The right to privacy used as a modern pillory in L.B. v. Hungary

By Liesa Keunen, PhD researcher at Ghent and Antwerp University, Belgium. Liesa Keunen is working on the research project ‘Tax audits on big data: exploring the legitimacy and limits in light of the prohibition of fishing expeditions’ (Ghent & Antwerp University, FWO). She is also a member of the research group Law & Technology, the Human Rights Centre and PIXLES (Privacy, Information Exchange, Law Enforcement and Surveillance), all established at the Faculty of Law and Criminology at Ghent University. At the University of Antwerp, she is a member of DigiTax (Centre of Excellence that researches the challenges and opportunities of digitalisation for taxation).

The fourth section of the European Court of Human Rights (ECtHR) delivered a remarkable judgment in the case of L.B. v. Hungary (application no. 36345/16) on January 12, 2021. The publication of taxpayers’ personal data on the tax authority’s website for failing to fulfil their tax obligations constitutes no violation of the right to private life as established under Article 8 of the European Convention on Human Rights (ECHR). In this case, the personal data published included the applicant’s name, home address, tax identification number, and the amount of unpaid tax he owed. The ECtHR clearly prioritises the Hungarian legislature’s choice to make the identity of persons who fail to respect their tax obligations publicly available in order to improve payment discipline and protect the business interests of third parties over the data subject’s right to privacy.

Facts

The applicant, Mr. L.B., is a Hungarian national born in 1966 and living in Budapest. On January 27, 2016 the Hungarian tax authority published on its website, in accordance with the relevant domestic law, the applicant’s personal data on a list of ‘tax defaulters’ in respect of those individuals whose tax arrears and debts exceeded 10 million Hungarian forints (€30.000) for the previous quarter. Subsequently, the applicant appeared on a list of ‘major tax evaders’ that kept record of individuals whose tax arrears and debts exceeded 10 million Hungarian forints for a period longer than 180 days. The personal data published on those lists included a data subject’s name, home address, tax identification number, and the amount of unpaid tax.

On February 16, 2016 an online media outlet additionally produced an interactive map called ‘the national map of tax defaulters’. Along with the addresses of other tax defaulters, the applicant’s home address was indicated with a red dot. Whenever a person clicked on the red dot, the applicant’s personal information appeared. This data was available to all readers of the online media outlet.

The applicant complained that the publication of his personal data on the tax authority’s website had infringed his right to private life as guaranteed under Article 8 ECHR. He argued that the Hungarian legislation was solely aimed at public shaming and that it was unlikely that third parties could influence his tax compliance, whether or not his data was made publicly available. The Hungarian tax authority argued that the aim of its regulation was to secure the economic well-being of the country, as well as to protect the rights of others (i.e., actual and potential business partners of the applicant).

Judgment

The ECtHR began by noting that its decision only concerns the publication of the applicant’s personal data on the website of the Hungarian tax authority. The tax authority’s actions, and its responsibility with regards to the initial publication of the information are, according to the ECtHR, essentially different from the dissemination of that information by online media outlets or search engines. Therefore, the wider dissemination of that information does not fall within the scope of this decision (§16).

Having found the publication of the applicant’s personal information on the tax authority’s website to be an interference with his right to private life under Article 8 ECHR, the Court had to decide whether this measure could be justified in light of the second paragraph of said article. In examining whether an interference is justified, the ECtHR assesses three criteria: the interference’s accordance with the law, the legitimate aim, and the necessity in a democratic society (the proportionality principle) (§43).

The ECtHR first noted that the applicant did not deny that the publication of his personal data had a legal basis in domestic law (namely, section 55(3) and (5) of the Tax Administration Act). It therefore saw no reason to call the legality of this measure into question (§44). Next, the ECtHR assessed whether the publication of the personal data on the tax authority’s website pursued a ‘legitimate aim’. The ECtHR accepted the Hungarian tax authority’s argument that the impugned measures aimed to improve tax payment discipline, which served to protect the economic well-being of the country and the rights of others (i.e., the actual and potential business partners of the applicant). As such, the Court found that it was legitimate for the Hungarian tax authority to invoke the need to protect the rights and freedoms of others within the meaning of article 8, §2 ECHR (§§45-46).

