[doc. web n. 1519208]
[ doc. web n. 1512255]

Taxpayers´ Lists on the Internet: The Italian Revenue Office Posted the Data on the Internet Unlawfully - Decision dated 6 May 2008

IL GARANTE PER LA PROTEZIONE DEI DATI PERSONALI

Having convened today in the presence of Prof. Francesco Pizzetti, President, Mr. Giuseppe Chiaravalloti, Vice-President, Mr. Mauro Paissan and Mr. Giuseppe Fortunato, Members, and Mr. Giovanni Buttarelli, Secretary-General;

Having regard to the personal data protection Code (legislative decree no. 196/2003);

Having regard to the legislation applying to publication of the lists of taxpayers that have submitted tax returns related to their personal income tax and/or VAT; having considered that the lists are drawn up annually on that basis and deposited for one year with the individual municipalities and the geographically competent branches of the Revenue Office in order for anyone to browse them; having considered that the "terms and arrangements" for drawing up such lists have to be laid down annually via an ad-hoc decree (see section 69 of Presidential decree no. 600 dated 29 September 1974 as amended by section 19 of Act no. 413 dated 30 December 1991; see also section 66-bis of Presidential decree no. 633 dated 26 October 1972);

Having regard to the decision whereby the Revenue Office implemented the above requirements as for the year 2005, ordering that the lists circulated to the said branches of the Office and forwarded to municipalities via electronic networks should also be posted in the ad-hoc section of the website managed by the Revenue Office (http://www.agenziaentrate.gov.it) "with a view to browsing such lists" "by having regard to the geographically competent branches of the Revenue Office" (decision by the Director of the Revenue Office dated 5 March 2008);

Having regard to the decision dated 30 April 2008 whereby this Authority, immediately it was  informed of the posting of these data on the Internet, considered after its initial assessment that such posting was not in conformity with sector-related legislation and urged the Revenue Office to terminate the posting forthwith;

Whereas the Italian DPA also called upon the Revenue Office, in the above decision, to provide additional clarification; whereas such clarification, after being requested urgently in a letter by the Italian DPA dated 2 May, was received within the deadline laid down therein (letter by the Revenue Office dated 5 May 2008); having evaluated the submissions and documents attached thereto;

Whereas the reports and claims submitted so far and the information gathered in the preparatory phase show that the posting on the Internet performed by the Revenue Office is in conflict with the applicable legislation, contrary to the statements made by the Revenue Office in the aforementioned letter, on account of the following:

1) The decision by the Director of the Revenue Office could only lay down the "terms and arrangements" for drawing up the taxpayers´ lists. Access to such lists is regulated specifically by the law, whereby the only arrangements consist in circulating the lists to the geographically competent branches of the Revenue Office and forwarding such lists, either on magnetic media or via electronic networks, exclusively to the individual municipalities concerned; in both cases, the lists may only include the taxpayers that are resident in the respective geographic areas. This procedure is aimed at ensuring that the lists be deposited  for one year in the manner described above and may be browsed – though not copied – by anyone (section 69(4) et seq. of Presidential decree no. 600/1973; see also section 66-bis of Presidential decree no. 633 dated 26 October 1972);

2) The "Code of Digital Administration" invoked by the Revenue Office to back their decision does foster the use of ICTs in the processing of data by public administrative agencies. However, the Code explicitly leaves unprejudiced such limitations on access to the data as may be set forth in laws and regulations – which is the case for section 69 referred to above – along with the safeguards and measures applying to the protection of personal data (section 2(5) and section 50 of legislative decree no. 82 dated 7 March 2005);

