CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 8 janvier 2026

.s800EAC49 { font-size:12pt } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .sBB9EE52A { font-family:Arial } .sA7F61D3B { margin-top:30pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .s34DFC730 { margin-top:0pt; margin-bottom:0pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s780F5245 { border:0.75pt solid #000000; clear:both } .s795B4A6B { margin-top:0pt; margin-bottom:0pt; text-align:justify; padding-top:1pt; padding-right:4pt; padding-left:4pt; font-size:11pt } .sA57875D8 { margin-top:0pt; margin-bottom:0pt; text-align:justify; padding-right:4pt; padding-left:4pt; font-size:11pt } .sD37EA1D6 { margin-top:0pt; margin-bottom:0pt; text-align:center; padding-right:4pt; padding-left:4pt; padding-bottom:1pt; font-size:9pt } .s59272B2C { margin-top:0pt; margin-bottom:6pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .s598389F7 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:10pt } .sE208486F { font-family:Arial; color:#ff0000 } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sA43C3626 { width:28.35pt; font-family:Arial; display:inline-block } .s3AAE10DF { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .s71220C2D { margin-top:0pt; margin-left:18.45pt; margin-bottom:12pt; text-indent:-18.45pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s3936C9DD { width:11.78pt; font:7pt 'Times New Roman'; display:inline-block } .sDBF374D0 { margin-top:0pt; margin-left:25.5pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s5BDECA8 { width:5pt; font:7pt 'Times New Roman'; display:inline-block } .s9D48DD53 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .s3BF0B6C7 { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s3A692EA6 { margin-top:14pt; margin-bottom:6pt; text-align:center; page-break-after:avoid; font-size:10pt } .s3F0D5878 { width:5.66pt; font:7pt 'Times New Roman'; display:inline-block } .s4DDA3AA3 { font-family:Arial; font-weight:bold; font-style:italic } .sD0A217A5 { margin-top:14pt; margin-left:18.45pt; margin-bottom:12pt; text-indent:-18.45pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sBB64854C { width:8.45pt; font:7pt 'Times New Roman'; display:inline-block } .sE8F2C496 { width:5.11pt; font:7pt 'Times New Roman'; display:inline-block } .s6B38CF35 { margin-top:0pt; margin-left:34pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s54B12A03 { width:6.99pt; font:7pt 'Times New Roman'; display:inline-block } .s7C9EDFAD { margin-top:14pt; margin-left:34pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sAB798EC2 { width:3.78pt; font:7pt 'Times New Roman'; display:inline-block } .s7ED160F0 { text-decoration:none } .s33165EBA { font-family:Arial; font-size:8pt; vertical-align:super; color:#0069d6 } .sD62BB3FA { width:7.11pt; font:7pt 'Times New Roman'; display:inline-block } .sDD998142 { margin-top:14pt; margin-left:17pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s6B505E72 { margin:0pt; padding-left:0pt } .sDECD9755 { margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.78pt; font-family:Arial; text-transform:uppercase } .s1B1D10B4 { margin-top:14pt; margin-left:19.85pt; margin-bottom:12pt; text-indent:-19.85pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s7B868B6A { width:9.85pt; font:7pt 'Times New Roman'; display:inline-block } .sF54F3725 { margin-top:0pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sDBC81028 { width:4.83pt; font:7pt 'Times New Roman'; display:inline-block } .s65DDED6B { margin-top:14pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s7AE800C3 { width:4.28pt; font:7pt 'Times New Roman'; display:inline-block } .s599F5480 { margin-top:0pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s3970C00F { width:8.17pt; font:7pt 'Times New Roman'; display:inline-block } .s4B52A9A9 { margin-top:14pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s320E5A8E { width:5.95pt; font:7pt 'Times New Roman'; display:inline-block } .sFABD3260 { margin-top:14pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-19.8pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s16F6432D { width:7.9pt; font:7pt 'Times New Roman'; display:inline-block } .sFF8BF293 { width:8.05pt; font:7pt 'Times New Roman'; display:inline-block } .sA6765C01 { margin-top:14pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-11.3pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sFA550501 { width:6.3pt; font:7pt 'Times New Roman'; display:inline-block } .sD051EF8 { width:3.72pt; font:7pt 'Times New Roman'; display:inline-block } .s9119587A { width:8.51pt; font:7pt 'Times New Roman'; display:inline-block } .s448F0C15 { margin-top:14pt; margin-left:18pt; margin-bottom:12pt; text-indent:-18pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s74818F78 { margin-top:14pt; margin-bottom:3pt; text-align:justify; font-family:Arial; list-style-position:inside } .sE7B3A78A { width:1.99pt; font:7pt 'Times New Roman'; display:inline-block } .sFBC99493 { font-style:italic } .sB7908EED { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:6.29pt; font-family:Arial } .sD11CFAB7 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:1.99pt; font-family:Arial } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s69DCC830 { margin-top:36pt; margin-bottom:0pt } .sC986E16F { font-family:Arial; color:#ffffff } .sA7186A9D { width:36.9pt; font-family:Arial; display:inline-block } .s7B051ABA { width:164.45pt; font-family:Arial; display:inline-block } .s1E019DFF { width:46.56pt; font-family:Arial; display:inline-block } .sA49AD2E4 { width:177.11pt; font-family:Arial; display:inline-block } .sF6A12959 { width:33%; height:1px; text-align:left } .s85226119 { margin-top:0pt; margin-bottom:0pt; text-align:justify; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 } .s3DC36BA9 { font-family:Arial; text-decoration:underline; color:#0069d6 } .fixListIndent { list-style-position: inside } FIRST SECTION CASE OF FERRIERI AND BONASSISA v. ITALY (Applications nos. 40607/19 and 34583/20)   JUDGMENT   Art 8 • Private life • Access and examination of applicants’ banking data, including bank account information, transaction histories, and other financial operations related to or traceable to them, by the Tax Authority for tax audit purposes • “Quality of law” requirements not met • Legal framework afforded domestic authorities unfettered discretion with regard to contested measures’ scope and conditions • Lack of sufficient procedural safeguards • Contested measures not subject to an effective ex post judicial or independent review • Interferences “not in accordance with the law” Art 46 • General measures • Systemic problem • Respondent State to bring its legislation and practice into line with Court’s findings • Need for specific rules in domestic law, indicating circumstances in which and conditions on which the domestic authorities were allowed to have access to taxpayers’ banking data, providing for effective judicial or independent review, and taking into account the context of international cooperation between tax authorities   Prepared by the Registry. Does not bind the Court.   STRASBOURG 8 January 2026   FINAL   11/05/2026   This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Ferrieri and Bonassisa v. Italy, The European Court of Human Rights (First Section), sitting as a Chamber composed of:   Ivana Jelić , President ,   Erik Wennerström,   Raffaele Sabato,   Frédéric Krenc,   Davor Derenčinović,   Alain Chablais,   Anna Adamska-Gallant , judges , and Ilse Freiwirth, Section Registrar, Having regard to: the applications (nos.   40607/19 and 34583/20) against the Italian Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Italian nationals, Mr Matteo Ferrieri and Mrs Ornella Bonassisa (“the applicants”), on 23 July 2019 and 1 August 2020 respectively; the decision to give notice of the applications to the Italian Government (“the Government”); the parties’ observations; Having deliberated in private on 2 December 2025, Delivers the following judgment, which was adopted on that date: INTRODUCTION 1.     The case concerns access to and the examination of the applicants’ banking data, including bank account information, transaction histories, and details of other financial operations either related to the applicants or traceable to them. Those measures (hereinafter “the contested measures”) were implemented by the Tax Authority ( Agenzia delle Entrate ) for tax audit purposes. The applicants complained of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex   post judicial or independent review of the contested measures. THE FACTS 2.     The first applicant (application no. 40607/19), Mr M. Ferrieri, was born in 1965 and lives Cerignola. He was represented by Mr C. Stasi, a lawyer practicing in Foggia. The second applicant (application no.   34583/20), Mrs   O. Bonassisa, was born in 1977 and lives in Foggia. She is an accountant representing herself before the Court. 3.     The Government were represented by their Agent, Mr   L.   D’Ascia, Avvocato dello Stato . 4.     The facts of the case may be summarised as follows. 5.     On 15 July 2019 the first applicant and on 16 July 2020 the second applicant were notified by their banks that the banks had received requests from the Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them, for a specified period of time, in respect of the first applicant from 1 January to 31 December 2017 and in respect of the second applicant from 1 January 2016 to 31 December 2017. The banks informed the applicants that they were going to comply with their legal obligation to provide the requested information. 6.     The authorisation to obtain such data directly from banking institutions had been issued by directors of the Tax Authority under Article 51 § 2 (7) of Presidential Decree no. 633 of 26 October 1972 (“Decree no.   633/1972”, see   paragraph 7 below) and Article 32 § 1 (7) of Presidential Decree no.   600 of 29 September 1973 (“Decree no.   600/1973”, see paragraph 9 below). RELEVANT LEGAL FRAMEWORK AND PRACTICE I.         DOMESTIC LAW A.    Presidential Decree no. 633 of 26 October 1972 (Establishment and regulation of value-added tax) 7 .     The measures at issue in the present case are regulated by Article   51 of Decree   no. 633/1972, as in force at the relevant time, which reads as follows: “1.     The value-added tax offices check the declarations submitted and the payments made by taxpayers, detect any omissions and proceed to the assessment and collection of the taxes or additional taxes due; they supervise compliance with the obligations relating to the invoicing and registration of transactions, the keeping of accounting records, and the other obligations set out in this Decree; [and] they impose fines and surcharges and submit reports to the judicial authorities for violations sanctioned under criminal law. The appropriate risk analysis activities are carried out to check the declarations submitted and identify the persons who have failed to submit them. 2.     