”, see paragraph 9 below).

RELEVANT LEGAL FRAMEWORK AND PRACTICE
I. DOMESTIC LAW

A. Presidential Decree no. 633 of 26 October 1972 (Establishment and
regulation of value-added tax)

7. The measures at issue in the present case are regulated by Article 51 of
Decree no. 633/1972, as in force at the relevant time, which reads as follows:
“1. The value-added tax offices check the declarations submitted and the payments
made by taxpayers, detect any omissions and proceed to the assessment and collection
of the taxes or additional taxes due; they supervise compliance with the obligations
relating to the invoicing and registration of transactions, the keeping of accounting
records, and the other obligations set out in this Decree; [and] they impose fines and
surcharges and submit reports to the judicial authorities for violations sanctioned under
criminal law. The appropriate risk analysis activities are carried out to check the
declarations submitted and identify the persons who have failed to submit them.
2. For the purpose of carrying out their functions [as set out in the previous
paragraph], the tax offices can:
...
(7) having obtained prior authorisation from the central director of assessment of the
Tax Authority or its regional director, or, as concerns the Revenue Police, from [the]
regional head [of the Revenue Police], request that banks provide ... data, information
and documents relating to any [financial] relationship or transactions ..., including
services rendered, [involving] their clients, as well as the guarantees given by third
parties or the financial operators mentioned above, and the particulars of the persons
for whom the same financial operators have carried out the above-mentioned
transactions ... The request should be addressed to the head of the centralised structure

2

FERRIERI AND BONASSISA v. ITALY JUDGMENT

or the head of the office [which receives the request], who shall immediately notify the
person concerned; the relevant response must be sent to the head of the office [which
has initiated the proceedings].
...
4. Requests under paragraph 2 point (7), as well as the relevant responses, even if
negative, shall be submitted exclusively by electronic means. A provision of the
Director of the Revenue Agency shall lay down the implementing provisions and the
procedures for transmitting the requests [and] replies, as well as the data and
information concerning the relationships and transactions indicated in point (7) above.”
8. Article 57 establishes the time-limits for issuing a tax assessment notice
finding that a taxpayer failed to comply with the relevant tax obligations in a
specific fiscal year. Its first paragraph, as in force at the relevant time,
provides that the taxpayer must be notified of the assessment by
31 December of the fifth year following the year in which the tax declaration
was filed. The second paragraph states that in the event of a complete
omission to file a declaration, the taxpayer can be notified of the tax
assessment by 31 December of the seventh year following the year in which
the declaration should have been filed.

B. Presidential Decree no. 600 of 29 September 1973 (Common
provisions concerning the assessment of income taxes)

9. Article 32 § 1 (7) of Decree no. 600/1973, concerning the assessment
of income taxes, reproduces the provision set out in Article 51 § 2 (7) of
Decree no. 633/1972 in relation to the assessment of value-added tax (VAT)
(see paragraph 7 above).
10. Article 43 reiterates the same time-limits for issuing a tax assessment
notice as those set out in Article 57 of Decree no. 633/1972 (see paragraph 8
above).

C. Legislative Decree no. 546 of 31 December 1992 (Provisions
concerning tax judicial proceedings)

11. Article 19 of Decree no. 546/1992, as in force at the material time,
included an exhaustive list of the acts that could be challenged before the tax
courts. Its relevant parts read as follows:

Article 19: Acts that can be challenged and the subject of the complaint
“1. Complaints [to the tax courts] can be lodged against:
(a) a tax assessment notice;
(b) a tax liquidation notice;
(c) an order imposing sanctions;
(d) a tax collection notice;

3

FERRIERI AND BONASSISA v. ITALY JUDGMENT

...
(i) any other act which the law expressly states can be challenged independently.
...
2. Acts other than those expressly provided for cannot be challenged independently.
Any act that can be challenged independently may be challenged solely on the basis of
its own irregularities ...”

D. Law no. 212 of 27 July 2000 (the Act on Taxpayers’ Rights)

12. The relevant provisions of Law no. 212/2000 read as follows:

Section 13: Taxpayer’s Guarantor
“1. A Taxpayer’s Guarantor is established at each directorate of revenues in the
regions and autonomous provinces.
2. The Taxpayer’s Guarantor, operating in full autonomy, is an [individual person
acting as a] body [who is] chosen and appointed by the president of the regional tax
court or its detached section in whose district the regional directorate of the tax authority
is based ...
6. The Taxpayer’s Guarantor addresses requests for documents or clarifications to
the competent offices, [and does so] also on the basis of reports submitted in writing by
the taxpayer or any other interested party who complains of malfunctions, irregularities,
incorrectness, abnormal or unreasonable administrative practices, or any other
behaviour likely to undermine the relationship of trust between citizens and the
financial administration. [The competent offices] respond within thirty days, and [this]
activates the self-correction procedures (autotutela) in respect of administrative
assessments or collection notices of which the taxpayer has been notified. The
Taxpayer’s Guarantor communicates the outcome of the activity carried out to the
regional or district directorates [of the tax authorities] or to the area headquarters of the
Revenue Police, as well as to supervisory bodies, informing the person who reported
[the irregularity].
7. The Taxpayer’s Guarantor makes recommendations to tax office managers to
protect the taxpayer and organise services in the best way.
...”

E. The power of self-correction (autotutela)

13. As part of its power of “self-correction” (autotutela), a public
administrative body can annul or revoke decisions that have already been
made, without the intervention of a judicial authority.

II. DOMESTIC PRACTICE

14. Over the years, the Tax Authority has issued several administrative
circulars aimed at clarifying the conditions under which the power to carry
out tax audits of banking data may be exercised, and the procedure to be

4

FERRIERI AND BONASSISA v. ITALY JUDGMENT

followed by tax offices for that purpose (see also Italgomme Pneumatici S.r.l.
v. Italy, nos. 36617/18 and 12 others, §§ 55-59, 6 February 2025).

A. Circular no. 131 of 30 July 1994

15. In Circular no. 131 of 30 July 1994 (“Circular no. 131/1994”), the Tax
Authority established criteria for selecting taxpayers and investigation
methods in relation to checks on income tax and value-added tax.
16. In respect of the criteria for carrying out tax audits of banking data,
the relevant part of the circular read as follows:
“Tax audits of banking data will, in particular, be carried out in respect of
- total or near-total tax evaders;
- persons with no accounting records or with accounting records that are obviously
unreliable;
- persons carrying out import-export transactions;
- persons who have issued and/or used invoices for non-existent transactions; [and]
- persons whose financial capacity is clearly in stark contrast to the[ir] declared
income.”
17. Circular no. 131/1994 further stated that tax offices asking for
authorisation to carry out tax audits of banking data “[had to] sufficiently
substantiate requests for authorisation to the regional directorates, in order to
provide them with useful elements of evaluation”. In particular, a request had
to indicate the following elements:
“- the data aimed at identifying the taxpayer;
- the reasons for undertaking the inquiry;
- the elements aimed at assessing the fiscal situation of the taxpayer;
- the reasons for considering that a tax audit of banking data would be useful in
respect of the tax inquiry;
- the time period in respect of which the tax audit of banking data should be carried
out;
- the banks ... to which the request should be submitted ...;”
18. Circular no. 131/1994 clarified that, on the basis of that information,
the regional directorates had to check the formal and substantial legality
(controllo sia di legittimità che di merito) of the request before issuing the
requested authorisation.
19. As regards a decision to carry out a tax audit of banking data, the
circular further stated that the domestic authorities had to undertake a
cost-benefit analysis:
“It must be stressed that tax audits of banking data should be initiated in cases [where]
the fruitfulness of the tax audit [in question] has been assessed. So, on the basis of
common experience, the ‘costs’ of the tax audit (represented by the inevitable extension

5

FERRIERI AND BONASSISA v. ITALY JUDGMENT

of the inquiry in terms of time and the complexity of the analysis of the accounts) must
be weighed against the relative ‘benefits’ of an evidential nature, relating to the
presumed size of the recoverable taxable amounts. The principle of economy of action
(in terms of cost-benefit) must, moreover, strongly guide all the tax audit activity of the
offices.”

B. Circular no. 32/E of 19 October 2006

20. In Circular no. 32/E of 19 October 2006 (“Circular no. 32/E/2006”),
the Tax Authority provided clarifications concerning the powers of tax offices
in the context of tax inquiries, including the power to request that banks
provide information and data concerning transaction histories and
transactions in taxpayers’ bank accounts.
21. The circular confirmed that authorisation to undertake tax audits of
banking data had to be requested in the context of a formalised procedure
designed to safeguard taxpayers’ rights and the transparent and impartial
exercise of administrative action, in conformity with the principles enshrined
in the Act on Taxpayers’ Rights (see paragraph 12 above).

