The Cyprus Tax Reform, the Investigative Powers of Tax Authorities and the Right to Privacy

^{by Michalis Severis, Senior Lawyer}

Recent Cyprus Tax Reform

In December 2025, legislation was passed by the Cypriot Parliament, which essentially consists of six amending laws that constitute the so-called Cyprus Tax Reform. These amendments entered into force on 01.01.2026. 

Among the amendments, specific provisions provide the Cyprus Tax Authorities with broad investigative powers, such as the following¹:

• Authorization for the collection and processing of personal data. 
• Authorization for access to and obtaining such data from any source and/or various sources. 
• Authorization for accessing data using information systems that allow automated processing and profiling.
• Authorization to obtain information and data (including financial data) from banking institutions.

Importance – Why does this matter? 

Whether you are an individual entrepreneur who is just starting your own business in Cyprus, or an entrepreneur who has been carrying out business activity in Cyprus for years, understanding certain aspects of the reformed tax provisions, combined with the protection provided by European law and the jurisprudence of the European Court of Human Rights, is essential. 

How could these broader investigative powers of the tax authorities affect an entrepreneur in Cyprus, and what safeguards are provided by European law to ensure that these powers are exercised in a manner that reflects the purpose for which they were established, while always remaining within the framework of legality and the European Acquis?

The above powers, in addition to aiming at the restructuring of the tax system, so that it may respond with greater flexibility and efficiency to modern economic and social requirements, take on even greater importance as they are also linked to the right to respect for private and family life, an individual’s home and correspondence, which is protected by Article 8 of the European Convention on Human Rights² as well as by the provisions of the Constitution of the Republic of Cyprus³. 

The exercise of these powers frequently involves access to personal and financial information. As a result, the expansion of tax authorities’ powers inevitably raises questions regarding their compatibility with the right to privacy protected under European human rights law and the European Convention on Human Rights. 

The information that Cyprus tax authorities may obtain from banking institutions and other sources, regarding individuals, details of professional activity, names and surnames of natural persons, specific information regarding taxable assets and home addresses, may constitute personal data connected with the right to privacy, within the meaning of Article 8 of the European Convention on Human Rights. 

It is understood that any failure to apply the principles of necessity and proportionality in compliance with the law, either due to the broad and general wording of the legislation or due to the exercise of powers by the tax authorities that is outside the permitted scope (or due to both), poses risks of violation of the aforesaid human right. The value of this right is fundamental for the members of a democratic and well-functioning society, both on a personal and professional level. The hypothetical scenario of uncontrolled access to or access without proper safeguards and clearly defined criteria to the above information and data, in addition to the pure legal aspect of the matter, could adversely affect the members of a society.

A Recent Judgment of the European Court of Human Rights  

This issue has recently gained renewed attention following the Judgment delivered on 8 January 2026 by the European Court of Human Rights in the case Ferrieri and Bonassisa v. Italy, applications 40607/19 and 34583/20⁴. The decision provides important clarification regarding the limits imposed by the right to privacy on the investigative powers of tax authorities under Article 8 of the European Convention on Human Rights.

The judgment is particularly relevant in light of legislative developments across European jurisdictions, including recent legislative developments in the Republic of Cyprus, especially with regard to the broader trend towards expanding the information-gathering powers of tax authorities. As tax authorities increasingly rely on access to financial and banking data during investigations, ensuring compliance with fundamental rights standards, becomes an essential legal consideration.

The case concerned the access of Italian tax authorities to the applicants’ banking information/data (including bank account information, transaction histories and details of other financial operations) during a tax investigation. The applicants argued that the legal framework governing such access lacked sufficient safeguards and therefore violated their right to privacy. In examining the case, the Court identified several important principles concerning the limits of investigative powers exercised by tax authorities.

By issuing the above Judgment, the European Court of Human Rights, inter alia, indicated the following:

1. Βanking information obtained from banking documents constitutes personal data of an individual, protected under Article 8. Consequently, the collection and examination of such data by tax authorities amounts to an interference with the right to respect for private life⁵. 

The Court notably stated that

“….such information may also concern professional dealings, and there is no reason….to justify excluding activities of a professional or business nature from the notion of “private life” ⁶

and also that

“…..details of taxable earned and unearned income, as well as taxable net assets, concern the “private life” of the individuals in question…..” ⁷

and further that 

“…..data such as a taxpayer’s name and home address, processed and published by the Tax Authority in connection with the fact that he or she has failed to fulfil his or her tax payment obligations, clearly concern information about “private life”….”.⁸

The same was indicated by the Court regarding “…consulting an individual’s bank account amounts…”.⁹

2. Article 8 of the European Convention on Human Rights guarantees the right to respect for private and family life, home, and correspondence. Although the provision does not explicitly refer to financial information, the Court has recognised that personal financial and banking data fall within the scope of an individual’s private life. Accordingly, access by public authorities to banking records or financial data constitutes an interference with the rights protected under Article 8. 

Such interference may nevertheless be justified where it meets three essential conditions:

       – it must be in accordance with the law,

       – it must pursue a legitimate aim, such as the prevention of tax evasion,

       – it must be necessary and proportionate in a democratic society¹⁰.