For the purpose of carrying out their functions [as set out in the previous paragraph], the tax offices can: ... (7)     having obtained prior authorisation from the central director of assessment of the Tax Authority or its regional director, or, as concerns the Revenue Police, from [the] regional head [of the Revenue Police], request that banks provide ... data, information and documents relating to any [financial] relationship or transactions ..., including services rendered, [involving] their clients, as well as the guarantees given by third parties or the financial operators mentioned above, and the particulars of the persons for whom the same financial operators have carried out the above-mentioned transactions ... The request should be addressed to the head of the centralised structure or the head of the office [which receives the request], who shall immediately notify the person concerned; the relevant response must be sent to the head of the office [which has initiated the proceedings]. ... 4.     Requests under paragraph 2 point (7), as well as the relevant responses, even if negative, shall be submitted exclusively by electronic means. A provision of the Director of the Revenue Agency shall lay down the implementing provisions and the procedures for transmitting the requests [and] replies, as well as the data and information concerning the relationships and transactions indicated in point (7) above.” 8 .     Article 57 establishes the time-limits for issuing a tax assessment notice finding that a taxpayer failed to comply with the relevant tax obligations in a specific fiscal year. Its first paragraph, as in force at the relevant time, provides that the taxpayer must be notified of the assessment by 31   December   of the fifth year following the year in which the tax declaration was filed. The second paragraph states that in the event of a complete omission to file a declaration, the taxpayer can be notified of the tax assessment by 31   December of the seventh year following the year in which the declaration should have been filed. B.    Presidential Decree no. 600 of 29 September 1973 (Common provisions concerning the assessment of income taxes) 9 .     Article 32 § 1 (7) of Decree no. 600/1973, concerning the assessment of income taxes, reproduces the provision set out in Article 51 § 2 (7) of Decree no. 633/1972 in relation to the assessment of value-added tax (VAT) (see paragraph 7 above). 10 .     Article 43 reiterates the same time-limits for issuing a tax assessment notice as those set out in Article 57 of Decree no. 633/1972 (see paragraph   8 above). C.    Legislative Decree no. 546 of 31 December 1992 (Provisions concerning tax judicial proceedings) 11 .     Article 19 of Decree no. 546/1992, as in force at the material time, included an exhaustive list of the acts that could be challenged before the tax courts. Its relevant parts read as follows: Article 19: Acts that can be challenged and the subject of the complaint “1.     Complaints [to the tax courts] can be lodged against: (a)     a tax assessment notice; (b)     a tax liquidation notice; (c)     an order imposing sanctions; (d)     a tax collection notice; ... (i)     any other act which the law expressly states can be challenged independently. ... 2.     Acts other than those expressly provided for cannot be challenged independently. Any act that can be challenged independently may be challenged solely on the basis of its own irregularities ...” D.    Law no. 212 of 27 July 2000 (the Act on Taxpayers’ Rights) 12 .     The relevant provisions of Law no. 212/2000 read as follows: Section 13: Taxpayer’s Guarantor “1.     A Taxpayer’s Guarantor is established at each directorate of revenues in the regions and autonomous provinces. 2.     The Taxpayer’s Guarantor, operating in full autonomy, is an [individual person acting as a] body [who is] chosen and appointed by the president of the regional tax court or its detached section in whose district the regional directorate of the tax authority is based ... 6.     The Taxpayer’s Guarantor addresses requests for documents or clarifications to the competent offices, [and does so] also on the basis of reports submitted in writing by the taxpayer or any other interested party who complains of malfunctions, irregularities, incorrectness, abnormal or unreasonable administrative practices, or any other behaviour likely to undermine the relationship of trust between citizens and the financial administration. [The competent offices] respond within thirty days, and [this] activates the self-correction procedures ( autotutela ) in respect of administrative assessments or collection notices of which the taxpayer has been notified. The Taxpayer’s Guarantor communicates the outcome of the activity carried out to the regional or district directorates [of the tax authorities] or to the area headquarters of the Revenue Police, as well as to supervisory bodies, informing the person who reported [the irregularity]. 7.     The Taxpayer’s Guarantor makes recommendations to tax office managers to protect the taxpayer and organise services in the best way. ...” E.     The power of self-correction ( autotutela ) 13 .     As part of its power of “self-correction” ( autotutela ), a public administrative body can annul or revoke decisions that have already been made, without the intervention of a judicial authority. II.       