3) As well as being unlawful because of the lack of a legal basis and the failure to inform the Italian DPA, posting the data in question on the Internet also resulted into disproportionate dissemination of this information by having regard to the purposes for which the legislation in force has introduced transparency requirements. Rather than allowing the data to be browsed in the individual geographical areas concerned, it resulted into their being freely available throughout Italy and abroad. The innovative features of this arrangement, which are highlighted in the submissions presented by the Revenue Office, could not be grasped from the wording used in the information notices provided to taxpayers in the tax return forms for 2005. The Revenue Office failed to apply any "filtering" of the online access and allowed a major number of users to save a backup copy of the lists via file transfer functions. By enabling users to access the data in a centralised fashion, the Office allowed them – in spite of the very few hours during which the relevant section of the website was in operation – to view numberless items of information related to all taxpayers, make copies thereof, create their own databases, modify and process the data, create profiling lists and circulate the data further on the network and/or offer them for sale.  This has endangered accuracy of the data in question and made it utterly impossible to prevent the data from being accessible upon expiry of the 1-year term laid down in the legislation mentioned above.

4) Finally, it should be pointed out that this Authority failed to be consulted beforehand by the Revenue Office, which is a legal obligation with a view to adopting  regulations and administrative measures related to personal data protection (see section 154(4) of the DP Code);

Whereas, based on the above premises, the publication arrangements in question do not appear to be lawful;

Whereas it is necessary accordingly, further to the blocking order already issued, to ban the Revenue Office from further disseminating the lists in question on the Internet via the arrangements described so far as well as from disseminating such lists via similar arrangements as related to the years following 2005, given the lack of an appropriate legal basis and the failure to consult with the Italian DPA (section 143(1)c. and section 154(1)a., b. and d. of the DP Code);

Whereas another decision adopted jointly with this one shall notify the Revenue Office of having committed an administrative infringement since it failed to provide the appropriate information beforehand to the taxpayers concerned (section 13 and section 161 of the DP Code);

Whereas any entity that has acquired taxpayers´ data, also indirectly, from the aforementioned website may not circulate the data further given that a breach of law was established via this decision; whereas circulating the data further, in particular via electronic networks or other IT media, is an offence and may carry criminal punishments if certain conditions are fulfilled (see section 11(1) a. and sections 2, 13, 23, 24, 161, and 167 of the DP Code); whereas it is necessary accordingly to publicize this decision to the widest possible extent;

Whereas the other mechanisms to lawfully access the lists are left unprejudiced, since such lists may be browsed by anyone at the individual municipalities and geographically competent branches of the Revenue Office with a view to their lawful use also for journalistic purposes;

Whereas if Parliament and Government plan to carry out a review of the legislation on accessibility of taxpayers´ lists also in light of technological developments, it will be necessary to devise, after consulting with the Italian DPA, appropriate solutions and safeguards to strike the right balance between the proportionate disclosure of taxpayers´ data and the protection of data subjects´ rights;

Having regard to the considerations made by the Office as submitted by the Secretary General in pursuance of article 15 of the Italian DPA´s Rules of Procedure no. 1/2000 dated 28 June 2000;

Acting on the report submitted by Prof. Francesco Pizzetti;

BASED ON THE ABOVE PREMISES, THE GARANTE

1. Confirms the order blocking publication of the lists of taxpayers who submitted tax return forms for 2005 with regard to their personal income tax and/or the value added tax and prohibits the Revenue Office, under section 143(1)c. and section 154(1)a., b. and d. of the DP Code,

a. From disseminating the said lists further on the Internet via the arrangements this decision found to be in conflict with the sector-related legislation in force;

b. From disseminating the said lists via similar arrangements as for the years following 2005, given the lack of an appropriate legal basis and the failure to consult with the Garante beforehand;

2. entrusts the Office with notifying the Revenue Office of the commission of an administrative infringement because it failed to provide appropriate information beforehand to the taxpayers concerned;

3. orders the Office to ensure that this decision be publicized to the widest possible extent, also by having it published in the Official Journal of the Italian Republic, so as to draw the attention of any entity that has obtained taxpayers´ data, also indirectly, from the website of the Revenue Office to the circumstance that they may not circulate such data further, given the aforementioned breach of law, and that circulating the data further is an offence and may carry criminal punishments if certain conditions are fulfilled.

Done in Rome, this 6th day of May 2008 

THE PRESIDENT
Pizzetti

THE RAPPORTEUR
Pizzetti

THE SECRETARY GENERAL
Buttarelli