C. Circular no. 25/E of 26 August 2014

22. In Circular no. 25/E of 26 August 2014 (“Circular no. 25/E/2014”),
the Tax Authority established operative guidelines for preventing and
combating tax evasion in the year 2014.
23. In respect of tax audits of banking data, the circular read as follows:
“With specific regard to ... financial investigations, it is reiterated that [they] must be
used only after carefully assessing the risk of significant discrepancies in [a] tax
declaration (significative anomalie dichiarative), and ideally only when the tax office
has already instituted a tax inquiry.”

D. Circular no. 16 of 28 April 2016

24. In Circular no. 16 of 28 April 2016 (“Circular no. 16/2016”), the Tax
Authority established operative guidelines for preventing and combating tax
evasion in the year 2016.
25. In respect of tax audits of banking data, the circular read as follows:
“The use of financial investigations, which should be used only after carefully
considering the risk of significant discrepancies in [a] tax declaration, and when the tax
office has already instituted a tax inquiry, must be appropriate and designed to obtain
credible and reliable assessments.”

6

FERRIERI AND BONASSISA v. ITALY JUDGMENT

III. DOMESTIC CASE-LAW

A. Case-law on authorisation to obtain taxpayers’ banking data

26. In judgment no. 14026 of 3 August 2012, the Court of Cassation held
that authorisation issued by a director of a tax office to obtain information
directly from banks concerning taxpayers’ transaction histories, transactions
and other dispositions was an act of a merely internal and procedural nature
(carattere meramente endoprocedimentale) which could not be challenged
independently before the tax courts.
27. In judgment no. 8849 of 30 April 2015, the Court of Cassation
observed that authorisation did not have to contain reasons, as no such
requirement had been imposed under the applicable domestic provisions. The
court held that such authorisation was merely an internal administrative act
which could not be challenged by the bank that had been asked to provide the
information, and the taxpayer concerned did not have to be notified of it.
Since the authorisation could not be challenged, in the Court of Cassation’s
view, it did not need to include any kind of reasoning.
28. Similarly, in judgment no. 19564 of 24 July 2018, the Court of
Cassation defined authorisation as a “mere preparatory act” (atto meramente
preparatorio) which served an “organisational function” (funzione
organizzativa) within the hierarchical structure of offices, but had no effect
on a taxpayer.

B. Case-law on ex post remedies

1. Tax courts
29. In judgment no. 14026 of 3 August 2012, the Court of Cassation held
that authorisation to obtain taxpayers’ banking data could be challenged by
lodging a complaint with the tax courts against a tax assessment notice based
on information obtained through such a measure.
30. As regards the reasons for challenging authorisation, in judgment
no. 17158 of 28 June 2018, the Court of Cassation held that failure to notify
a taxpayer of such authorisation could not affect its validity (see also
judgment no. 16874 of 21 July 2009 and judgment no. 20420 of
26 September 2014 of the Court of Cassation). Given that authorisation was
merely an administrative act issued by the Tax Authority, only a complete
lack of such authorisation could be challenged by means of a complaint
against a tax assessment notice based on information acquired in the absence
of any authorisation, provided that it could be demonstrated that the lack of
authorisation had caused specific prejudice to the taxpayer concerned (see
judgment no. 14026 of 3 August 2012 and judgment no. 3628 of
10 February 2017 of the Court of Cassation).

7

FERRIERI AND BONASSISA v. ITALY JUDGMENT

31. More recently, the Court of Cassation clarified that a tax assessment
notice could not be invalidated merely because it was based on banking data
obtained in the absence of any authorisation issued by the competent
management body. Similarly, a taxpayer would need to demonstrate that the
lack of authorisation had caused him or her specific prejudice in relation to a
constitutionally protected right or interest (see judgment no. 3242 of
10 February 2021 and judgment no. 10576 of 1 April 2022 of the Court of
Cassation).

2. The Taxpayer’s Guarantor
32. In judgment no. 25212 of 24 August 2022, the Court of Cassation
clarified, although not in the context of tax audits of banking data but in the
context of reimbursement of tax paid in excess of the amount legally due in
relation to inheritance matters, that the Taxpayer’s Guarantor could not adopt
binding decisions. The Court of Cassation held as follows:
“The legal system currently in force does not expressly provide for the Tax Authority
or the entities which are entitled to collect taxes being obliged to implement a
self- correction (autotutela) measure requested by the Taxpayer’s Guarantor, or to
comply with the decisions taken by the Taxpayer’s Guarantor. Indeed, the [decisions]
of the Taxpayer’s Guarantor are not binding and therefore do not produce legal effects,
but only constitute warnings entailing at most only an obligation to respond to the
request for self-correction and/or review the file presented by the taxpayer. Ultimately,
the Taxpayer’s Guarantor is not recognised as having any active management powers.
[The body] cannot therefore exercise authoritative or sanctioning powers in respect of
tax administration offices or, following the activation of a self-correction procedure,
replace the tax administration in reviewing any illegitimate [notice]. In this regard, it
has been said that the legislation establishing [the Taxpayer’s Guarantor] does not give
[that body] the power to cancel tax notices by way of self-correction, nor does it
establish a duty for the tax administration to decide [a case] in the manner requested by
the Guarantor. According to the most acceptable interpretation, [the legislation] seems
to limit itself to giving the Taxpayer’s Guarantor the power to merely initiate the
[self- correction] procedure. However, [once the relevant procedure has been initiated],
the tax services would therefore be required to respond to the request of the Taxpayer’s
Guarantor by issuing, at the very least, a notice indicating why they do not intend to
follow up on [that request].”

IV. EUROPEAN UNION LAW

A. Council Directive 2011/16/EU of 15 February 2011 on
administrative cooperation in the field of taxation and repealing
Directive 77/799/EEC

33. Council Directive 2011/16/EU of 15 February 2011 on administrative
cooperation in the field of taxation (the Directive on Administrative
Cooperation, “the DAC”) repealed Directive 77/799/ECC in force until then.
The DAC has been amended several times, the most recent directive being

8

FERRIERI AND BONASSISA v. ITALY JUDGMENT

DAC8 in 20231. DAC9 has entered into force on 7 May 2025 and must be
transposed no later than 31 December 2025.
Through the DAC, EU countries can make use of mechanisms like the
automatic exchange of information and the exchange of information on
request to ensure that foreign income is subject to tax. The automatic
exchange of information means the systematic communication of pre-defined
information from the tax administration of an EU country to the tax
administration of another EU country. The exchange of information comes in
three forms – automatic, on-request and spontaneous – that are specific to the
type of information to be exchanged. Information is exchanged between one
competent authority and another through a secured network, ensuring
confidentiality and privacy.
34. Recital 20 of the DAC reads as follows:
“However, a Member State should not refuse to transmit information because it has
no domestic interest or because the information is held by a bank, other financial
institution, nominee or person acting in an agency or fiduciary capacity or because it
relates to ownership interests in a person.”
35. The relevant provisions of the DAC read as follows:

Article 5: Procedure for exchange of information on request
“At the request of the requesting authority, the requested authority shall communicate
to the requesting authority any information referred to in Article 1(1) that it has in its
possession or that it obtains as a result of administrative enquiries.”

Article 8: Scope and conditions of mandatory automatic exchange of information
“1. The competent authority of each Member State shall, by automatic exchange,
communicate to the competent authority of any other Member State, information
regarding taxable periods as from 1 January 2014 that is available concerning residents
in that other Member State, on the following specific categories of income and capital
as they are to be understood under the national legislation of the Member State which
communicates the information:
(a) income from employment;
(b) director’s fees;
(c) life insurance products not covered by other Union legal instruments on exchange
of information and other similar measures;
(d) pensions;
(e) ownership of and income from immovable property.
...”

1 More information on the DAC and further modifications are available at: https://taxation-

customs.ec.europa.eu/taxation/tax-transparencycooperation/administrative-co-operation-
and-mutual-assistance/directive- administrative- cooperation-dac_en

9

FERRIERI AND BONASSISA v. ITALY JUDGMENT

Article 18: Obligations
“1. If information is requested by a Member State in accordance with this Directive,
the requested Member State shall use its measures aimed at gathering information to
obtain the requested information, even though that Member State may not need such
information for its own tax purposes. That obligation is without prejudice to
paragraphs 2, 3 and 4 of Article 17, the invocation of which shall in no case be construed
as permitting a requested Member State to decline to supply information solely because
it has no domestic interest in such information.
2. In no case shall Article 17(2) and (4) be construed as permitting a requested
authority of a Member State to decline to supply information solely because this
information is held by a bank, other financial institution, nominee or person acting in
an agency or a fiduciary capacity or because it relates to ownership interests in a person.
3. Notwithstanding paragraph 2, a Member State may refuse the transmission of
requested information where such information concerns taxable periods prior to
1 January 2011 and where the transmission of such information could have been refused
on the basis of Article 8(1) of Directive 77/799/EEC if it had been requested before
11 March 2011.”
36. Commission Implementing Regulation (EU) 2025/648 of
2 April 2025 on amending Implementing Regulation (EU) 2015/2378
provides standard forms and computerised formats to be used in relation to
Council Directive 2011/16/EU as amended by Council
Directive 2021/514/EU, specifically setting out when member States have to
submit statistical data in relation to information reported by digital platform
operators and the types of statistics to be provided in relation to joint audits.