DOMESTIC PRACTICE 14 .     Over the years, the Tax Authority has issued several administrative circulars aimed at clarifying the conditions under which the power to carry out tax audits of banking data may be exercised, and the procedure to be followed by tax offices for that purpose (see also Italgomme Pneumatici S.r.l. v.   Ital y , nos. 36617/18 and 12 others, §§ 55-59, 6 February 2025). A.    Circular no. 131 of 30 July 1994 15 .     In Circular no. 131 of 30 July 1994 (“Circular no.   131/1994”), the Tax Authority established criteria for selecting taxpayers and investigation methods in relation to checks on income tax and value-added tax. 16 .     In respect of the criteria for carrying out tax audits of banking data, the relevant part of the circular read as follows: “Tax audits of banking data will, in particular, be carried out in respect of -     total or near-total tax evaders; -     persons with no accounting records or with accounting records that are obviously unreliable; -     persons carrying out import-export transactions; -     persons who have issued and/or used invoices for non-existent transactions; [and] -     persons whose financial capacity is clearly in stark contrast to the[ir] declared income.” 17 .     Circular no.   131/1994 further stated that tax offices asking for authorisation to carry out tax audits of banking data “[had to] sufficiently substantiate requests for authorisation to the regional directorates, in order to provide them with useful elements of evaluation”. In particular, a request had to indicate the following elements: “-     the data aimed at identifying the taxpayer; -     the reasons for undertaking the inquiry; -     the elements aimed at assessing the fiscal situation of the taxpayer; -     the reasons for considering that a tax audit of banking data would be useful in respect of the tax inquiry; -     the time period in respect of which the tax audit of banking data should be carried out; -     the banks ... to which the request should be submitted ...;” 18 .     Circular no.   131/1994 clarified that, on the basis of that information, the regional directorates had to check the formal and substantial legality ( controllo sia di legittimità che di merito ) of the request before issuing the requested authorisation. 19 .     As regards a decision to carry out a tax audit of banking data, the circular further stated that the domestic authorities had to undertake a cost ‑ benefit analysis: “It must be stressed that tax audits of banking data should be initiated in cases [where] the fruitfulness of the tax audit [in question] has been assessed. So, on the basis of common experience, the ‘costs’ of the tax audit (represented by the inevitable extension of the inquiry in terms of time and the complexity of the analysis of the accounts) must be weighed against the relative ‘benefits’ of an evidential nature, relating to the presumed size of the recoverable taxable amounts. The principle of economy of action (in terms of cost-benefit) must, moreover, strongly guide all the tax audit activity of the offices.” B.    Circular no. 32/E of 19 October 2006 20.     In Circular no. 32/E of 19 October 2006 (“Circular no. 32/E/2006”), the Tax Authority provided clarifications concerning the powers of tax offices in the context of tax inquiries, including the power to request that banks provide information and data concerning transaction histories and transactions in taxpayers’ bank accounts. 21.     The circular confirmed that authorisation to undertake tax audits of banking data had to be requested in the context of a formalised procedure designed to safeguard taxpayers’ rights and the transparent and impartial exercise of administrative action, in conformity with the principles enshrined in the Act on Taxpayers’ Rights (see paragraph 12 above). C.    Circular no. 25/E of 26 August 2014 22 .     In Circular no. 25/E of 26 August 2014 (“Circular no.   25/E/2014”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2014. 23 .     In respect of tax audits of banking data, the circular read as follows: “With specific regard to ... financial investigations, it is reiterated that [they] must be used only after carefully assessing the risk of significant discrepancies in [a] tax declaration ( significative anomalie dichiarative ), and ideally only when the tax office has already instituted a tax inquiry.” D.    Circular no. 16 of 28 April 2016 24.     In Circular no. 16 of 28 April 2016 (“Circular no. 16/2016”), the Tax Authority established operative guidelines for preventing and combating tax evasion in the year 2016. 25 .     In respect of tax audits of banking data, the circular read as follows: “The use of financial investigations, which should be used only after carefully considering the risk of significant discrepancies in [a] tax declaration, and when the tax office has already instituted a tax inquiry, must be appropriate and designed to obtain credible and reliable assessments.” III.     DOMESTIC CASE-LAW A.    Case-law on authorisation to obtain taxpayers’ banking data 26 .     In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation issued by a director of a tax office to obtain information directly from banks concerning taxpayers’ transaction histories, transactions and other dispositions was an act of a merely internal and procedural nature ( carattere meramente endoprocedimentale ) which could not be challenged independently before the tax courts. 