In analysing the ‘necessity criterion’, the ECtHR assessed whether the Hungarian tax authority had struck a fair balance between the applicant’s right to privacy and the interest of the community as a whole, as well as the rights of others, when publishing his personal data on its website (§51). The ECtHR noted that it ‘does not find it unreasonable that the State considers it necessary to protect its general economic interest in collecting public revenue by means of public scrutiny aimed at deterring persons from defaulting on their tax obligations’. In order to arrive to that conclusion, the ECtHR started by justifying the reasons provided for the measures and then commented on the specific context in which the personal data was made public.

It mainly considered, among others, the importance of the implementation of the impugned measure since it contributes to the overall well-functioning of the Hungarian tax policy, which, in turn, is essential to the proper functioning of the state apparatus (§52). The ECtHR also referred to the protection of the economic interests of private individuals. It emphasised that potential business partners have a specific interest in knowing whether or not a person complies with their tax obligations, as that might help them assess their suitability to do business with. Based on the above, the ECtHR found the publication of the identity of persons who fail to respect their tax obligations a matter of general interest (§53). It concluded that the Hungarian legislature’s choice to make the applicant’s personal data public (in order to improve payment discipline and protect the business interests of third parties and thereby contribute to the general economy) is not manifestly unreasonable (§54).

The ECtHR continued to assess the necessity criterion by answering the question of whether the impact of the publication outweighed the above-described justifications (proportionality). In order to do so, the ECtHR took into account the essential role played by personal data protection in safeguarding the right to private life and the fundamental principles of data protection (§55). With respect to the latter, the Court pointed out that the publication of the personal data on the contentious lists was only authorised in respect of those private individuals whose tax arrears and tax debts exceeded 10 million Hungarian forints over a certain period of time (§56). The ECtHR was further satisfied with the fact that the identification of data subjects on the tax authority’s website was possible for no longer than was necessary for the given purposes of the publication, since the personal data was removed once the person concerned had paid their taxes (§57). Despite the fact that the ECtHR also recognised the serious repercussions on a person’s private life when personal data are published (§58), it further emphasised that publishing the lists of tax defaulters and tax evaders would have been pointless if it were not for the identification of the taxpayers in question. Solely publishing the first name and surname would not have been sufficient 1) to identify a certain person, 2) to fulfil the publication’s purpose of facilitating public scrutiny of tax evasion, and 3) it would have been likely to provide inaccurate information when persons bear the same name (§59). The ECtHR therefore concluded that a combination of identifiers (including the home address) was necessary to ensure the accuracy and efficacy of the measures (§60).

The ECtHR went on to balance the rights of a person whose information has been published on the internet and the public’s right to be informed. It justified the choice to publish the personal data on the internet because the purpose of the publication was to inform the public and to make the information easily available and accessible to those concerned, irrespective of their place of residence. Widespread public access to the data was thus considered necessary for the efficacy of the measures and was in everyone’s interest (§§64-65). The ECtHR ended by stating that it doubted that the list of tax defaulters and tax evaders, appearing in Hungarian on the website of the Hungarian tax authority, would actually attract worldwide public attention, i.e. attention from persons other than those concerned. The website of the tax authority (as a portal designated for tax matters) ensures, according to the ECtHR, that the personal data was distributed in a manner reasonably intended to reach those with a particular interest in it, while avoiding disclosure to those who had no such interest (§68).

Additionally, the website did not provide the public with a means of shaming the applicant (§69). As a result, the ECtHR found no evidence that the lists have led to any concrete repercussions on the applicant’s private life. Making the information in question public could not be considered a serious intrusion into the applicant’s personal sphere (§70). In conclusion, ‘the specific context in which the information at issue was published, the fact that the publication was designed to secure the availability and accessibility of information in the public interest, and the limited effect of the publication on the applicant’s daily life, the Court considers that the publication fell within the respondent State’s margin of appreciation’ (§71). No violation of Article 8 ECHR was found (§72), by five to two votes.

Judges RAVARANI and SCHUKKING issued a dissenting opinion in which they, generally stated, strongly disagree on the point of the scope of the personal data published and on the manner of publication. They considered it unnecessary to have published the applicant’s home address and to have published it on the internet. They also reasoned that the majority was inaccurate to exclude any potential republication of the personal data of the applicant by third parties. Furthermore, they pointed out that publishing an individual’s home address on the internet can trigger dramatic consequences, such as burglary. They concluded that the proportionality assessment should have led to a finding of a violation of Article 8 ECHR.