B. Regulation 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC

37. Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (the General Data Protection Regulation, “the
GDPR”) (OJ 2016 L 119/1) entered into force on 24 May 2016 and has
applied since 25 May 2018.
38. Article 5 of the GDPR establishes the principles relating to processing
of personal data, such as lawfulness, fairness and transparency, purpose
limitation, data minimisation, accuracy, storage limitation, integrity and
confidentiality, and accountability. Pursuant to Article 13 of the GDPR, data
controllers have the obligation to inform a data subject of the collection of
their personal data and provide the data subject with certain information
relevant thereto as specified in the provision. Article 15 of the GDPR further
provides that the data subject has the right to obtain from the controller
confirmation as to whether or not personal data concerning him or her is being

10

FERRIERI AND BONASSISA v. ITALY JUDGMENT

processed and, where that is the case, access to the personal data and other
relevant information as set out in the provision.
39. Recital 31 of the GDPR reads as follows:
Public authorities to which personal data are disclosed in accordance with a legal
obligation for the exercise of their official mission, such as tax and customs authorities,
financial investigation units, independent administrative authorities, or financial market
authorities responsible for the regulation and supervision of securities markets should
not be regarded as recipients if they receive personal data which are necessary to carry
out a particular inquiry in the general interest, in accordance with Union or Member
State law. The requests for disclosure sent by the public authorities should always be in
writing, reasoned and occasional and should not concern the entirety of a filing system
or lead to the interconnection of filing systems. The processing of personal data by those
public authorities should comply with the applicable data-protection rules according to
the purposes of the processing.

40. Within the context of the aforementioned rules, Article 23 provides as
follows:

Article 23: Restrictions
“1. Union or Member State law to which the data controller or processor is subject
may restrict by way of a legislative measure the scope of the obligations and rights
provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its
provisions correspond to the rights and obligations provided for in Articles 12 to 22,
when such a restriction respects the essence of the fundamental rights and freedoms and
is a necessary and proportionate measure in a democratic society to safeguard:
...
(e) other important objectives of general public interest of the Union or of a
Member State, in particular an important economic or financial interest of the Union or
of a Member State, including monetary, budgetary and taxation a matters, public health
and social security;
...”

C. Case-law of the Court of Justice of the European Union

41. In its judgment of 22 October 2013 in Sabou (C-276/12,
EU:C:2013:678), the Grand Chamber of the Court of Justice of the European
Union (CJEU) held as follows:
“38. The Court has previously ruled that observance of the rights of the defence is a
general principle of European Union law which applies where the authorities are
minded to adopt a measure which will adversely affect an individual
(see [Case C-349/07 Sopropé [2008] ECR I-10369], paragraph 36). [...]
39. The question arises as to whether the decision of a competent authority of a
Member State to request assistance from a competent authority of another Member
State and the latter’s decision to examine witnesses for the purposes of responding to
that request constitute acts which, because of their consequences for the taxpayer, make
it necessary for him to be heard.

11

FERRIERI AND BONASSISA v. ITALY JUDGMENT

40. All the Member States which submitted observations to the Court argued that a
request for information by one Member State sent to the tax authorities of another
Member State does not constitute an act giving rise to such an obligation. They rightly
consider that, in tax inspection procedures, the investigation stage, during which
information is collected and which includes the request for information by one tax
authority to another, must be distinguished from the contentious stage, between the tax
authorities and the taxpayer, which begins when the taxpayer is sent the proposed
adjustment.
[...]
46. Accordingly, the answer to the first and second questions is that European Union
law, as it results in particular from Directive 77/799 and the fundamental right to be
heard, must be interpreted as not conferring on a taxpayer of a Member State either the
right to be informed of a request for assistance from that Member State addressed to
another Member State, in particular in order to verify the information provided by that
taxpayer in his income tax return, or the right to take part in formulating the request
addressed to the requested Member State, or the right to take part in examinations of
witnesses organised by the requested Member State.”
42. In its judgment of 6 October 2020 in Luxembourg State (C-245/19 and
C-246/19, EU:C:2020:795), the CJEU ruled as follows:
“1. Article 47 of the Charter of Fundamental Rights of the European Union, read in
conjunction with Articles 7 and 8 and Article 52(1) thereof, must be interpreted as:
– precluding legislation of a Member State implementing the procedure for the
exchange of information on request established by Council Directive 2011/16/EU of
15 February 2011 on administrative cooperation in the field of taxation and repealing
Directive 77/799/EEC, as amended by Council Directive 2014/107/EU of
9 December 2014, which prevents a person holding information from bringing an
action against a decision by which the competent authority of that Member State orders
that person to provide it with that information, with a view to following up on a request
for exchange of information made by the competent authority of another Member State,
and as
– not precluding such legislation from preventing the taxpayer concerned, in that
other Member State, by the investigation giving rise to that request for exchange of
information and the third parties concerned by the information in question from
bringing actions against that decision.
2. Article 1(1) and Article 5 of Directive 2011/16, as amended by
Directive 2014/107, must be interpreted as meaning that a decision by which the
competent authority of a Member State orders a person holding information to provide
it with that information, with a view to following up on a request for exchange of
information made by the competent authority of another Member State, is to be
considered, taken together with that request, as concerning information which is not
manifestly devoid of any foreseeable relevance where it states the identity of the person
holding the information in question, that of the taxpayer concerned by the investigation
giving rise to the request for exchange of information, and the period covered by that
investigation, and where it relates to contracts, invoices and payments which, although
not specifically identified, are defined by criteria relating, first, to the fact that they were
concluded or carried out by the person holding the information, secondly, to the fact
that they took place during the period covered by that investigation and, thirdly, to their
connection with the taxpayer concerned.”

12

FERRIERI AND BONASSISA v. ITALY JUDGMENT

V. INTERNATIONAL LAW

The Convention on Mutual Administrative Assistance in Tax Matters

43. The Convention on Mutual Administrative Assistance in Tax Matters
was developed jointly by the Organisation for Economic Co-operation and
Development (OECD) and the Council of Europe. It was concluded in
Strasbourg on 25 January 1988 and amended by the Protocol amending the
Convention on Mutual Administrative Assistance in Tax Matters, which
entered into force on 1 June 2011. Italy ratified the Convention on
31 January 2006 and the amending Protocol on 17 January 2012. The latter
entered into force in respect of Italy on 1 May 2012.
44. The relevant parts of the Explanatory Report to the 2010 Protocol
amending the Convention on Mutual Administrative Assistance in Tax
Matters clarified:
“1. The object of this Convention is to promote international co operation for a better
operation of national tax laws, while respecting the fundamental rights of taxpayers.
...
6. In this context, the Convention attempts to reconcile the respective legitimate
interests of those involved: in particular, the requirements of mutual international
assistance in tax assessment and enforcement, respect for special features of national
legal systems, the confidential nature of information exchanged between national
authorities and the fundamental rights of taxpayers.
7. Taxpayers have especially the right to respect for their privacy and the right to a
proper procedure in the determination of their rights and obligations in tax matters,
including appropriate protection against discrimination and double taxation.
8. In applying the Convention, tax authorities will be bound to operate within the
framework of national laws. The Convention specifically ensures that taxpayers’ rights
under national laws are fully safeguarded. However, national laws should not be applied
in a manner that undermines the object and purpose of the Convention. In other words,
the Parties are expected not to unduly prevent or delay effective administrative
assistance.”
45. The relevant provisions of the Convention on Mutual Administrative
Assistance in Tax Matters read as follows:

Article 1: Object of the Convention and persons covered
“1. The Parties shall, subject to the provisions of Chapter IV, provide administrative
assistance to each other in tax matters. Such assistance may involve, where appropriate,
measures taken by judicial bodies.
2. Such administrative assistance shall comprise:
a. exchange of information, including simultaneous tax examinations and
participation in tax examinations abroad;
b. assistance in recovery, including measures of conservancy; and
c. service of documents.