27 .     In judgment no. 8849 of 30 April 2015, the Court of Cassation observed that authorisation did not have to contain reasons, as no such requirement had been imposed under the applicable domestic provisions. The court held that such authorisation was merely an internal administrative act which could not be challenged by the bank that had been asked to provide the information, and the taxpayer concerned did not have to be notified of it. Since the authorisation could not be challenged, in the Court of Cassation’s view, it did not need to include any kind of reasoning. 28.     Similarly, in judgment no. 19564 of 24 July 2018, the Court of Cassation defined authorisation as a “mere preparatory act” ( atto meramente preparatorio ) which served an “organisational function” ( funzione organizzativa ) within the hierarchical structure of offices, but had no effect on a taxpayer. B.    Case-law on ex post remedies 1.      Tax courts 29 .     In judgment no. 14026 of 3 August 2012, the Court of Cassation held that authorisation to obtain taxpayers’ banking data could be challenged by lodging a complaint with the tax courts against a tax assessment notice based on information obtained through such a measure. 30 .     As regards the reasons for challenging authorisation, in judgment no.   17158 of 28 June 2018, the Court of Cassation held that failure to notify a taxpayer of such authorisation could not affect its validity (see also judgment no. 16874 of 21 July 2009 and judgment no. 20420 of 26   September   2014 of the Court of Cassation). Given that authorisation was merely an administrative act issued by the Tax Authority, only a complete lack of such authorisation could be challenged by means of a complaint against a tax assessment notice based on information acquired in the absence of any authorisation, provided that it could be demonstrated that the lack of authorisation had caused specific prejudice to the taxpayer concerned (see judgment no. 14026 of 3 August 2012 and judgment no. 3628 of 10   February   2017 of the Court of Cassation). 31 .     More recently, the Court of Cassation clarified that a tax assessment notice could not be invalidated merely because it was based on banking data obtained in the absence of any authorisation issued by the competent management body. Similarly, a taxpayer would need to demonstrate that the lack of authorisation had caused him or her specific prejudice in relation to a constitutionally protected right or interest (see judgment no. 3242 of 10   February 2021 and judgment no. 10576 of 1 April 2022 of the Court of Cassation). 2.      The Taxpayer’s Guarantor 32 .     In judgment no. 25212 of 24 August 2022, the Court of Cassation clarified, although not in the context of tax audits of banking data but in the context of reimbursement of tax paid in excess of the amount legally due in relation to inheritance matters, that the Taxpayer’s Guarantor could not adopt binding decisions. The Court of Cassation held as follows: “The legal system currently in force does not expressly provide for the Tax Authority or the entities which are entitled to collect taxes being obliged to implement a self-   correction ( autotutela ) measure requested by the Taxpayer’s Guarantor, or to comply with the decisions taken by the Taxpayer’s Guarantor. Indeed, the [decisions] of the Taxpayer’s Guarantor are not binding and therefore do not produce legal effects, but only constitute warnings entailing at most only an obligation to respond to the request for self-correction and/or review the file presented by the taxpayer. Ultimately, the Taxpayer’s Guarantor is not recognised as having any active management powers. [The body] cannot therefore exercise authoritative or sanctioning powers in respect of tax administration offices or, following the activation of a self-correction procedure, replace the tax administration in reviewing any illegitimate [notice]. In this regard, it has been said that the legislation establishing [the Taxpayer’s Guarantor] does not give [that body] the power to cancel tax notices by way of self-correction, nor does it establish a duty for the tax administration to decide [a case] in the manner requested by the Guarantor. According to the most acceptable interpretation, [the legislation] seems to limit itself to giving the Taxpayer’s Guarantor the power to merely initiate the [self-   correction] procedure. However, [once the relevant procedure has been initiated], the tax services would therefore be required to respond to the request of the Taxpayer’s Guarantor by issuing, at the very least, a notice indicating why they do not intend to follow up on [that request].” IV.    EUROPEAN UNION LAW A.    Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC 33.     Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation (the Directive on Administrative Cooperation, “the DAC”) repealed Directive 77/799/ECC in force until then. The DAC has been amended several times, the most recent directive being DAC8 in 2023 [1] . DAC9 has entered into force on 7 May 2025 and must be transposed no later than 31 December 2025. Through the DAC, EU countries can make use of mechanisms like the automatic exchange of information and the exchange of information on request to ensure that foreign income is subject to tax. The automatic exchange of information means the systematic communication of pre-defined information from the tax administration of an EU country to the tax administration of another EU country. The exchange of information comes in three forms – automatic, on-request and spontaneous – that are specific to the type of information to be exchanged. Information is exchanged between one competent authority and another through a secured network, ensuring confidentiality and privacy. 