The requirement that an interference must be “in accordance with the law” plays a particularly important role in this analysis. It requires that the legal framework governing such measures be sufficiently clear, accessible, and foreseeable to protect individuals against arbitrary interference by public authorities. As the Court observed:“….The exceptions provided for in Article 8 § 2 are to be interpreted narrowly, and the need for them in a given case must be convincingly established….”.¹¹

The Court recognised that combating tax evasion and protecting the economic interests of the state are legitimate objectives that may justify certain limitations on privacy rights. Nevertheless, the pursuit of these objectives does not eliminate the need for appropriate legal and procedural safeguards.

3. Legislation authorising access to financial data, must satisfy the “quality of law” requirement. This means that the relevant legal provisions must clearly define the scope of the powers granted to public authorities and provide sufficient protection against arbitrary interference. 

As the Court stated in Paragraph 71 in its Judgement: “……it would be contrary to the rule of law, one of the basic principles of a democratic society enshrined in the Convention, for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise. The level of precision required of domestic legislation – which cannot in any case provide for every eventuality – depends to a considerable degree on the content of the instrument in question, the field it is designed to cover and the number and status of those to whom it is addressed…” 

4. In the case before it, the Court found that the Italian legal framework allowed tax authorities to obtain extensive banking information with a considerable degree of administrative discretion that could be described as unfettered discretion. The Italian legislation did not clearly define the conditions under which such powers could be exercised and, in any case, the Italian legal context (more broadly) or at least part of it (i.e. detailed criteria included in circulars adopted and published by the Italian Tax Authorities), was not binding on the Tax Authorities. The judgment underscores the need for clear legal criteria, independent review or judicial review (probably an ex-post review within a reasonable time would suffice), and effective remedies in practice, to prevent arbitrariness in tax data access¹². The Court noted that “…….the Court considers that the legal basis for the contested measures was incapable of sufficiently delimiting the scope of discretion conferred on the domestic authorities, and accordingly did not meet the “quality-of-law” requirement under Article 8 of the Convention.”.¹³

5. The Court observed that the system lacked sufficient procedural safeguards, including effective oversight mechanisms capable of preventing potential abuse of investigative powers¹⁴.

The Court concluded that the combination of broad investigative powers and limited safeguards created a risk of arbitrary interference with individuals’ private life. Accordingly, it found a violation of Article 8 of the Convention. The Court’s judgment does not suggest that tax authorities should be deprived of effective investigative tools. Instead, it highlights the importance of ensuring that such powers operate within a legal framework that adequately protects fundamental rights. 

The Court recommended reforms and indicated ways to align domestic Italian law with the Convention’s standards, ensuring legal clarity, procedural safeguards, and effective review mechanisms. 

Several safeguards may contribute to achieving this balance. First of all, legislation should clearly define the circumstances in which tax authorities may access a taxpayer’s financial/banking information/data. A crucial aspect of this recommendation is that “….the domestic legal framework must oblige the authorities to respect those conditions, provide reasons for such measures and accordingly justify the measures in the light of such criteria”¹⁵. In addition, a state’s legal framework must provide for an effective review of such measures. This review could be judicial or in any case independent. It is also important to note that tax authorities’ investigative powers should be exercised in accordance with the principles of necessity and proportionality. Moreover, taxpayers should have access to effective remedies allowing them to challenge investigative measures that may unlawfully interfere with their rights. Transparent administrative procedures and clear guidelines can also help ensure that investigative powers are exercised consistently and responsibly¹⁶.

Takeaways

The judgment in Ferrieri and Bonassisa v. Italy case, illustrates the continuing importance of balancing effective tax enforcement with the protection of fundamental rights. While states enjoy a broad margin of appreciation (discretion) in the field of taxation, investigative powers that involve access to personal financial information/data must be accompanied by clear legal limits and adequate safeguards.

As tax authorities continue to expand their investigative capabilities, the principles articulated by the European Court of Human Rights in the above Judgment, provide valuable guidance for both the Cypriot Parliament and the Cyprus Tax Authorities. Ensuring that legislation exists which meets the “necessary quality criteria” as well as that tax authorities’ powers are exercised transparently, proportionately, and subject to appropriate oversight, is essential not only for the protection of privacy rights but also for maintaining public confidence in the fairness of the tax system.

1. 1. The Assessment and Collection of Taxes (Amending) (No.2) Law of 2025 (L.243(I)/2025). See also The Assessment and Collection of Taxes Law of 1978 (4/1978). ↩︎
2. 2. European Convention on Human Rights, article 8. ↩︎
3. 3. Constitution of the Republic of Cyprus, article 15. ↩︎
4. 4.  Ferrieri and Bonassisa v Italy (Applications nos 40607/19 and 34583/20) Judgment of 8 January 2026, European Court of Human Rights (First Section). Available at https://hudoc.echr.coe.int/fre?i=001-247632 ↩︎
5. 5. Ibid, paras 53 and 54. ↩︎
6. 6. Ibid, para 54. ↩︎
7. 7. Ibid, para 54. ↩︎
8. 8. Ibid, para 54. ↩︎
9. 9. Ibid, para 55. ↩︎
10. 10. Ibid, para 57. ↩︎
11. 11. Ibid, para 57. ↩︎
12. 12. Ibid, paras 71-74, 78, 81, 86, 87, 93, 97 and 99. ↩︎
13. 13. Ibid, para 82. ↩︎
14. 14. Ibid, para 105. ↩︎
15. 15. Ibid, para 114. ↩︎
16. 16.  See also Ferrieri and Bonassisa v Italy, paras 113-117. ↩︎