Luxembourg v B and others – Striking the right balance? New landmark case on human rights and tax law within EU legal framework


20 Oct 2020

Do the ends justify the means? In early October the CJEU delivered a landmark decision in the joint case of C-245/19 and C-246/19 of Luxembourg v B and Others – the ‘F.C case’. This short article shall summarize some of the most important points discussed by the Court.

It is always big news for tax practitioners and lawyers when a new case appears on a European level involving tax and human rights. This time is no exception. When mandatory duties and statutory obligations are involved, there is always a question of balancing the rights of an individual vis-à-vis the State. The decision in a joint case of C-245/19 and C-246/19 of Luxembourg v B and Others revolved around the interpretation of the Directive on Administrative Cooperation in the Field of Taxation[i] [the ‘Directive’] and the Charter of Fundamental Rights of the European Union [the ‘Charter’]. The Charter can be invoked by a party which feels that its rights stipulated therein have been violated by EU law or when a Member State is implementing and applying EU law.

The Directive provides for a framework of exchange of information, whereby the public authorities of Member States may issue requests to each other for information on taxpayers. Persons, both legal and natural, like banks, corporate service providers, etc. who possess relevant information may then be subject to an administrative inquiry to provide the said information. The Directive also establishes that the provisions of the General Data Protection Regulation [ii] [the ‘GDPR’] apply. This is provided, that the Member States must limit the rights of notification and access to the information by the taxpayer when an inquiry is being made in relation to him. However, at the same time, the taxpayer who feels that his data privacy rights have been violated due to the inquiry must have an ‘effective judicial remedy’ – and this is without prejudice to any administrative and non-judicial remedies, including complaints to the data handling authority of the Member State.

The law of Luxembourg used to stipulate that there could be no appeal/administrative challenge for the request for the exchange of information itself.[iii] It did, however, state that the tax administration had to review the request to make sure that it was a relevant one, and that the said request met certain statutory requirements such as stating the legal basis, listing the parties concerned, etc. The law also provided for a penalty clause – failing to give the relevant information to the authorities could raise a liability of up to €250,000.

While the law did not explicitly allow for a way to directly challenge the request for the exchange of information, the juridical practice did provide for a right to an administrative review of the imposition of a penalty to be heard by the Administrative Tribunal.

Both cases concerned an individual ‘F.C’ – Spanish authorities made two separate inquiries to Luxembourg in the context of tax investigations.

National Proceedings

In the case of C-245/19 – ‘F.C I’ the Luxembourg tax authorities [on a request from the Spanish tax authorities in relation to tax investigations of a Spanish national] requested certain information on a taxpayer from a private company. The information requested was contents of contracts, invoices, and details of bank accounts in relation to the taxpayer. The request also stated that it could not be appealed against, citing specific statute to that effect. Nevertheless, the taxpayer applied to the Administrative Tribunal to seek alteration or annulment of the decision to request information. The Administrative Tribunal saw itself competent to hear the case [even though the law explicitly stated the contrary] and decided to partially annul the request. The Tribunal stated that the Luxembourgish law implementing the Directive was in violation of Article 47 of the Charter which provides:

‘Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article.’

The Tribunal came to that conclusion due to the lack of a statute allowing direct challenge of the decision to request exchange of information. Luxembourgish authorities appealed to the Administrative Court arguing, among other things, that the request for an exchange of information could be challenged indirectly through an appeal of an administrative fine for non-compliance.

The case of C-245/19 – ‘F.C II’ concerned the second request also originating from the Spanish tax authorities and conveyed through their Luxembourgish counterpart. This time the Luxembourgish tax authorities requested an exchange of information from a bank. The request detailed a broad set of information including, among other things, the list of accounts & accountholders, beneficial owners and financial asset statements. Again, the parties concerned brought the decision under scrutiny to the Administration Tribunal which, again, partially annulled the decision based on similar grounds as specified earlier.

The reference for a preliminary ruling from the Administrative Court asked the CJEU[iv] whether the Charter allows Member States to not provide the parties concerned with a right to a direct legal challenge of a decision to request an exchange of information within the framework of the implementation of the Directive on Administrative Cooperation in the Field of Taxation.