34.     Recital 20 of the DAC reads as follows: “However, a Member State should not refuse to transmit information because it has no domestic interest or because the information is held by a bank, other financial institution, nominee or person acting in an agency or fiduciary capacity or because it relates to ownership interests in a person.” 35.     The relevant provisions of the DAC read as follows: Article 5: Procedure for exchange of information on request “At the request of the requesting authority, the requested authority shall communicate to the requesting authority any information referred to in Article 1(1) that it has in its possession or that it obtains as a result of administrative enquiries.” Article 8: Scope and conditions of mandatory automatic exchange of information “1.     The competent authority of each Member State shall, by automatic exchange, communicate to the competent authority of any other Member State, information regarding taxable periods as from 1 January 2014 that is available concerning residents in that other Member State, on the following specific categories of income and capital as they are to be understood under the national legislation of the Member State which communicates the information: (a)     income from employment; (b)     director’s fees; (c)     life insurance products not covered by other Union legal instruments on exchange of information and other similar measures; (d)     pensions; (e)     ownership of and income from immovable property. ...” Article 18: Obligations “1.     If information is requested by a Member State in accordance with this Directive, the requested Member State shall use its measures aimed at gathering information to obtain the requested information, even though that Member State may not need such information for its own tax purposes. That obligation is without prejudice to paragraphs   2, 3 and 4 of Article 17, the invocation of which shall in no case be construed as permitting a requested Member State to decline to supply information solely because it has no domestic interest in such information. 2.     In no case shall Article 17(2) and (4) be construed as permitting a requested authority of a Member State to decline to supply information solely because this information is held by a bank, other financial institution, nominee or person acting in an agency or a fiduciary capacity or because it relates to ownership interests in a person. 3.     Notwithstanding paragraph 2, a Member State may refuse the transmission of requested information where such information concerns taxable periods prior to 1   January 2011 and where the transmission of such information could have been refused on the basis of Article 8(1) of Directive 77/799/EEC if it had been requested before 11   March 2011.” 36.     Commission Implementing Regulation (EU) 2025/648   of 2   April   2025 on amending Implementing Regulation (EU) 2015/2378 provides standard forms and computerised formats to be used in relation to Council Directive 2011/16/EU as amended by Council Directive   2021/514/EU, specifically setting out when member States have to submit statistical data in relation to information reported by digital platform operators and the types of statistics to be provided in relation to joint audits. B.    Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC 37.     Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General   Data Protection Regulation, “the GDPR”) (OJ   2016 L 119/1) entered into force on 24 May 2016 and has applied since 25 May 2018. 38.     Article 5 of the GDPR establishes the principles relating to processing of personal data, such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Pursuant to Article 13 of the GDPR, data controllers have the obligation to inform a data subject of the collection of their personal data and provide the data subject with certain information relevant thereto as specified in the provision. Article 15 of the GDPR further provides that the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed and, where that is the case, access to the personal data and other relevant information as set out in the provision. 39.     Recital 31 of the GDPR reads as follows: Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, or financial market authorities responsible for the regulation and supervision of securities markets should not be regarded as recipients if they receive personal data which are necessary to carry out a particular inquiry in the general interest, in accordance with Union or Member State law. The requests   for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing.   40.     Within the context of the aforementioned rules, Article 23 provides as follows: Article 23: Restrictions “1.     Union or Member   State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles   12 to 22 and Article   34, as well as Article   5 in so far as its provisions correspond to the rights and obligations provided for in Articles   12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: ... (e)     other important objectives of general public interest of the Union or of a Member   State, in particular an important economic or financial interest of the Union or of a Member   State, including monetary, budgetary and taxation a matters, public health and social security; ...” C.    