If personal information is given to the tax office, then when can it be processed for other purposes without that person’s consent? For example, is consent required when data is made available to other state bodies such as those concerned with combating financial fraud?
Reverse engineering the case from the questions asked by the Slovak Supreme Court for Administrative Law, it seems that the Slovak tax authorities have created a list of people linked to tax fraud, a list and information which is available to the public prosecution authorities.
The claimant is on that list. He claims that data about him was given to the tax authority but has been processed by the tax authority and made available to the public prosecutor without his consent.
In essence, the tax authority claims that it does not need his consent to process the data or to pass it on to the third party concerned because it is in the state’s interest to combat tax fraud.
According to the Official Journal (OJ  C165/6), the Najvyšší súd Slovenskej republiky has asked:
1. Does Article 47(1) of the Charter of Fundamental Rights of the European Union, under which everyone whose rights, in particular their right to privacy with respect to the processing of personal data laid down in Article 1(1) et seq. of Directive 95/46/EC (1) of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [‘Directive 95/46/EC’], are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in Article 47 of that Charter, preclude a provision of national law which renders the exercise of an effective remedy before a tribunal, that is the submission of an application in administrative proceedings, conditional on the fact that the applicant, to protect his rights and freedoms, must have exhausted beforehand the procedures available to him under specific legislation, such as the Slovak Law on Administrative Complaints?
2. Is it possible to interpret the right to respect for private and family life, home and communications, laid down in Article 7 of the Charter of Fundamental Rights of the European Union, and the right to the protection of personal data laid down in Article 8 thereof to the effect that, where there is an alleged infringement of the right to the protection of personal data, which, with respect to the European Union, is implemented primarily through Directive 95/46/EC, and entails, in particular:
– the obligation on Member States to protect the right to privacy of persons with respect to the processing of their personal data (Article (1)) and,
– the authorisation conferred on Member States to process personal data where the processing is necessary for the performance of a task carried out in the public interest (Article 7, point (e)) or the processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed;
– and having regard to the authorisation [to restrict that right], by way of an exception, conferred on a Member State (Article 13(1)(e) and (f)), when such a restriction constitutes necessary measures to safeguard an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
those rights do not allow a Member State to create, without the consent of the person concerned, a register of personal data for the purposes of tax administration, so that the fact that personal data is rendered at the disposal of a public authority for the purposes of countering tax fraud in itself constitutes a risk?
3. Can a register held by a financial body of a Member State, which contains the applicant’s personal data and whose inaccessibility has been provided for by appropriate technical and organisational measures for the protection of personal data against unauthorised disclosure or access within the meaning of Article 17(1) of Directive 95/46/EC, be designated, by virtue of the fact that it was obtained by the applicant without the lawful agreement of the relevant financial body, as unlawful evidence, which the referring court must refuse to admit in accordance with the requirements of EU law on a fair trial laid down in the second paragraph of Article 47 of the Charter of Fundamental Rights?
4. Is the abovementioned right to an effective remedy and to a fair trial (in particular under Article 47 of the Charter of Fundamental Rights of the European Union) infringed by an approach taken by the referring court whereby, where there is case-law from the European Court of Human Rights cited in the case before it which differs from the answer obtained from the Court of Justice of the European Union, the referring court, in accordance with the principle of sincere cooperation laid down in Article 4(3) of the Treaty on European Union and Article 267 of the Treaty on the Functioning of the European Union, gives precedence to the Court of Justice’s legal opinion?
In the area of data processing law and privacy law, information given to the tax office for one purpose but subsequently used by another part of the state, has recently been discussed by the CJEU in Case C-201/14, Bara – giving personal data and consent to processing for just one purpose.
The issue of whether an official register that contains personal data is subject to the right to be forgotten, is at issue in Case C-398/15, Manni – data in public registers should be subject to the Google right to be forgotten.
The issue of whether the police can release personal information in its database in order to respond to a request from a private company, is at stake in Case C-13/16, Rīgas satiksme – our police data request is necessary for our legitimate interest.
The issue of when EU privacy law can stop a national tax authority from disclosing information to another tax authority is at stake in Case C-682/15, Berlioz Investment Fund – tax information exchanges not fishing expeditions.
The issue of a fair trial under Article 47 of the EU Charter is at stake not only in the Berlioz Investment Fund case but also in Case C-64/16, Associação Sindical dos Juízes Portugueses – a pay cut ends judicial independence.