Naming, Shaming, And Third-Party Access To Taxpayer Data

Does naming and shaming tax debtors and tax defaulters violate their human rights? Particularly their human right to privacy?

From the perspective of several tax authorities around the world, the answer is no. Their common argument is that taxpaying is a public activity, and debtors and defaulters who shirk their public duty should not be hidden. Rather, public naming and shaming is a way to ensure that taxpayers honor their civic obligation, and it nudges other taxpayers into compliance.

However, reasonable minds may differ on whether public naming is the best way to enforce compliance, and it’s a question that recently appeared before the European Court of Human Rights (ECHR). The ECHR is an international court that addresses litigation involving the European Convention on Human Rights, and it occasionally sees tax-related cases. In one recent case, L.B. v. Hungary, Application No. 36345/16, an unnamed taxpayer who landed on Hungary’s public tax defaulter list challenged the list as unlawful. He said the government cared more about humiliating taxpayers and less about compliance, since Hungary never actually conducted a review to see if public listing actually worked. The taxpayer faced a steep battle; typically, courts give tax authorities wide latitude to maintain public lists and rule against taxpayers in cases like this. This time around, the court surprisingly ruled in favor of the taxpayer after agreeing that Hungary failed to balance its public interest in tax compliance against taxpayers’ right to privacy. The ruling could encourage taxpayers to launch more privacy-based challenges, particularly against public debtor and default lists that are accessible to all and vulnerable to republication by third parties.

Background

Hungary has been publicly naming tax defaulters since 1996. At first, Hungary’s public defaulter lists targeted two groups: individual taxpayers with over HUF 10 million in arrears and legal entities whose arrears exceeded HUF 100 million.

Those lists published personal data: the individual taxpayer’s name, home address, commercial premises and tax identification number (if applicable), amount of tax arrears, and legal consequences for taxpayers who failed to pay previous arrears.

Over the years, Hungarian lawmakers created new lists targeting major tax debtors, employers with undeclared employees, and taxpayers who failed to submit their tax returns for two consecutive years.

In the case of major tax debtors — defined as taxpayers with debts exceeding HUF 10 million for over 180 days — the lists include the debtor’s name, company name, home address, and registered office. For taxpayers who are determined by a court or administrative decision to have maintained undeclared employees, their taxpayer name, registered office, TIN (for business entities), and address (for private individuals) are published, as well as the date of the final decision.

The Taxpayer

The taxpayer in this case wound up on Hungary’s public tax defaulters list after the National Tax and Customs Authority investigated his income tax liability for fiscal 2008-2010 and found that his arrears totaled HUF 290,738,542. The tax authority alleged that the taxpayer had failed to pay income tax on a series of improper bank withdrawals from a limited liability company he previously owned.

The taxpayer established the LLC in February 2009 and served as its managing director until November 2009. According to court documents, after that date the company was sold several times, in short intervals, to different Hungarian and foreign owners. However, the LLC was a shell company and did not have the personnel or resources to support meaningful activity, the court said.

Nonetheless, the taxpayer and the LLC’s accountant issued about HUF 100 million in invoices for fictitious supplies and directed those payments into the company’s bank account. Over the course of 2010, the taxpayer allegedly withdrew HUF 715,025,000 from the account and paid no income tax on the cash.

After the tax authority’s investigation, the taxpayer was placed on both the public tax defaulter and the major tax debtors lists, and his name and home address were published on its website. That information was obtained by an online media outlet, which later published the taxpayer’s home address in an interactive national map of over 3,600 tax debtors. That map marked each debtor’s home with a red dot, and when users clicked on the dot, the debtor’s name and home address would appear.

The Taxpayer’s Opening Argument

The taxpayer filed an action against Hungary in the ECHR alleging that the tax authority’s actions violated article 8 of the Convention for the Protection of Human Rights and Fundamental Freedom.

That article, entitled “Right to Respect for Private and Family Life,” states:

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The taxpayer argued that the publication of his personal data had publicly shamed him and ruined his reputation, thereby destroying his article 8 rights.

He told the court that public lists have a negative connotation, and that a list of Hungary’s largest tax debtors carries a stigma.

“This public shaming list was a modern form of pillory, was extremely humiliating and caused huge distress,” the opinion said.

A lower chamber of the ECHR found that publication of the taxpayer’s personal data interfered with his private life. However, it also found that the list was published to protect the country’s economic well-being and to protect the rights and freedoms of individuals considering going into business with tax debtors.

Therefore, the lower chamber found that Hungarian lawmakers had a reasonable foundation and objective for authorizing the lists. The court also noted that the plaintiff didn’t indicate that the listing caused repercussions in his private life. Hence, the lower chamber found that the burden placed on the plaintiff’s private life was not substantially greater than necessary to further Hungary’s legitimate interest.

The Grand Chamber Argument

On referral before the court’s Grand Chamber, the taxpayer rejected the notion that Hungary’s publication of his private data fulfilled a legitimate state aim. He emphasized that the government never reviewed the scheme or analyzed whether public listing compels taxpayers to comply with their payment obligations. As such, the government’s apparent disinterest in assessing whether the scheme was working suggested that its real intent was to humiliate and shame taxpayers, he said.

The taxpayer also rejected the notion that business partners need to know about tax debts, arguing that tax debts do not indicate whether a person is a reliable business partner. Here too, he said the government failed to collect or provide data about whether business partners use those lists, which undermines its position.

The government contended that it couldn’t provide statistics because it is hard to determine why taxpayers comply with their tax obligations, and there is no requirement for taxpayers to reveal their motives about why they pay their taxes.