13

FERRIERI AND BONASSISA v. ITALY JUDGMENT

3. A Party shall provide administrative assistance whether the person affected is a
resident or national of a Party or of any other State.”

Article 4: General provision
“1. The Parties shall exchange any information, in particular as provided in this
section, that is foreseeably relevant for the administration or enforcement of their
domestic laws concerning the taxes covered by this Convention.
2. Deleted.
3. Any Party may, by a declaration addressed to one of the Depositaries, indicate that,
according to its internal legislation, its authorities may inform its resident or national
before transmitting information concerning him, in conformity with Articles 5 and 7.”

Article 21: Protection of persons and limits to the obligation to provide assistance
“1. Nothing in this Convention shall affect the rights and safeguards secured to
persons by the laws or administrative practice of the requested State.
2. Except in the case of Article 14, the provisions of this Convention shall not be
construed so as to impose on the requested State the obligation:
a. to carry out measures at variance with its own laws or administrative practice or
the laws or administrative practice of the applicant State;
b. to carry out measures which would be contrary to public policy (ordre public);
c. to supply information which is not obtainable under its own laws or its
administrative practice or under the laws of the applicant State or its administrative
practice;
d. to supply information which would disclose any trade, business, industrial,
commercial or professional secret, or trade process, or information the disclosure of
which would be contrary to public policy (ordre public);
e. to provide administrative assistance if and insofar as it considers the taxation in the
applicant State to be contrary to generally accepted taxation principles or to the
provisions of a convention for the avoidance of double taxation, or of any other
convention which the requested State has concluded with the applicant State;
f. to provide administrative assistance for the purpose of administering or enforcing
a provision of the tax law of the applicant State, or any requirement connected
therewith, which discriminates against a national of the requested State as compared
with a national of the applicant State in the same circumstances;
g. to provide administrative assistance if the applicant State has not pursued all
reasonable measures available under its laws or administrative practice, except where
recourse to such measures would give rise to disproportionate difficulty;
h. to provide assistance in recovery in those cases where the administrative burden
for that State is clearly disproportionate to the benefit to be derived by the applicant
State.
3. If information is requested by the applicant State in accordance with this
Convention, the requested State shall use its information gathering measures to obtain
the requested information, even though the requested State may not need such
information for its own tax purposes. The obligation contained in the preceding
sentence is subject to the limitations contained in this Convention, but in no case shall

14

FERRIERI AND BONASSISA v. ITALY JUDGMENT

such limitations, including in particular those of paragraphs 1 and 2, be construed to
permit a requested State to decline to supply information solely because it has no
domestic interest in such information.
4. In no case shall the provisions of this Convention, including in particular those of
paragraphs 1 and 2, be construed to permit a requested State to decline to supply
information solely because the information is held by a bank, other financial institution,
nominee or person acting in an agency or a fiduciary capacity or because it relates to
ownership interests in a person.”

THE LAW

I. JOINDER OF THE APPLICATIONS

46. Having regard to the similar subject matter of the applications, the
Court finds it appropriate to examine them jointly in a single judgment.

II. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

47. The applicants complained under Article 8 of the Convention of the
excessively broad scope of the discretion conferred on the domestic
authorities by the national legislation, and of the lack of sufficient procedural
safeguards capable of protecting them against any abuse or arbitrariness, in
particular the lack of ex ante and/or ex post judicial or independent review of
the contested measures.
48. Article 8 of the Convention reads as follows:
“1. Everyone has the right to respect for his private ... life ...
2. There shall be no interference by a public authority with the exercise of this right
except such as is in accordance with the law and is necessary in a democratic society in
the interests of national security, public safety or the economic well-being of the
country, for the prevention of disorder or crime, for the protection of health or morals,
or for the protection of the rights and freedoms of others.”

A. Admissibility

1. The Government’s non-exhaustion objection
(a) The parties’ submissions
49. The Government submitted that the applicants had failed to exhaust
domestic remedies, as they had not challenged the measures in question
before the tax courts or the civil courts.
50. The applicants argued that a complaint to the tax courts would have
been ineffective, as the availability of such a complaint had been uncertain
and in any event would not have become available until some point in the
future. As regards the civil courts, they submitted that the Government had
failed to prove that such a remedy was available in practice, as they had not

15

FERRIERI AND BONASSISA v. ITALY JUDGMENT

provided any case-law example in which the remedy had been used
successfully in a similar case.

(b) The Court’s assessment
51. The Court notes that the Government’s objection as to whether the
applicants had at their disposal an effective remedy to challenge the contested
measures is closely related to the substance of the applicants’ complaints.
Accordingly, it finds that this objection should be joined to the merits.

2. Conclusions as to admissibility
52. The Court notes that the complaint cannot be declared manifestly
ill- founded within the meaning of Article 35 § 3 of the Convention. It further
finds that there are no other grounds at this stage for declaring this complaint
inadmissible, and therefore declares it admissible.

B. Merits

1. Applicability of Article 8 and existence of an interference
53. In the present case, the Government did not dispute that the impugned
measures had constituted interferences with the applicants’ right to respect
for their private life within the meaning of Article 8 of the Convention. On
the basis of the following observations, the Court sees no reason to find
otherwise.
54. The Court has already held that the information which tax authorities
obtain from banking documents undoubtedly amounts to personal data
concerning an individual, regardless of whether it is sensitive information or
not (see G.S.B. v. Switzerland, no. 28601/11, § 93, 22 December 2015).
Moreover, such information may also concern professional dealings, and
there is no reason of principle to justify excluding activities of a professional
or business nature from the notion of “private life” (see, in the context of
obtaining and copying banking data, M.N. and Others v. San Marino,
no. 28005/12, § 51, 7 July 2015, and Brito Ferrinho Bexiga Villa-Nova
v. Portugal, no. 69436/10, § 43, 1 December 2015). The Court has also held
that details of taxable earned and unearned income, as well as taxable net
assets, concern the “private life” of the individuals in question
(see Samoylova v. Russia, no. 49108/11, § 62, 14 December 2021, and the
cases cited therein), and that data such as a taxpayer’s name and home
address, processed and published by the Tax Authority in connection with the
fact that he or she has failed to fulfil his or her tax payment obligations,
clearly concern information about “private life”, notwithstanding the fact that
under domestic law, the data have been classified as information in the public
interest (see L.B. v. Hungary [GC], no. 36345/16, § 104, 9 March 2023).

16

FERRIERI AND BONASSISA v. ITALY JUDGMENT

55. Furthermore, the Court has already found that consulting an
individual’s bank account amounts to an interference with his or her right to
respect for private life (see, in the context of consulting the banking data of a
lawyer, Brito Ferrinho Bexiga Villa-Nova, cited above, § 44, and Sommer
v. Germany, no. 73607/13, § 48, 27 April 2017).
56. It follows that, in the present case, the Tax Authority’s act of accessing
the applicants’ banking data amounted to an interference with their right to
respect for their “private life”.
57. The Court reiterates that an interference breaches Article 8 unless it is
“in accordance with the law”, pursues one or more of the legitimate aims
referred to in paragraph 2 and is, in addition, “necessary in a democratic
society” to achieve those aims (see, among other authorities, Vinks and
Ribicka v. Latvia, no. 28926/10, § 93, 30 January 2020). The exceptions
provided for in Article 8 § 2 are to be interpreted narrowly, and the need for
them in a given case must be convincingly established (ibid., § 101, with
further references).
58. That said, it should be borne in mind that the Court has already
considered that bank data, that is to say purely financial information, do not
involve the transmission of intimate details or data closely linked to identity
do not merit enhanced protection, and that accordingly, States enjoy a broad
margin of appreciation in this field (see L.B. v. Hungary, § 119, and G.S.B.
v. Switzerland, § 93, both cited above).

2. Whether the interference was “in accordance with the law”
(a) The parties’ submissions
(i) The applicants
59. The applicants submitted that the contested measures had been
implemented on the basis of a “law” which did not comply with the quality
requirements imposed by the principles of legality and the rule of law.
60. They highlighted that the applicable domestic provisions did not
provide for an ex ante independent or judicial review of such measures, as
they had to be authorised by a higher authority within the same Tax Authority
which, in their view, was not independent.
61. The applicants further argued that the applicable provisions did not
indicate the circumstances in which or the conditions on which the contested
measures could be implemented, thereby giving the domestic authorities an
unfettered margin of discretion. In their view, the criteria established in the
circulars provided by the Government (see paragraphs 15-22 above) were
very generic and left a wide margin of discretion. Moreover, they submitted
that those criteria had not been fulfilled in their case, as they had not been
suspected of or found liable of any of the serious tax offences referred to in
those circulars.

