Ferrieri and Bonassisa v. Italy (application no. 40607/19 and 34583/20))

 

In the  Judgment of 8 January 2026, the European Court of Human Rights, in the case law related to the application of

Art 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms • Private life • Access and examination of applicants’ banking data, including bank account information, transaction histories, and other financial operations related to or traceable to them, by the Tax Authority for tax audit purposes • “Quality of law” requirements not met • Legal framework afforded domestic authorities unfettered discretion with regard to contested measures’ scope and conditions • Lack of sufficient procedural safeguards • Contested measures not subject to an effective ex post judicial or independent review • Interferences “not in accordance with the law”; and 

Art 46 • General measures • Systemic problem • Respondent State to bring its legislation and practice into line with Court’s findings • Need for specific rules in domestic law, indicating circumstances in which and conditions on which the domestic authorities were allowed to have access to taxpayers’ banking data, providing for effective judicial or independent review, and taking into account the context of international cooperation between tax authorities; 

held that the finding of a violation constituted in itself sufficient just satisfaction for any non-pecuniary damage sustained by the applicants.

The case concerns measures implemented by the Tax Authority (Agenzia delle Entrate) for tax audit purposes, including access to and the examination of the applicants’ banking data, bank account information, transaction histories, and details of other financial operations either related to the applicants or traceable to them.

Relying on Articles 8 (right to respect for private life), taken alone and in conjunction with Article 13 (right to an effective remedy) and Article 6 § 1 (right to a fair trial) of the European Convention on Human Rights, Mr Ferrieri and Ms Bonassisa complain that the national legislation gave the authorities excessive scope to decide on access to taxpayers’ banking data. They also complain of the lack of sufficient procedural safeguards to protect them against any abuse or arbitrariness, in particular the lack of judicial or independent review of the contested measures.

The Court concluded as follows:

"103. In the light of the above, the Court finds that the contested measures were not subjected to an effective ex post judicial or independent review. 104. For the above reasons, the Court dismisses the Government’s preliminary objection based on the non-exhaustion of domestic remedies.

105. The Court concludes that even if there could be said to be a general legal basis for the impugned measures in Italian law, that law does not meet the quality requirements imposed under the Convention. In particular, even

taking into account the Contracting States’ broad margin of appreciation in respect of bank data, that is to say purely financial information (see paragraph 58 above), and the importance of the aim of similar measures in the field of taxation (see paragraph 73 above), the Court considers that the domestic legal framework afforded the domestic authorities unfettered discretion with regard to both the conditions in which the contested measures could be implemented and the scope of those measures. At the same time, that framework did not provide sufficient procedural safeguards, as the contested measures were not subjected to a judicial or independent review. Therefore, the domestic legal framework did not provide the applicants with the minimum degree of  protection to which they were entitled under the Convention. The Court finds that in these circumstances, it cannot be said that the interferences in question were “in accordance with the law” as required by Article 8 § 2 of the Convention.

106. There has accordingly been a violation of Article 8 of the Convention.

107. Having regard to the above conclusion, the Court does not consider it necessary to review compliance with the other requirements of Article 8 § 2 (see De Tommaso, § 127, and Brazzi, § 51, both cited above)".

Firm news

feb9

09/02/2026

Accessing a dismissed employee's company email account can violate privacy laws and data protection regulations

According to the Italian Data Protection Authority, the content of emails, contact data related to communications, and any attachments fall within the notion of correspondence. Therefore emails are  protected

feb6

06/02/2026

Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act

The Commission has proposed a new cybersecurity package to further strengthen the EU's cybersecurity resilience and capabilities. The package introduces measures to simplify compliance with

feb6

06/02/2026

Proposal for a Regulation for the Digital Networks Act (DNA)

The Commission proposes the Digital Networks Act (DNA), which offers a modern, simplified, and harmonised legal framework to bolster Europe's competitiveness. By strengthening digital networks,