Commentary

In line with the dissenting opinion of judges RAVARANI and SCHUKKING, one must concede that the absence of a violation of Article 8 ECHR in this specific case is hard to accept. The arguments for this are twofold. The publication of the home address was, first of all, unnecessary to fulfil the objective of the law. Second, it was not necessary to have published the lists on the internet. Moreover, one could argue that excluding the impact of possible republication of the personal data by third parties conflicts with the positive obligation of States to protect the right to private life.

Publication of the home address on the internet

The publication of the home address of the applicant is by no means needed to identify the applicant and thus to accomplish the objective of the law (see above). A home address is considered to be personal data and the ECtHR has previously acknowledged that ‘the publication of personal data, including a home address, can have significant effects or even serious repercussions on a person’s private life’ (see §58 and mutatis mutandis, Alkaya v. Turkey, §§29 and 39). Moreover, in that regard, the dissenting opinion states that tax defaulters appearing on the published lists have not paid a substantial amount of taxes (at least €30.000), and as such are considered wealthy. This, in turn, increases their risk of being the victims of burglary. Nevertheless, according to the majority, the publication of the home address was necessary since solely publishing a taxpayer’s first name and surname would not make it possible to distinguish them from other individuals (§59). As judges RAVARANI and SCHUKKING have reasoned, the majority should have realised that interested third parties are able to identify someone even without their home address. After all, there are enough other means available ‘to those concerned’to identify those that are worthy of doing business with. For example, simply conducting further research, or, when consulting the published lists on the tax authority’s website, using a person’s name and their tax identification number.

Furthermore, the initial publication of the personal tax data should clearly not have been published on the world wide web without additional safeguards. The ECtHR even acknowledges in L.B. v. Hungary that ‘the risk of harm posed by content and communications on the Internet to the exercise and enjoyment of human rights and freedoms, particularly the right to respect for private life, is certainly higher than that posed by the press’ (see §62 and inter alia, Egill Einarsson v. Iceland, §46, in fine). The reason for choosing the internet, namely to make the information easily accessible ‘to those concerned’ is understandable, but again, there is ‘no need to explain the immense multiplicative effect of any piece of information that is published on the internet’ (§10 dissenting opinion). Consequently, not only ‘those who are concerned’ can and will access the data. The interactive map of ‘national tax defaulters’ is just one national example thereof. Looking at the bigger picture, it becomes clear that this personal tax data can be integrated in big data sets and consequently be used for algorithmic decision making by, for example, insurance companies and banks. The personal tax data could be useful for these institutes in determining who does and who does not receive a mortgage or a certain discount on an insurance fee. The impact on one’s private life can thus be considered enormous, although it might not be immediately visible.

In the context of the further use and republication of personal tax data published on the internet, it must be pointed out that the Finnish tax authority in Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland (hereinafter: Satakunnan) took additional safeguards to limit the accessibility of the publicly available tax data (e.g. it could only be consulted at local tax offices). This is definitely not the case here. Even if the lack of safeguards could somehow be linked to the legitimate aim that the Hungarian tax authority is pursuing, the Hungarian legislator did probably not intend to include the republication and further use of personal data made public as part of the public scrutiny to protect the economic well-being of the country and the rights of others. For that reason, it would have been appropriate for the Hungarian legislator to require additional safeguards when personal tax data is published on the internet. The ECtHR acknowledges in that view that (author’s underlining): “The protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life, as guaranteed by Article 8 of the Convention. The domestic law must afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article (see S. and Marper v. United Kingdom, § 103; Satakunnan, §137; L.B. v. Hungary, §22). It is, in other words, the responsibility of the Hungarian legislator to prevent the use of personal (tax) data that is not compatible with Article 8 ECHR. Requiring safeguards when personal data is published online can be considered one step in accomplishing that obligation.

Additionally, one should point out that the erasure of the personal tax data on the Hungarian tax authority’s website once the amount of outstanding tax has been paid becomes irrelevant in case of republication of that data on the internet. Indeed, once data has been republished, the erasure of that data on the tax authority’s website does not automatically erase that data on every channel that republished the information. It is, as the dissenting opinion confirms, consequently wrong of the ECtHR to assume that the applicant had not experienced a serious intrusion into his private life because he had not demonstrated concrete repercussions on his private life by the publication of his data on the tax authority’s website (see earlier and §70 of the judgment). After all, it is extremely difficult to provide evidence for concrete and immediate harm since there is no knowledge on who exactly has obtained, used or republished his personal data after it has been republished on the internet by third parties.