17

FERRIERI AND BONASSISA v. ITALY JUDGMENT

62. They also contended that domestic law did not provide for any
effective ex post checking of the measures. In their view, the possibility of
lodging a complaint with the civil courts was merely theoretical, as there were
no case-law examples of this. Moreover, a complaint to the civil courts would
not have been an effective remedy, as those courts could not implement
precautionary and urgent measures. As regards the possibility of challenging
the measures before the tax courts, the applicants submitted that such an
action could be brought only in respect of a tax assessment notice, which a
person could be notified of several years after the alleged violation.
Furthermore, the applicants would have been prevented from raising their
complaints before the tax courts, as the well-established case-law of the Court
of Cassation provided that a lack of authorisation or a lack of reasoning in
authorisation did not justify the annulment of a tax assessment notice. As
regards a complaint to the Taxpayer’s Guarantor, the applicants argued that
that body would have had no power to assess the complaints raised in the
present applications, and in any case, did not have the power to adopt binding
decisions.
63. The applicants further submitted that they had not been notified of the
authorisation to access their bank accounts, and that therefore they had not
known why the measures had been implemented. In particular, they had not
known whether they had been implemented for purely preventive and
exploratory purposes, without indicating the offences of which they had been
suspected. In their view, the failure to notify them of the authorisation had
completely prevented them from subjecting the measures to effective checks.

(ii) The Government
64. The Government submitted that the procedure, conditions and scope
of application of the contested measures were clearly provided for in
Article 32 § 1 (7) of Decree no. 600/1973 and Article 51 § 2 (7) of
Decree no. 633/1972, which, in their view, were sufficiently accessible, clear
and foreseeable in their application. Moreover, the fourth paragraph of both
provisions clarified that a request to implement the contested measures and
responses to such a request had to be submitted by electronic means, thereby
allowing the procedure to be checked.
65. The Government considered that the measures had been subjected to
a sufficient ex ante check, given that a request for authorisation had to be
submitted to the competent management body of the Tax Authority or the
Revenue Police. Such a request had to refer to the relevant facts, the years
being audited and the results of tax audits already undertaken, and to elaborate
on the reasons justifying the requested access to bank accounts. The
authorising body had to assess whether, in the light of the information
provided, the conditions established under the law had been satisfied and the
measure was proportionate and adequate in respect of the aim pursued.
Moreover, Circular no. 131/1994 of the Tax Authority clarified that the

18

FERRIERI AND BONASSISA v. ITALY JUDGMENT

contested measures could be authorised where there had been no tax
declarations for several tax periods, where accounting records were not
reliable, or where invoices for non-existent transactions had been identified
(see paragraphs 15-16 above). It also stated that a request for authorisation
had to be substantiated. Furthermore, Circular no. 25/E/2014 and Circular
no. 16/2016 added that the measures could be authorised in cases where the
expected tax returns exceeded a certain amount (see paragraphs 23 and
25 above). In accordance with the relevant domestic law and practice, the
reasons justifying the contested measures could not, therefore, be generic or
standardised.
66. The Government contended that the competent management body
could be considered independent, as it had different functions and was usually
located in a different office from the one requesting the authorisation.
67. They argued that the measures had a clear purpose – verifying
effective compliance with taxpayers’ tax obligations, as provided for in
Article 53 of the Italian Constitution. In order to be authorised, the measures
had to comply with the following conditions: they had to prevent, identify
and repress tax evasion; and they had to respect the criteria of legality,
cost-effectiveness, efficiency and transparency, and be carried out with full
respect for the rights and guarantees granted to taxpayers.
68. As regards the existence of an ex post judicial review, the Government
pointed out that authorisation to undertake financial tax audits of bank
accounts was a “preparatory act” which could not be challenged in court
immediately. It had to be challenged by lodging a complaint with the
competent tax court against the final tax assessment notice, and by
demonstrating that an irregularity in the authorisation process had affected
the validity of that notice. In the Government’s view, several other countries
had adopted a similar approach. By contrast, in cases in which tax assessment
proceedings did not lead to the issuance of a tax assessment notice, the
relevant authorisation to consult bank accounts could be challenged before
the ordinary civil courts. Lastly, a taxpayer could report allegedly unlawful
access to his or her bank account to the Taxpayer’s Guarantor, under
Article 13 of Law no. 212/2000. That body could exercise its tax audit
powers, remind the competent domestic authorities to comply with the
applicable provisions, and report the identified shortcomings to the head of
the competent office with a view to possibly instituting disciplinary
proceedings.

(b) The Court’s assessment
(i) General principles
69. The Court reiterates at the outset that the expression “in accordance
with the law”, within the meaning of Article 8 § 2 of the Convention, requires
firstly that the impugned measure should have some basis in domestic law.

19

FERRIERI AND BONASSISA v. ITALY JUDGMENT

Secondly, the domestic law must be accessible to the person concerned.
Thirdly, the person affected must be able, if need be with appropriate legal
advice, to foresee the consequences of the domestic law for him, and fourthly,
the domestic law must be compatible with the rule of law (see, among other
authorities, De Tommaso v. Italy [GC], no. 43395/09, § 107,
23 February 2017).
70. The Court further points out that the concept of “law” must be
understood in its “substantive” sense, not its “formal” one. It therefore
includes everything that goes to make up the written law, including
enactments of lower rank than statutes, and the relevant case-law authority
(see, for example, National Federation of Sportspersons’ Associations and
Unions (FNASS) and Others v. France, nos. 48151/11 and 77769/13, § 160,
18 January 2018). Accordingly, in assessing the lawfulness of an
interference, and in particular the foreseeability of the domestic law in
question, the Court has regard to both the text of the law and the manner in
which it was applied and interpreted by the domestic authorities. It is the
practical interpretation and application of the law by the domestic courts that
must give individuals protection against arbitrary interference (see Italgomme
Pneumatici S.r.l. and Others v. Italy, nos. 36617/18 and 12 others, § 96,
6 February 2025).
71. For domestic law to meet these requirements, it must afford a measure
of legal protection against arbitrary interferences by public authorities with
the rights safeguarded by the Convention. In matters affecting fundamental
rights, it would be contrary to the rule of law, one of the basic principles of a
democratic society enshrined in the Convention, for a legal discretion granted
to the executive to be expressed in terms of an unfettered power.
Consequently, the law must indicate with sufficient clarity the scope of any
such discretion conferred on the competent authorities and the manner of its
exercise. The level of precision required of domestic legislation – which
cannot in any case provide for every eventuality – depends to a considerable
degree on the content of the instrument in question, the field it is designed to
cover and the number and status of those to whom it is addressed
(see Italgomme Pneumatici S.r.l. and Others, cited above, § 97, and Bernh
Larsen Holding AS and Others v. Norway, no. 24117/08, § 130,
14 March 2013, with further references).
72. The Court notes that while Article 8 contains no explicit procedural
requirements, in applications lodged under this provision, it has emphasised
that the concepts of lawfulness and the rule of law in a democratic society
also require that measures affecting human rights must be subject to some
form of adversarial proceedings before an independent body competent to
review in a timely fashion the reasons for the decision and the relevant
evidence (see Ivashchenko v. Russia, no. 61064/10, § 74, 13 February 2018,
with further references).

20

FERRIERI AND BONASSISA v. ITALY JUDGMENT

73. With specific regard to the measures at issue in the present case, the
Court has already found that it is legitimate for State authorities to access and
even disclose, within formalised procedures, bank details in order to assess
whether an applicant has complied with his or her tax obligations and, if not,
to take the requisite legal action (see G.S.B. v. Switzerland, cited above, § 95).
However, in such circumstances, the Court must be satisfied that there were
sufficient and adequate guarantees against arbitrariness (ibid., § 96),
including the possibility of an effective review of the measure at issue.
74. In this context, the Court has found that a subsequent judicial review
can offer sufficient protection if a review procedure at an earlier stage would
jeopardise the purpose of an investigation or surveillance.

(ii) Application of the above principles to the present case
75. The Court observes that the measures at issue were prescribed by law,
notably Article 51 § 2 (7) of Decree no. 633/1972 (see paragraph 7 above)
and Article 32 § 1 (7) of Decree no. 600/1973 and (see paragraph 9 above),
and that the parties did not dispute that such provisions were accessible.
However, the parties disagreed as to whether the legal basis for the contested
measures, as derived from the cited domestic provisions, complied with the
“quality-of-law” requirements imposed under Article 8 of the Convention.
76. Taking into account the scope of the applicants’ complaints, the Court
deems it necessary to assess whether the legal basis delimited the scope of
discretion conferred on the domestic authorities, and whether it provided for
sufficient procedural safeguards capable of protecting the applicants against
any abuse or arbitrariness.