Case-law of the Court of Justice of the European Union 41 .     In its judgment of 22 October 2013 in Sabou (C ‑ 276/12, EU:C:2013:678), the Grand Chamber of the Court of Justice of the European Union (CJEU) held as follows: “38.     The Court has previously ruled that observance of the rights of the defence is a general principle of European Union law which applies where the authorities are minded to adopt a measure which will adversely affect an individual (see   [Case   C ‑ 349/07   Sopropé   [2008] ECR I ‑ 10369], paragraph 36). [...] 39.     The question arises as to whether the decision of a competent authority of a Member State to request assistance from a competent authority of another Member State and the latter’s decision to examine witnesses for the purposes of responding to that request constitute acts which, because of their consequences for the taxpayer, make it necessary for him to be heard. 40.     All the Member States which submitted observations to the Court argued that a request for information by one Member State sent to the tax authorities of another Member State does not constitute an act giving rise to such an obligation. They rightly consider that, in tax inspection procedures, the investigation stage, during which information is collected and which includes the request for information by one tax authority to another, must be distinguished from the contentious stage, between the tax authorities and the taxpayer, which begins when the taxpayer is sent the proposed adjustment. [...] 46.     Accordingly, the answer to the first and second questions is that European Union law, as it results in particular from Directive 77/799 and the fundamental right to be heard, must be interpreted as not conferring on a taxpayer of a Member State either the right to be informed of a request for assistance from that Member State addressed to another Member State, in particular in order to verify the information provided by that taxpayer in his income tax return, or the right to take part in formulating the request addressed to the requested Member State, or the right to take part in examinations of witnesses organised by the requested Member State.” 42 .     In its judgment of 6 October 2020 in Luxembourg State (C ‑ 245/19 and C-246/19, EU:C:2020:795), the CJEU ruled as follows: “1.     Article 47 of the Charter of Fundamental Rights of the European Union, read in conjunction with Articles 7 and 8 and Article 52(1) thereof, must be interpreted as: –     precluding legislation of a Member State implementing the procedure for the exchange of information on request established by Council Directive 2011/16/EU of 15   February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC, as amended by Council Directive 2014/107/EU of 9   December   2014, which prevents a person holding information from bringing an action against a decision by which the competent authority of that Member State orders that person to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, and as –     not precluding such legislation from preventing the taxpayer concerned, in that other Member State, by the investigation giving rise to that request for exchange of information and the third parties concerned by the information in question from bringing actions against that decision. 2.     Article 1(1) and Article 5 of Directive 2011/16, as amended by Directive   2014/107, must be interpreted as meaning that a decision by which the competent authority of a Member State orders a person holding information to provide it with that information, with a view to following up on a request for exchange of information made by the competent authority of another Member State, is to be considered, taken together with that request, as concerning information which is not manifestly devoid of any foreseeable relevance where it states the identity of the person holding the information in question, that of the taxpayer concerned by the investigation giving rise to the request for exchange of information, and the period covered by that investigation, and where it relates to contracts, invoices and payments which, although not specifically identified, are defined by criteria relating, first, to the fact that they were concluded or carried out by the person holding the information, secondly, to the fact that they took place during the period covered by that investigation and, thirdly, to their connection with the taxpayer concerned.” V.      INTERNATIONAL LAW The Convention on Mutual Administrative Assistance in Tax Matters 43.     The Convention on Mutual Administrative Assistance in Tax Matters was developed jointly by the Organisation for Economic Co-operation and Development (OECD) and the Council of Europe. It was concluded in Strasbourg on 25 January 1988 and amended by the Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters, which entered into force on 1 June 2011. Italy ratified the Convention on 31   January   2006 and the amending Protocol on 17 January 2012. The latter entered into force in respect of Italy on 1 May 2012. 44.     The relevant parts of the Explanatory Report to the 2010 Protocol amending the Convention on Mutual Administrative Assistance in Tax Matters clarified: “1.     