What is clear, however, is that the publication of the personal tax data on the internet can have enormous consequences related to the applicant’s private life and is disproportionate in relation to the objective of the law, certainly when no safeguards are in place. To conclude on this point, a reference to §52 of the decision must be made. The majority of the ECtHR itself accepts that there are difficulties in establishing whether the publication of tax defaulters’ data tackles tax evasion and revenue losses. The publication of personal data on the internet can clearly not be considered necessary to achieve the legitimate aim if it is uncertain whether the measure is suitable to fulfils its purpose. Hence, the proportionality principle is not fulfilled and should have led to a finding of a violation of article 8 ECHR. In other words, deterring people from defaulting on their tax obligations by means of public scrutiny through making their personal tax data public means using the right to privacy as nothing more than a modern pillory.

Positive obligation

Under their positive obligations, States are required to not only respect, but also protect fundamental rights, such as the right to privacy. As a consequence, States should protect the enjoyment of human rights from interference by third parties (i.e., private companies such as press companies, or individuals). Extending the scope of the ECHR to relationships between private individuals is called granting “horizontal effect” to the rights enshrined in it. According to the interpretation of the ECtHR, the horizontal effect of human rights is indirect. By that it means that individuals can enforce human rights provisions against other individuals only indirectly since they must rely on State law that implements the State’s (positive) human rights obligations. A private individual’s interference with another private individual’s human rights may be attributed to the State through its failure to prevent the interference.

The ECtHR has, in the past, granted substantive protection in horizontal relations between individuals claiming the right to privacy and press companies. Indeed, (and important for the case of L.B. v. Hungary), the ECtHR has found that Article 8 ECHR encompasses ‘the right to live privately, away from unwanted attention’ (see, for example, Smirnova v. Russia, §95), which provides protection against the publication of personal data, including (among others) a home address (see, for example, Alkaya v. Turkey, §30). The ECtHR has also acknowledged that States have a positive obligation under Article 8 ECHR to protect a person’s ‘right to reputation’ (see, for example, ECtHR, 28 April 2009, Karakó v. Hungary, §18). Since protecting an individual’s right to privacy in this kind of cases requires the State to regulate the activities of the press (which are protected under freedom of expression), the ECtHR typically investigates these cases by answering the question whether a fair balance has been struck between the applicant’s right to privacy and the right to freedom of expression of the press (see, for example, Von Hannover v. Germany (No. 2), §100). With this regard, it is accepted that placing responsibilities and imposing obligations on institutions and companies to take data protection measures emanates from the State’s positive obligation under article 8 ECHR to protect the right to private life (See, L. LAVRYSEN, Human rights in a positive state: rethinking the relationship between positive and negative obligations under the European Convention on Human Rights, Cambridge, Intersentia, 2016, 86 and 91).

Unfortunately, the ECtHR narrowed the scope of its decision in L.B. v. Hungary to the publication of the personal tax data on the Hungarian tax authority’s website. In doing so, it disregarded the opportunity to take into account Hungary’s positive obligation to protect the personal tax data that the Hungarian tax authority publishes on its website. The applicant did not complain about the republication of his personal data by the online media outlet but he nevertheless did complain about the fact that his personal data had been published online, becoming available around the world to third parties (§36). To underpin this matter with the words of judges RAVARANI and SCHUKKING, ‘the Hungarian tax authority certainly could and should have foreseen the republication and that it bears responsibility, not for the actual republication as said above, but for having enabled of fostered it’ (see §12 dissention opinion).

In line with what is explained above, the Hungarian tax authority could have prevented the online media outlet’s (possible) interference with the right to privacy by simply adding safeguards when publishing such personal (tax) data online (see also earlier). This statement is moreover supported by the ECtHR’s decision in Satakunnan, where it prioritises the right to privacy of taxpayers when balancing it with the press companies’ right to freedom of expression. There, two companies published publicly available tax data, first through a newspaper and later through an SMS-service, which allowed people to text someone’s name to a special number and receive that person’s tax information. Finnish courts and authorities had subsequently prohibited the two companies from processing personal tax data in the manner and to the extent that they had. The ECtHR concluded, among others, that these restrictions pursued the legitimate aim of protecting the right to privacy of taxpayers. In other words, the ECtHR protected the right to privacy of the taxpayers in relation to the further dissemination of their tax data by third parties.

It seems likely that the ECtHR would have decided in the same way here, had it taken into account the broader scope of this case by considering the positive obligation of States to respect the right to private life. A violation of the applicant’s right to privacy would then have been much clearer and perhaps also a lot easier to find.

*Title based on the words used by judges Ravarani and Schukking.