(α) The delimitation of the scope of discretion conferred on the domestic
authorities
77. The Court notes at the outset that under Article 51 § 2 (7) of
Decree no. 633/1972 (see paragraph 7 above) and Article 32 § 1 (7) of
Decree no. 600/1973 (see paragraph 9 above) access to a taxpayer’s banking
data can be authorised for the purpose of performing tax office functions
which, as defined in Article 51 § 1 of Decree no. 633/1972 (see paragraph 7
above), relate to verifying compliance with taxpayers’ tax obligations.
78. In the Court’s view, the conditions indicated in the above legislative
provisions, taken alone, are insufficient to delimit the scope of discretion
conferred on the domestic authorities. In particular, mere reference to the
need to assess taxpayers’ compliance with their tax obligations confers an
unfettered discretion on the tax offices, as they have unregulated authority to
assess whether to implement the contested measures and to define the scope
of the information to be requested, which, by definition, is very wide
(see paragraph 65 above).
79. However, reiterating that the concept of “law”, within the meaning of
the Convention, includes enactments of lower rank than statutes

21

FERRIERI AND BONASSISA v. ITALY JUDGMENT

(see paragraph 70 above), the Court finds that in the field of taxation, the
conditions laid down in the applicable legislative provisions may be wider
and generic, provided that they are subsequently specified and clarified in
other instruments of lower rank or in the relevant domestic case-law.
80. In this context, the Court notes that some additional criteria were
established in the administrative circulars adopted and published by the Tax
Authority (see paragraph 14 above) and submitted by the Government.
In particular, Circular no. 131/1994 stated that tax audits of banking data
could be undertaken in respect of certain taxpayers: total or near-total tax
evaders, persons with no accounting records or with accounting records that
were obviously unreliable, persons carrying out import-export transactions,
persons who had issued and/or used invoices for non-existent transactions,
and persons whose financial capacity was clearly in stark contrast to their
declared income (see paragraph 16 above). It also clarified that a request for
authorisation to implement the contested measures should be reasoned, in
order to provide the authorising body with useful elements of evaluation
(see paragraph 17 above) to allow it to check the formal and substantive
legality of the request (see paragraph 18 above). Moreover, the same circular
stated that tax audits of banking data could be carried out only when other
means of assessing compliance with tax obligations had proved ineffective,
and on the basis of a cost-benefit analysis (see paragraph 19 above).
Furthermore, Circular no. 25/E/2014 established that tax audits of banking
data should be carried out only where there were significant discrepancies in
a tax declaration (significative anomalie dichiarative), and ideally when a tax
office had already instituted a tax inquiry (see paragraph 23 above), while
Circular no. 16/2016 added that the use of such audits should be “appropriate”
and “aimed at obtaining credible and reliable assessments” (see paragraph 25
above).
81. The Court is prepared to accept that the clear and detailed criteria laid
down in the circulars adopted and published by the Tax Authority might be
sufficient to complement the applicable domestic provisions and delimit the
scope of discretion conferred on the domestic authorities, provided that they
are binding on the authorities.
However, this does not appear to be the case. In particular, the Court
cannot but note that in the light of the Court of Cassation’s case-law,
authorisation does not have to contain reasoning (see paragraph 27 above). It
follows that the authorities are not required to justify the exercise of their
powers by giving reasons for their decisions and thereby showing that they
are following the criteria laid down in the relevant domestic provisions,
including the administrative circulars, resulting in them exercising unfettered
discretion (see Bernh Larsen Holding AS and Others, cited above, § 130).
82. In the light of the above, the Court considers that the legal basis for
the contested measures was incapable of sufficiently delimiting the scope of

22

FERRIERI AND BONASSISA v. ITALY JUDGMENT

discretion conferred on the domestic authorities, and accordingly did not meet
the “quality-of-law” requirement under Article 8 of the Convention.

(β) The existence of sufficient procedural safeguards capable of protecting the
applicants against any abuse or arbitrariness
83. The Court must now assess whether domestic law provided for
sufficient procedural safeguards capable of protecting the applicants against
any abuse or arbitrariness.
84. The applicants complained that the Tax Authority had not informed
them of the requests to obtain banking data directly from banking institutions.
In this regard, the Court reiterates its finding that Article 8 cannot be
interpreted as giving all persons who are potentially implicated in such
matters, including the interested taxpayer, a right to prior notice of lawful tax
audits or exchanges of tax-related information (see Othymia Investments
B.V. v. the Netherlands (dec.), no. 75292/10, § 44, 16 June 2015). Nor may
such a right be inferred from European Union law as interpreted by the CJEU,
in circumstances in which it may be applicable in situations that have a
cross-border nature or where mutual assistance between authorities is
requested (see paragraphs 41-42 above).
85. As regards the applicants’ complaint that the contested measures had
not been subjected to ex ante judicial or independent scrutiny, the Court notes
that in the instant case, under domestic law, prior judicial authorisation was
not required. In particular, the domestic legal framework required that the
measures be authorised by the central director of assessment of the Tax
Authority or its regional director, or by the regional head of the Revenue
Police (see paragraphs 7 and 9 above).
86. The Court finds that considerations of efficiency in the field of
taxation (see Bernh Larsen Holding AS and Others, cited above, § 130) and
the need to not jeopardise the purpose of the contested measures
(see Italgomme Pneumatici S.r.l. and Others, cited above, § 122) might
justify the lack of ex ante judicial or independent review. However, in this
context, the Court must assess whether there were other effective and
adequate safeguards against abuse and arbitrariness, notably a subsequent
independent or judicial review (see paragraphs 73-74 above).
87. In particular, and taking into account the applicants’ complaints, the
Court must assess whether the contested measures were subjected to an
ex post judicial or independent review. It will therefore examine whether the
remedies relied on by the Government – a complaint to the tax courts, a
complaint to the civil courts, and a complaint to the Taxpayer’s
Guarantor – complied with the requirements imposed under the Convention.

‒ Complaint to the tax courts
88. As regards a complaint to the tax courts, the Court notes that under
Article 19 § 2 of Decree no. 546/1992 (see paragraph 11 above), authorisation

23

FERRIERI AND BONASSISA v. ITALY JUDGMENT

to access a taxpayer’s banking data is not an act that can be challenged
independently before the tax courts. As clarified in the domestic case-law,
such authorisation cannot be challenged independently before the tax courts
because it is considered to be a mere preparatory act (see paragraph 26-27
above).
89. The Court takes note of the case-law submitted by the Government,
according to which where the measures at issue in the present case lead to a
tax assessment notice, the taxpayer in question is allowed to challenge the
authorisation to consult his or her bank account before the tax courts. In
particular, as such authorisation is considered to be a preparatory act whose
unlawfulness affects the validity of the tax assessment notice, the taxpayer is
allowed to raise his or her complaints against the act authorising the
consultation of his or her bank data by challenging the tax assessment notice
under Article 19 § 2 of Decree no. 546/1992 (see paragraph 29 above).
90. Having carefully examined the material submitted to it, the Court is
not persuaded by the Government’s argument that this would amount to an
effective ex post judicial remedy within the meaning of its case-law
(see Italgomme Pneumatici S.r.l. and Others, cited above, § 126, which
concerns a different context – access to and inspection of business premises).
91. Firstly, the domestic case-law clarified that an act authorising the
contested measures did not have to contain reasons (see paragraph 27 above),
and that the validity of a tax assessment notice could not be affected by an
irregularity (see paragraph 30 above) or even by a lack of authorisation
(see paragraph 31 above). In addition, the Government did not provide any
case- law examples where such a remedy – challenging authorisation – had
been used successfully. Taking these factors into account, the Court does not
see how authorisation could be found to affect the lawfulness of a tax
assessment notice.
92. Secondly, the Government observed that the availability of such a
remedy would depend on whether the measures in question had led to the
issuance of a tax assessment notice which was challenged by the taxpayer,
and whether that notice was based on evidence obtained by consulting a bank
account. Therefore, the Court finds that the existence of and accessibility to
such a remedy is uncertain and may only exist at some point in the future
(see Société Canal Plus and Others v. France, no. 29408/08, § 40,
21 December 2010).
93. Lastly, under Article 57 of Decree no. 633/1972 (see paragraph 8
above) and Article 43 of Decree no. 600/1973 (see paragraph 10 above), a tax
assessment notice can be issued several years after the filing of a tax return
or the moment when a tax return should have been filed. In this regard, the
Court reiterates that an effective remedy must become available within a
reasonable period of time (see, mutatis mutandis, Compagnie des gaz de
pétrole Primagaz v. France, no. 29613/08, § 28, 21 December 2010, and
Société Canal Plus and Others, cited above, § 40), and considers that a

24

FERRIERI AND BONASSISA v. ITALY JUDGMENT

remedy which would (possibly) become available after several years cannot
be considered to be sufficiently prompt (see Italgomme Pneumatici S.r.l.
and Others, cited above, § 129).
94. The above is sufficient to conclude that a complaint to the tax courts
would not amount to an effective ex post judicial remedy. There is therefore
no need for the Court to examine whether the domestic legal framework
provided for appropriate and sufficient redress in the event of a finding of an
irregularity. In any case, the Court reiterates that the question of whether
redress is appropriate and sufficient has generally been considered to be
dependent on all the circumstances of the case, having regard, in particular,
to the nature of the Convention violation at stake (see, in a different context,
Gäfgen v. Germany [GC], no. 22978/05, § 116, ECHR 2010, and Contrada
v. Italy (no. 4), no. 2507/19, §§ 55 and 62-65, 23 May 2024).