The referring court cited Article 6 of the Charter [Right to a Private Life], Article 8 [Protection of Personal Data] and Article 52 [Interpretation of the Charter].

Legal Analysis

The case not only dealt with the question of the effective remedy, but also, who could enjoy it.

The CJEU first noted that the right to private life, protection of personal data and, most importantly, the right to an effective remedy are not absolutely prerogatives of the persons enjoying them. This line of reasoning is nothing new, but an established juridical line of thought both in EU case-law and in local jurisprudence of Member States.

The Court then laid down the groundwork of its reasoning first by stating that it is the general EU law principal that a person has protection against arbitrary and disproportionate interference in the protection of his fundamental rights from the public authorities of the Member States. It then went on to reason that in general, Article 47 of the Charter would imply that the person who is subject to the request within the tax investigation context must have legal remedy to challenge it. The question is then whether this right can be limited on any grounds. The answer is ‘Yes’ if certain conditions are met. Indeed, Article 52(1) of the Charter provides that limitations to the rights must be subject to the principle of proportionality.

The Court noted that the Directive made reference to the GDPR, in particular Article 79 – right to an effective judicial remedy against violations of the personal data rights.

The question then becomes - ‘What is ‘effective’ remedy?’ An effective remedy, the Court recalls its previous case-law, is access to a court which has jurisdiction and the ability to examine questions of law and facts and to issue binding decisions. In particular, the court must be able to examine all the said questions.[v]

Luxembourg’s argument that the ability to challenge the decision to request information indirectly by not complying with it and thus incurring penalty which one must then challenge was not entertained by the Court. Quite obviously, for the Court, this did not constitute an effective remedy. Indeed, as per Unibet:

If, on the contrary…it [the party] was forced to be subject to administrative or criminal proceedings and to any penalties that may result as the sole form of legal remedy for disputing the compatibility of the national provision at issue with Community law, that would not be sufficient to secure for it such effective judicial protection.[vi]

This was decided in relation to the persons who were holding the taxpayer’s information. Thus, these types of persons have a right to directly challenge the request to provide information.

What about the taxpayer himself? Can the taxpayer whose information is being requested by a Member State as part of a tax investigation challenge the request directly himself as well? One would instinctively think ‘Yes’. But the matter is complicated.

The Court did acknowledge the right to a private life as stipulated in Article 7 of the Charter and that the person whose rights in that field may be violated during the exchange of sensitive information should have a right to effective remedy. However, limitations to the right to an effective remedy may apply, if the national law of the Member State explicitly provides for it and the said limitation is proportionate vis-à-vis the objectives it is trying to achieve.  

The Court first acknowledged that the initial requirement of the limitation being explicitly spelled out in the statute book was met – the legal basis of the limitation was clear and precise in the law of Luxembourg.

Then, the Court reasoned that the right to an effective judicial remedy [in case of a taxpayer] does not mean access to a direct remedy per se, when there are alternative effective remedies available. Deutsche Lufthansa­ was cited where the Court noted that there is no need to have a ‘free-standing’ action so long as there are alternative means to challenge the matter and the principle of effectiveness, that is, the alternative must not make it practically impossible or excessively hard to protect one’s rights, is met.[vii]

The Court commented that the taxpayer is not the addressee of the request and hence does not suffer from penalties in the case of non-compliance – this is questionable reasoning to justify differentiation between the taxpayer and the other party holding the taxpayer’s information and something the Attorney General questioned as well in his reasoned opinion. The Court implied that by not being subject to a penalty or a legal obligation to disclose information, the taxpayer was running a lower risk, and hence this justified differentiation in terms of access to an effective judicial remedy.

Another of the cases invoked in support of this argument was P - Commission v Jégo-Quéré where the Court allowed indirect challenge to a Regulation to be sufficient for the purposes of satisfying Article 47, however, the applicability of the circumstances of that case are questionable vis-a-vis the case in discussion today.[viii]

Thus, for a taxpayer, the situation is different. According to the Court having a right to an administrative review is sufficient. Furthermore, for the Court, it was enough that alternative forms of redress as provided by the GDPR are available. The Court cited Unibet where it was ruled that the right to an effective judicial protection does not imply having access to a direct ‘free-standing’ judicial action when there are other effective legal remedies available – in that case a right for an administrative review was considered sufficient.