The Grand Chamber Decision

Although article 8 protects individuals’ right to privacy, governments are allowed to breach this measure in a few narrow circumstances. They are allowed to do so to pursue legitimate aims in accordance with the law, and to enact protections that are “necessary in a democratic society,” like public safety and national security provisions.

While governments have fairly wide latitude in crafting public disclosure schemes, they do not have unlimited discretion, the court said. It established that government authorities must engage in a five-part test that balances the public vs. private interest. That test should balance:

(i) the public interest in dissemination of the information in question;

(ii) the nature of the disclosed information;

(iii) the repercussions on and risk of harm to the enjoyment of private life of the persons concerned;

(iv) the potential reach of the medium used for the dissemination of the information, in particular, that of the internet; and

(v) basic data protection principles, including those on purpose limitation, storage limitation, data minimization and data accuracy. Procedural safeguards are also important here.

In this case, the Grand Chamber said it found no evidence that Hungarian lawmakers considered how a public listing would affect the right to privacy or how members of the public might misuse the information. The court said:

Nor does it appear that consideration was given to the potential reach of the medium used for the dissemination of the information in question, namely the fact that the publication of personal data on the Tax Authority’s website implied that irrespective of the motives in obtaining access to the information anyone, worldwide, who had access to the Internet also had unrestricted access to information about the name as well as the home address of each tax debtor on the list, with the risk of republication as a natural, probable and foreseeable consequence of the original publication.

The court also found little evidence that the Hungarian parliament employed a balancing test to determine whether it was necessary to publish every bit of taxpayer data in order to fulfill its economic interests.

“Given the rather sensitive nature of such information, sufficient parliamentary consideration was particularly important in the circumstances of the case,” the court said.

Other EU States

On the issue of legislative review and balancing, Hungary appears to be an outlier among European countries, which may have made its scheme more vulnerable before the ECHR. The ECHR reviewed 34 European countries and found that 21 maintain public tax debtor lists on which public authorities may or must publicly disclose debtors’ personal data depending on the infraction and the amount of tax debt owed.

The court found that all 21 restrict the scope of information that is published and only publish what is necessary to identify a tax debtor. That scope varies across countries. Most publish a full name, some include a TIN, and a few release birth years, permanent or temporary addresses, and the taxpayer’s occupation. A handful of countries require tax authorities to inform taxpayers that their data will be disclosed.

But one characteristic that the 21 countries and Hungary have in common is that all publish their lists online. Most allow open access, although a few like Finland, Latvia, Portugal, and San Marino restrict access. None of them appear to have specific legal provisions requiring authorities to prevent republication of taxpayers’ personal data. In fact, some countries, like the United Kingdom, allow the media to reprint the information.

Punting on Republication

The Grand Chamber’s opinion didn’t address whether governments infringe on taxpayers’ right to privacy by allowing open-ended republication. However, it is an important topic that applies to all European countries with public tax debtor and defaulter lists and could render those lists vulnerable to future challenges.

In this case, the Grand Chamber didn’t discuss republication because it lacked the jurisdiction to do so — the lower chamber did not address the issue. That didn’t stop the taxpayer from arguing before the Grand Chamber that Hungary’s list was “disproportionate” because it seemingly enabled unlimited republication. He argued that outside parties could have unlimited access to his personal data and republish that data because the government failed to impose substantive or procedural safeguards on how that information is used.

He argued the article 8 right to respect for private life includes an affirmative obligation to protect it. As such, Hungary is obligated to restrict and prevent the republication of taxpayers’ information, he said. He provided the example that Hungary could require individuals to show a valid business interest before accessing tax debtors’ personal data.

The Hungarian government countered that online publication is an effective and efficient way for the public to access information. Is the government obligated to prevent republication? Hungary said no, because the data was lawfully allowed to be disclosed for the sake of the public interest.

Hungary also pointed out that the legislation allows a remedy: Taxpayers whose personal data is republished by third parties can present the issue before domestic courts and request that the data be deleted. The legislature allowed this to balance the state’s interest in publishing the information versus the taxpayer’s interest in minimizing dissemination of that information.

However, a retroactive deletion of data can’t reverse the harm that occurs when a taxpayer’s private data is republished online. At that point, the taxpayer’s privacy has been irreversibly breached, and it is impossible to know who has viewed the information, who has retained the information, and whether the data might later be disseminated by any number of third parties well after the original republication.

Future Implications

Generally, it’s not easy for taxpayers whose data is released in public lists to successfully challenge that publication on human rights grounds. The ECHR reviewed cases across Europe and found that no taxpayer has yet managed to successfully do so before a domestic court.

However, the republication issue could give litigants an avenue to successfully argue for their rights, particularly depending on the nature of their alleged tax infraction.

In a concurring opinion, Judge Egidijus Kūris argued that there are differences between tax defaulters, tax debtors, and tax evaders, and some taxpayers who default or owe taxes may do so for reasons beyond their control. Because of this, tax authorities need to distinguish between taxpayers who default and owe for innocent reasons — and do not deserve public naming and shaming — and those who purposely default and deserve public listing.

Failing to distinguish between those categories could be devastating from a privacy perspective. It means that some taxpayers who legitimately cannot pay their taxes for noncriminal reasons could find themselves on online lists, their data republished, and their right to privacy violated numerous times because of a situation beyond their control.

Based on the danger of this happening, tax authorities should be stricter about access to online debtor and default lists and the reasons they allow this access. Certainly, they should try to place some parameters around republication. The ECHR’s ruling makes it clear that taxpayers can potentially prevail in privacy-related challenges, and national tax administrations should heed that message. It is apparent that several European tax authorities have some vulnerabilities around their management, or lack of management, concerning data republication, and that could leave them vulnerable to court challenges.