‒ Complaint to the civil courts
95. As regards a complaint to the civil courts, the Court notes that the
Government mentioned such a remedy without referring to any case-law
example where its availability and accessibility had been envisaged by the
Court of Cassation, or where it had been used successfully before the lower
courts.
96. In this regard, the Court reiterates that only remedies which are likely
to provide redress for an applicant’s complaints need to be taken into account.
In particular, the existence of such remedies must be sufficiently certain, not
only in theory but also in practice, failing which they will lack the requisite
accessibility and effectiveness. Furthermore, it falls to the respondent State
to establish that these conditions are satisfied (see Janosevic v. Sweden (dec.),
no. 34619/97, 26 September 2000).
97. In the present case, notwithstanding the applicants’ objection
regarding the effectiveness of such a remedy, the Government failed to show,
with reference to demonstrably established consistent case-law in cases
similar to those of the applicants, that the remedy was sufficiently certain not
only in theory but also in practice, and offered at least some prospects of
success (see Mikolajova v. Slovakia, no. 4479/03, § 34, 18 January 2011, and
Brazzi v. Italy, no. 57278/11, § 49, 27 September 2018).
98. In any event, even assuming that the remedy of a complaint to the civil
courts did exist in practice, in the present case, where the applicable domestic
provisions did not require that there be any reasons given for the contested
measures prior to such measures being implemented, the Court does not see
what kind of scrutiny those courts would have been able to ensure.
99. In the light of the above, the Court concludes that the Government
have failed to demonstrate the existence in practice of the remedy in question,
and that in any case, such a remedy would not have been effective within the
meaning of Article 8 of the Convention.

25

FERRIERI AND BONASSISA v. ITALY JUDGMENT

‒ Complaint to the Taxpayer’s Guarantor
100. As regards a complaint to the Taxpayer’s Guarantor under section 13
of Law no. 212/2000 (see paragraph 12 above), the Court notes that as stated
in judgment no. 25212 of 24 August 2022 of the Court of Cassation
(see paragraph 32 above), that authority does not issue binding decisions, but
merely makes recommendations to the tax authorities.
101. The Court reiterates that the powers and procedural guarantees an
authority possesses are relevant in determining whether a remedy is effective
(see Tagayeva and Others v. Russia, nos. 26562/07 and 6 others, § 620,
13 April 2017, and Centre for Legal Resources on behalf of Valentin
Câmpeanu v. Romania [GC], no. 47848/08, § 149, ECHR 2014). Therefore,
it is imperative that the remedy should be before a body which, while not
necessarily judicial, is independent of the executive and ensures the fairness
of the proceedings, offering, in so far as possible, an adversarial process. The
decisions of such an authority shall be reasoned and legally binding
(see, mutatis mutandis, Centrum för rättvisa v. Sweden [GC], no. 35252/08,
§ 273, 25 May 2021; Big Brother Watch and Others v. the United Kingdom
[GC], nos. 58170/13 and 2 others, § 359, 25 May 2021; and Segerstedt-
Wiberg and Others v. Sweden, no. 62332/00, § 120, ECHR 2006‑VII).
102. Therefore, the Court finds that a complaint to the Taxpayer’s
Guarantor – a body which merely supervises the activity of the tax authorities
and cannot issue binding decisions – would not constitute an effective remedy
for the purpose of the guarantees against arbitrariness demanded by Article 8
of the Convention.

(iii) Overall conclusions
103. In the light of the above, the Court finds that the contested measures
were not subjected to an effective ex post judicial or independent review.
104. For the above reasons, the Court dismisses the Government’s
preliminary objection based on the non-exhaustion of domestic remedies.
105. The Court concludes that even if there could be said to be a general
legal basis for the impugned measures in Italian law, that law does not meet
the quality requirements imposed under the Convention. In particular, even
taking into account the Contracting States’ broad margin of appreciation in
respect of bank data, that is to say purely financial information (see paragraph
58 above), and the importance of the aim of similar measures in the field of
taxation (see paragraph 73 above), the Court considers that the domestic legal
framework afforded the domestic authorities unfettered discretion with regard
to both the conditions in which the contested measures could be implemented
and the scope of those measures. At the same time, that framework did not
provide sufficient procedural safeguards, as the contested measures were not
subjected to a judicial or independent review. Therefore, the domestic legal
framework did not provide the applicants with the minimum degree of

26

FERRIERI AND BONASSISA v. ITALY JUDGMENT

protection to which they were entitled under the Convention. The Court finds
that in these circumstances, it cannot be said that the interferences in question
were “in accordance with the law” as required by Article 8 § 2 of the
Convention.
106. There has accordingly been a violation of Article 8 of the
Convention.
107. Having regard to the above conclusion, the Court does not consider
it necessary to review compliance with the other requirements of Article 8 § 2
(see De Tommaso, § 127, and Brazzi, § 51, both cited above).

III. OTHER ALLEGED VIOLATIONS OF THE CONVENTION

108. The applicants further complained that the absence of an effective
judicial remedy to complain of interferences with the right to respect for their
private life violated their right of access to justice under Article 6 § 1 and
Article 13 of the Convention.
109. Having regard to the facts of the case, the submissions of the parties
and its findings above (see paragraphs 103 and 105), the Court considers that
it has dealt with the main legal questions raised by the case and that there is
no need to examine the admissibility and merits of the remaining complaints
(see Centre for Legal Resources on behalf of Valentin Câmpeanu,
cited above, § 156).

IV. APPLICATION OF ARTICLE 46 OF THE CONVENTION

110. The relevant parts of Article 46 of the Convention read:
“1. The High Contracting Parties undertake to abide by the final judgment of the Court
in any case to which they are parties.
2. The final judgment of the Court shall be transmitted to the Committee of Ministers,
which shall supervise its execution ...”
111. Under Article 46 §§ 1 and 2 of the Convention, a judgment in which
the Court finds a violation of the Convention or its Protocols imposes on the
respondent State a duty to choose, subject to supervision by the Committee
of Ministers, the general and/or, if appropriate, individual measures to be
taken in its domestic legal order to end the violation and make all feasible
reparation for its consequences by restoring as far as possible the situation
which would have obtained if it had not taken place. Furthermore, it follows
from the Convention, and from its Article 1 in particular, that in ratifying the
Convention and its Protocols the Contracting States undertake to ensure that
their domestic law is compatible with them (see, among other authorities,
Maestri v. Italy [GC], no. 39748/98, § 47, ECHR 2004-I, and Ekimdzhiev and
Others v. Bulgaria, no. 70078/12, § 427, 11 January 2022). With a view to
helping the respondent State to fulfil its obligations under Article 46, the
Court may seek to indicate the type of individual and/or general measures that