The Court also noted that because the request for exchange of information is issued during the preliminary stages of the tax investigations, the right to a fair trial or a right to be heard is not triggered yet. It is triggered, says the Court, when the investigation reaches the adversary/litigious stage – when the penalties, requests to amend the assessments, etc. start. Thus, according to the Court, the taxpayer has a right to indirectly challenge the request once the tax authorities issue further orders/demands based on the information provided by the said request.

Finally, the Court has ruled that the limitation on the right of effective remedy was justified on the grounds of combating tax fraud and evasion. Additionally, and interestingly, only in relation to the taxpayer, the Court referenced the need for efficiency and speed in administrative cooperation as another reason for justifying the limitations. This is an interesting reasoning, considering that the data controllers who are subject to the information request, as the Court ruled earlier, must have a right to directly challenge the request [which would inevitably lead to prolonging the process]. This begs the question – why then can the subject persons of the request prolong the process and have access to a direct challenge remedy, while taxpayers are left to wait for the subsequent action from the tax authorities?

In the end, the Court also rules on whether third parties concerned have the right to challenge the information request. In this case that would mean the third parties who are not the subject of the investigation but whose private information would also be revealed as part of the information provided to the requesting authority. The Court took the same line of reasoning as it did vis-à-vis the taxpayer – these persons are not subject to legal obligations nor penalties, the persons have a right to indirectly challenge the request at a later stage, and, the limitation is in line with the general interest of the Directive.

The Court’s conclusions should be contrasted with the arguments brought forward by the Attorney General Kokott. Kokott stated in his reasoned opinion that by not providing for a right to directly challenge the information order, the taxpayer’s and third parties’ rights under Article 47 of the Charter were violated.

Kokott argued that being able to challenge the hypothetical tax assessment which would follow from the information provided by the request could hardly be considered as effective remedy. What if the private information is provided but the tax authorities decide not to act? What if it is requested for other purposes and not for using a tax assessment? How could the person whose rights to personal data have been violated challenge the order then? The AG argued that the incidental right to challenge the order by challenging the subsequent assessment cannot constitute a remedy that could be characterized as ‘effective’ – it certainly would not be effective at protecting the taxpayer from an unlawful interferences of their protection of their personal data. It would ‘merely serve[s] to provide a defense against the perpetuation of the interference, but not against the interference itself’.[ix]

The judgment definitely strengthens the legislative and administrative power of the Member States in relation to tax investigations. This is done by undermining the right of the taxpayer to challenge the request for the exchange of information and giving the Member States a wider discretion in limiting the said right. It would not be surprising if this matter will be eventually raised to the level of ECHR. [x]

In paragraph 84 of the judgment, in particular, we find some self-contradiction. The Court comments that the law of Luxembourg prohibiting the challenge by the taxpayer of the decision to request information does not violate the right to access to an effective remedy and this is in compliance with Article 79(1) of the GDPR. However, how can the taxpayer know that his personal data is processed legally if not ex post facto once the possible violations have already occurred?

While the judgment gives some breathing space to the subject persons of the request, it leaves much to be desired in relation to the taxpayers. It is a realistic possibility that in the future we will witness further legal challenges on the information requests both on the EU and ECHR levels.


[i] Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing Directive 77/799/EEC.

[ii] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

[iii] This has been amended as of 1st Match 2019 with the right to directly challenge the information order.

[iv] Court of Justice of the European Union.

[v] Case C-199/11 - Otis and Others, para 49; Case C-433/18 - Aktiva Finants, para 36.

[vi] Case C-432/05 – Unibet, para 64.

[vii] Case C-379/18 - Deutsche Lufthansa AG – paras 61-62.

[viii] Case C-263/02 - P - Commission v Jégo-Quéré, para 35.

[ix] Joined Cases C‑245/19 and C‑246/19, Attorney General Opinion, Para 74.

[x] European Court of Human Rights.