The Spanish Supreme Court has confirmed, in its judgments of 25 June 2024 (no. 1122/2024, Contentious-Administrative Chamber, Second Section, cassation appeal no. 7845/2022, rapporteur Mr Dimitry Berberoff Ayuda) and of 2 July 2024 (Fourth Section, cassation appeal no. 5831/2023), that the judicial authorisation of entry into the contributor’s home, provided for in article 113 of the General Tax Act (LGT) in conjunction with article 18.2 of the Spanish Constitution, requires specific and individualised reasoning and projects its control over measures that invade other fundamental rights of article 18 of the Constitution itself —notably, where the inspection extends to computer repositories, servers, email or data stored in the cloud—.
It is helpful to begin with the legislative framework, because the reader unfamiliar with tax procedure usually does not know the relationship between the constitutional protection of the home and the AEAT’s inspection powers.
Article 18.2 of the Spanish Constitution enshrines the inviolability of the home. Its effect on the tax Administration is direct: no official may access the contributor’s home without (i) express, free and uninduced consent of the affected party or (ii) specific judicial authorisation, save where a crime is being committed in flagrante. Article 113 of the LGT reflects this requirement at the legislative level and coordinates it with the AEAT’s powers of verification and inspection.
Judicial authorisation is not a formality. The Spanish Supreme Court has, judgment after judgment, refined the requirements that the order must meet in order to be considered valid. STS 1122/2024 consolidates and extends that doctrine with a specific focus on digital access.
The case under review reflects a paradigmatic case of contemporary tax inspection. AEAT sought judicial authorisation to enter the home of a company —CVC España— in order to inspect its tax documentation. The application expressly included access to computers, servers, databases and files stored in the cloud. The Court authorised the full imaging of the electronic devices. The inspection downloaded, in execution of that authorisation, more than one million emails and some forty thousand documents. The company appealed alleging that the order lacked the specific reasoning that entry into telematic repositories requires.
The cassation question was whether the judicial authorisation of home entry requires explicit, specific and individualised reasoning of access to information held in telematic repositories, in order to safeguard the fundamental rights recognised in article 18 of the Spanish Constitution.
The Spanish Supreme Court answers in the affirmative. The doctrine is built on three pillars.
First, the guiding principle. The authorisation of entry into the home under article 18.2 of the Spanish Constitution does not automatically empower the invasion of the other rights of article 18 —personal privacy (paragraph 1), secrecy of communications (paragraph 3) and informational self-determination over personal data (paragraph 4)—. Each of these rights requires specific judicial authorisation or the consent of the affected party.
Second, the substantive requirements of the authorisation. The consolidated doctrine of the Spanish Supreme Court, already reflected in earlier judgments —among others, those of 23 September 2021 (appeal no. 2672/2020) and 14 June 2023 (appeal no. 6104/2022)— requires the order to verify cumulatively: (i) the existence of objective and sufficient indicia of the investigative purpose justifying the entry, generic or conjectural data not being sufficient; (ii) the suitability of the measure in relation to the object of the action; (iii) the necessity and proportionality —the subsidiarity principle—, that is, that no less invasive means are available to obtain the data sought; and (iv) the specific reasoning of the order, identifying the factual and legal elements that support each aspect of the authorisation.
Third, the projection over digital access. Where the entry extends to electronic equipment located in the constitutionally protected home —and especially where servers, emails or information stored in the cloud are accessed—, the doctrine of the Spanish Supreme Court requires the order to reason specifically the justification for the access to those repositories. The reasoning must address (i) the necessity and proportionality of the measure in relation to the specific object of the tax investigation; (ii) the nature of the data to which access will be obtained, assessing the possible affectation of the right to privacy and the secrecy of communications; and (iii) the impact on business activity and, where applicable, the rights of third parties, distinguishing whether the inspected party is a natural or a legal person.
In our view, the doctrine of the Spanish Supreme Court correctly articulates the tension between inspection powers and fundamental rights. Entry into the digital home —access to emails, servers and clouds— simultaneously invades several of the rights of article 18 of the Spanish Constitution, not only the inviolability of the home. An authorisation that confines itself to empowering physical entry without pronouncing on the digital scope leaves the other fundamental rights unprotected. The requirement of specific and differentiated reasoning is, therefore, a natural consequence of the guarantee system itself.
The procedural consequence is relevant. Where the judicial order is substantively defective —generic reasoning, absence of individualised pronouncement on digital access, failure to evidence the subsidiarity principle—, the doctrine of the Spanish Supreme Court leads to the unusability of the evidence obtained on entry, in accordance with article 11.1 of the Organic Law on the Judiciary and with the constitutional doctrine on illicit evidence.
The practical consequence for the contributor faced with an entry request is articulated in several steps.
It is advisable, first, to examine the effective coverage of the judicial authorisation: validity, express identification of the place and of the fact investigated, objective scope of the inspection. And, in particular, to verify whether the order specifically addresses access to computer repositories, servers or information in the cloud; if it does not, the inspection may not extend to those elements.
It is advisable, second, to expressly reserve spontaneous consent to any extension of the scope of the authorisation, without prejudice to not materially obstructing the action once the latter has been judicially authorised in its exact terms.
It is advisable, third, to prepare immediately —with legal assistance— the challenge of the order in those cases where substantive or procedural defects affecting the scope of the entry are perceived. A timely challenge opens the door to the subsequent declaration of unusability of the evidence obtained, with a reflex effect on the tax assessment and on any penalty.
For defensive purposes, it is also advisable to preserve a documentary trail of the action: copy of the order, record of the entry, identification of the devices on which the action took place, scope of the imaging, reservations made. That documentation is the basis of any subsequent challenge.
In conclusion, what this new doctrine of the Spanish Supreme Court makes clear is that the constitutional protection of the home is today projected, in full, over the digital sphere: the judicial authorisation of entry is only valid where it specifically and individually motivates access to the different rights of article 18 of the Spanish Constitution affected —notably, emails, servers and data stored in the cloud—, without the generic authorisation to enter the physical home being sufficient to legitimise the massive imaging of digital information.
Sources
- Spanish Supreme Court, Contentious-Administrative Chamber, Second Section, judgment no. 1122/2024 of 25 June 2024, cassation appeal no. 7845/2022 (ECLI:ES:TS:2024:3662), rapporteur Mr Dimitry Berberoff Ayuda.
- Spanish Supreme Court, Contentious-Administrative Chamber, Fourth Section, judgment of 2 July 2024, cassation appeal no. 5831/2023.
- Spanish Supreme Court, Contentious-Administrative Chamber, judgment of 23 September 2021, cassation appeal no. 2672/2020.
- Spanish Supreme Court, Contentious-Administrative Chamber, judgment of 14 June 2023, cassation appeal no. 6104/2022.