27

FERRIERI AND BONASSISA v. ITALY JUDGMENT

might be taken in order to put an end to the situation it has found to exist
(see Stanev v. Bulgaria [GC], no. 36760/06, § 255, ECHR 2012, with further
references).
112. In the present case, the Court is of the view that the shortcomings
identified are liable to give rise to further justified applications in the future
(see, mutatis mutandis, N. v. Romania (no. 2), no. 38048/18, § 84,
16 November 2021). Since the breach of Article 8 found in this case appears
to be of a systemic character, in the sense that it resulted from the content of
the relevant domestic law, as interpreted and applied by the domestic courts,
it seems appropriate for the Court to give some indications on how breaches
of this kind are to be avoided in the future (see Stoyanova v. Bulgaria,
no. 56070/18, § 78, 14 June 2022).
113. For these reasons, in the light of its findings of a violation of Article 8
of the Convention (see paragraph 105 above), the Court finds it crucial that
the respondent State adopt the appropriate general measures with a view to
bringing its legislation and practice into line with the Court’s findings. In
particular, the Court considers that the following issues must be clearly
regulated in the domestic legal framework.
114. First, the domestic legal framework, if necessary by means of
relevant administrative practice directions, should indicate the circumstances
in which and conditions on which the domestic authorities are allowed to have
access to taxpayers’ banking data (see paragraph 71 above). The stringency
of the criteria imposed by the law can take into account that in the field of
taxation, the conditions laid down in the applicable legislative provisions may
be wider and generic, provided that they are subsequently specified and
clarified in other instruments of lower rank or in the relevant domestic
case- law (see paragraph 79 above), as appears to be the case (see
paragraph 81 above). However, the domestic legal framework must oblige
the authorities to respect those conditions, provide reasons for such measures
and accordingly justify the measures in the light of such criteria (see
paragraph 81 above).
115. Secondly, the domestic legal framework should provide for an
effective judicial or independent review of such measures, and in particular a
review of the domestic authorities’ compliance with the criteria and
restrictions concerning the conditions justifying those measures and their
scope (see paragraph 73 above). The Court, having noted the various
restrictions on the jurisdiction of the tax courts and the civil courts, as well as
the inability of the Taxpayer’s Guarantor to issue binding decisions
(see paragraphs 91-94, 97-99 and 102 above), considers that the existence and
availability of such remedies should not be conditional on whether a measure
has led to the issuing of a tax assessment notice (see paragraph 92 above), nor
should they become available only when tax assessment proceedings have
been concluded (see paragraph 93 above). A judicial or independent

28

FERRIERI AND BONASSISA v. ITALY JUDGMENT

authority’s powers to determine the consequences of any breach must also be
defined by law (see paragraph 114 above).
116. Thirdly, such a regulatory framework should take into account the
context of international cooperation between tax authorities. The law should
be framed with a view to considering the interests of the authorities in
disclosing and having access to bank details in order to allow a third country
to assess whether a taxpayer has complied with his or her tax obligations
abroad (see paragraph 12 above).
117. The Court considers that some of the necessary measures are already
provided for in the domestic legislation, in particular section 13 of
Law no. 212/2000 (see paragraph 12 above), but the general principles
affirmed in this legislation need to be implemented by means of specific rules
in the domestic statute law, while the case-law should be brought in line with
these principles and those established by the Court (see, mutatis mutandis,
Italgomme and Others, cited above, § 147).

V. APPLICATION OF ARTICLE 41 OF THE CONVENTION

118. Article 41 of the Convention provides:
“If the Court finds that there has been a violation of the Convention or the Protocols
thereto, and if the internal law of the High Contracting Party concerned allows only
partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the
injured party.”

A. Damage

119. The applicants claimed compensation for the non-pecuniary damage
they had suffered and asked the Court to determine the amount it deemed to
be appropriate.
120. The Government submitted that the applicants’ claim was
unsubstantiated and should therefore be dismissed.
121. Having regard to the circumstances of the case, the Court considers
that the finding of a violation is sufficient to compensate for the
non-pecuniary damage sustained.

B. Costs and expenses

122. The applicants did not submit any claim in respect of costs and
expenses. Accordingly, the Court makes no award.

FOR THESE REASONS, THE COURT,

1. Decides, unanimously, to join the applications;

29

FERRIERI AND BONASSISA v. ITALY JUDGMENT

2. Decides, by five votes to two, to join the preliminary objections
concerning non-exhaustion of domestic remedies to the merits, and
dismisses them;

3. Declares, by five votes to two, the complaint concerning Article 8 of the
Convention admissible;

4. Holds, by five votes to two, that there has been a violation of Article 8 of
the Convention;

5. Holds, by five votes to two, that there is no need to examine the
complaints under Article 6 § 1 and Article 13 of the Convention;

6. Holds, by five votes to two, that the finding of a violation constitutes in
itself sufficient just satisfaction for any non-pecuniary damage sustained
by the applicants.

Done in English, and notified in writing on 8 January 2026, pursuant to
Rule 77 §§ 2 and 3 of the Rules of Court.

Ilse Freiwirth Ivana Jelić
Registrar President

In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the
Rules of Court, the separate opinion of Judges Krenc and Adamska-Gallant
is annexed to this judgment.

30

FERRIERI AND BONASSISA v. ITALY JUDGMENT - SEPARATE OPINION

JOINT DISSENTING OPINION OF JUDGES KRENC AND
ADAMSKA-GALLANT
1. Regrettably, we are unable to agree with the present judgment as
regards the approach taken by our esteemed colleagues to the admissibility of
the applications. We are of the view that the applicants did not exhaust
domestic remedies in the present case and that both applications should
therefore have been declared inadmissible.
2. We cannot but note that the applicants brought their case directly to
Strasbourg after being notified by their banks of the requests received from
the Tax Authority to provide information relating to their banking data. The
applicants did not use any remedy at the domestic level before applying to
the Court, nor make any attempt to do so. They took no steps whatsoever
before the national authorities. The Court was therefore invited to act as a
court of first instance.
This is, in our view, incompatible with the subsidiary character of the
Court’s supervision. Our review cannot pre-empt that which the domestic
authorities are called upon to carry out. Subsidiarity lies at the very heart of
the Convention system: domestic authorities are best placed to address
alleged violations first, being closer to individuals and to reality, and the
Court may only intervene when domestic authorities have failed to provide
the minimum protection required by the Convention. This balance is essential
for preserving both the effectiveness of the Convention and respect for States’
sovereignty.
3. In the case at hand, it is particularly striking that the first applicant
lodged his application with the Court barely eight days after receiving the
notification in issue, and that the second applicant did so two weeks after
receiving a similar notification.
Are we to accept that any taxpayer who receives such a notification can
bring his or her case directly to the Court in the same way? With all due
respect, we do not believe this is the correct approach.
4. Recently, in other circumstances, the Court showed a strong
commitment to the principle of subsidiarity and to the corresponding
requirement of exhaustion of domestic remedies, whether in the context of
the pandemic (see Communauté genevoise d’action syndicale (CGAS)
v. Switzerland [GC], no. 21881/20, 27 November 2023), climate change
(see Duarte Agostinho and Others v. Portugal and 32 Others (dec.) [GC],
no. 39371/20, 9 April 2024) or migration (see Mansouri v. Italy (dec.) [GC],
no. 63386/16, 29 April 2025).
In our view, a coherent approach should have led the Court to reject the
present applications in favour of a prior examination of the issues at stake at
the domestic level.
5. We are not persuaded by the majority’s stance that a remedy before the
civil courts would have been ineffective in the present situation. In particular,

31

FERRIERI v. ITALY JUDGMENT - SEPARATE OPINION

we fail to see how the fact that the authorisation to access a taxpayer’s
banking data did not have to contain reasons (see paragraph 97 of the present
judgment) would prevent domestic judges from examining the applicants’
complaint under Article 8 of the Convention. On the contrary, this constitutes
the crux of the complaint (namely the excessively broad scope of the
discretion enjoyed by the domestic authorities and the lack of sufficient
procedural safeguards). To be honest, we do not understand the link being
made here.
The judgment notes that the Government have not provided any examples
of domestic case-law concerning the complaints raised by the applicants (see
paragraphs 94-96 of the present judgment). It would appear, however,
difficult to provide examples of case-law if applicants fail to bring their cases
before the domestic courts and choose to apply directly to the Court (see,
mutatis mutandis, Casarini v. Italy, no. 25578/11, §§ 100-05,
5 November 2024).
We consider that the applicants should at least have tried to give the
domestic courts the opportunity which the rule of exhaustion of domestic
remedies is designed to afford States, namely, to determine the issue of the
compatibility of the impugned national measures with the Convention. In the
present case, the applicants failed to take appropriate steps to enable the
national courts to fulfil their fundamental role in the Convention protection
system, the Court’s role being subsidiary to theirs. As a result, we lose the
benefit of the findings and assessments of the national courts, which are of
crucial importance in our review (see Duarte Agostinho and Others, cited
above, § 226).
What is more, in the absence of any proceedings before them, the Italian
courts have had no opportunity to examine – whether on the basis of the
parties’ submissions or of their own motion – any issue relating to the
application and interpretation of EU law provisions (in particular, the General
Data Protection Regulation (Regulation (EU) 2016/679)), seeking, where
appropriate, a preliminary ruling from the CJEU (see, mutatis mutandis,
Mansouri, cited above, § 115). The Court’s review must remain secondary to
that of national courts and to the Court of Justice of the European Union,
which serves as a constitutional court within an integrated legal order.
6. To conclude, we firmly believe that the principle of subsidiarity cannot
be understood as the Court relinquishing its fundamental mission. It is not
intended to curtail or limit the Court’s review – this point deserves to be made
with absolute clarity. It is rather to underscore, through the requirement of
exhaustion of domestic remedies, the primary role of national authorities in
ensuring compliance with the Convention.

32