The object of this Convention is to promote international co operation for a better operation of national tax laws, while respecting the fundamental rights of taxpayers. ... 6.     In this context, the Convention attempts to reconcile the respective legitimate interests of those involved: in particular, the requirements of mutual international assistance in tax assessment and enforcement, respect for special features of national legal systems, the confidential nature of information exchanged between national authorities and the fundamental rights of taxpayers. 7.     Taxpayers have especially the right to respect for their privacy and the right to a proper procedure in the determination of their rights and obligations in tax matters, including appropriate protection against discrimination and double taxation. 8.     In applying the Convention, tax authorities will be bound to operate within the framework of national laws. The Convention specifically ensures that taxpayers’ rights under national laws are fully safeguarded. However, national laws should not be applied in a manner that undermines the object and purpose of the Convention. In other words, the Parties are expected not to unduly prevent or delay effective administrative assistance.” 45 .     The relevant provisions of the Convention on Mutual Administrative Assistance in Tax Matters read as follows: Article 1: Object of the Convention and persons covered “1.     The Parties shall, subject to the provisions of Chapter IV, provide administrative assistance to each other in tax matters. Such assistance may involve, where appropriate, measures taken by judicial bodies. 2.     Such administrative assistance shall comprise: a.     exchange of information, including simultaneous tax examinations and participation in tax examinations abroad; b.     assistance in recovery, including measures of conservancy; and c.     service of documents. 3.     A Party shall provide administrative assistance whether the person affected is a resident or national of a Party or of any other State.” Article 4: General provision “1.     The Parties shall exchange any information, in particular as provided in this section, that is foreseeably relevant for the administration or enforcement of their domestic laws concerning the taxes covered by this Convention. 2.     Deleted. 3.     Any Party may, by a declaration addressed to one of the Depositaries, indicate that, according to its internal legislation, its authorities may inform its resident or national before transmitting information concerning him, in conformity with Articles 5 and 7.” Article 21: Protection of persons and limits to the obligation to provide assistance “1.     Nothing in this Convention shall affect the rights and safeguards secured to persons by the laws or administrative practice of the requested State. 2.     Except in the case of Article 14, the provisions of this Convention shall not be construed so as to impose on the requested State the obligation: a.     to carry out measures at variance with its own laws or administrative practice or the laws or administrative practice of the applicant State; b.     to carry out measures which would be contrary to public policy ( ordre public ); c.     to supply information which is not obtainable under its own laws or its administrative practice or under the laws of the applicant State or its administrative practice; d.     to supply information which would disclose any trade, business, industrial, commercial or professional secret, or trade process, or information the disclosure of which would be contrary to public policy ( ordre public ); e.     to provide administrative assistance if and insofar as it considers the taxation in the applicant State to be contrary to generally accepted taxation principles or to the provisions of a convention for the avoidance of double taxation, or of any other convention which the requested State has concluded with the applicant State; f.     to provide administrative assistance for the purpose of administering or enforcing a provision of the tax law of the applicant State, or any requirement connected therewith, which discriminates against a national of the requested State as compared with a national of the applicant State in the same circumstances; g.     to provide administrative assistance if the applicant State has not pursued all reasonable measures available under its laws or administrative practice, except where recourse to such measures would give rise to disproportionate difficulty; h.     to provide assistance in recovery in those cases where the administrative burden for that State is clearly disproportionate to the benefit to be derived by the applicant State. 3.     If information is requested by the applicant State in accordance with this Convention, the requested State shall use its information gathering measures to obtain the requested information, even though the requested State may not need such information for its own tax purposes. The obligation contained in the preceding sentence is subject to the limitations contained in this Convention, but in no case shall such limitations, including in particular those of paragraphs 1 and 2, be construed to permit a requested State to decline to supply information solely because it has no domestic interest in such information. 4.     In no case shall the provisions of th