Puškár: Tax Fraud Lists, Court Access, and the Limits of Procedural Barriers

Case C-73/16 | Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy | Court of Justice of the European Union | Second Chamber | 27 September 2017

Practice Takeaways: ① A public-interest purpose does not dispense with a legal mandate, necessity, or sufficient grounds for individual inclusion. ② A preliminary administrative procedure must preserve effective court access, including through safeguards against substantial delay, excessive costs, and expired limitation periods. ③ Evidence obtained without the controller’s legally required permission cannot automatically be excluded. ④ Access rights matter when assessing whether exclusion is proportionate.

Can tax authorities place someone on a list of suspected company “front men” without asking permission? And can the person challenge that processing if national procedural rules stand between the complaint and a court—or prevent the person from relying on the list itself?

In Puškár, the Court examined both the authority’s justification for processing and the individual’s practical ability to contest it. Tax collection and combating tax fraud could support processing without consent. But the relevant authority needed a legal mandate, the processing had to be necessary, and there had to be sufficient grounds for naming the individual. Procedural requirements likewise needed to satisfy the right to an effective remedy.

NOTE: The judgment interpreted Directive 95/46, the GDPR’s predecessor. Its analysis of public-interest processing remains relevant to Article 6(1)(e) GDPR. Its separate conclusions about administrative remedies require attention to the GDPR’s remedies framework and later case law.

Practice Tip: Assess the justification for maintaining a register and the justification for including each person separately. A legitimate institutional purpose does not establish that every entry is lawful.

What happened

According to Puškár, the list contained 1,227 natural persons (which the public authorities refer to by the expression ‘white horses’) associated with 3,369 legal persons. It linked individuals, generally identified by national identity and tax identification numbers, to companies in which they were regarded as acting as fronts in director roles. The Financial Administration Criminal Office confirmed the list’s existence but said the Finance Directorate had drawn it up. (Judgment, paras. 26–27.)

Puškár sought an order preventing the authorities from including him on that or similar lists and requiring them to delete references to him from the lists and the financial administration’s IT system. The Supreme Court initially rejected actions brought by him and two other individuals on procedural or substantive grounds. The Constitutional Court set those judgments aside, finding infringements of fundamental rights, and returned the cases for reconsideration. (Judgment, paras. 25–31.)

A further complication concerned the evidence. The list was protected against unauthorized disclosure or access, and Puškár did not claim to have obtained it with the authorities’ legally required permission. The Supreme Court asked whether that meant it had to refuse the list as evidence. (Judgment, paras. 28, 32.)

Why the case matters

Government registers can do more than collect facts. Associating someone with suspected misconduct can affect reputation, dealings with public authorities, and the business activities of associated companies—even where the register is not publicly available.

The case therefore connects substantive data protection safeguards with the procedures needed to enforce them. The authority must justify its processing, while the person affected must have a meaningful opportunity to challenge that justification.

A defensible reason to maintain a list does not establish a defensible reason to put a particular person on it.

The judgment also shows why confidentiality and effective judicial protection must be considered together. Protecting an internal document, including other people’s data, is a legitimate concern. Whether that concern justifies keeping the document out of a particular lawsuit requires a separate assessment.

Key holding

The Court reached three principal conclusions:

1. Prior administrative remedies could be required under the Directive, subject to effective judicial protection.The procedure could not disproportionately burden court access, particularly through substantial delay, excessive costs, or failure to suspend the relevant limitation period. (Judgment, para. 76.)
2. The list could not automatically be excluded because the claimant lacked permission to obtain it. Exclusion required a basis in national legislation, respect for the essence of the right to an effective remedy, and proportionality. (Judgment, para. 98.)
3. The public-interest basis could support the list without consent. The authorities needed the relevant statutory tasks, the list and individual entries had to be appropriate and necessary, sufficient indications had to support inclusion, and the remaining data protection requirements had to be satisfied. (Judgment, para. 117.)

The Court’s analysis

1. Tax administration was within the Directive’s scope

The names and identifiers were personal data, and recording and using them in the list constituted processing. The more contested issue was whether the Directive’s exclusion for certain State activities, including activities in the criminal-law sphere, applied. (Judgment, paras. 33–35.)

• The Court interpreted that exclusion narrowly. The information appeared to have been collected for tax collection and combating tax fraud, rather than specifically for criminal proceedings. Its possible later use in such proceedings did not change that assessment. The conclusion remained subject to the national court’s factual determinations. (Judgment, paras. 36–44.)
• The Directive itself also allowed legislative restrictions on certain rights to protect important financial interests, including taxation. That mechanism presupposed that tax-related processing could fall within the Directive in the first place. (Judgment, paras. 42–43.)

2. A preliminary administrative complaint could serve legitimate objectives

Requiring an administrative complaint adds a step before a person can obtain judicial protection. It may cause delay and additional expense. The Court therefore treated the requirement as a limitation on the right to an effective remedy under Article 47 of the Charter, requiring justification under Article 52(1). (Judgment, paras. 61–62.)

• There were legitimate reasons for a preliminary complaint: the authority could correct unlawful conduct without litigation, unnecessary proceedings could be avoided, and any subsequent court would have an administrative record on which to draw. (Judgment, paras. 66–69.)

Those benefits did not settle whether the particular procedure was lawful. The national court had to examine its practical operation, especially whether:

• It substantially delayed bringing legal proceedings.
• The relevant limitation period was suspended while administrative remedies were pursued.
• Its costs, added to the costs of litigation, created an excessive burden.

The Court also drew on earlier judgments concerning preliminary dispute resolution, including safeguards relating to urgent interim measures and access through means other than exclusively electronic procedures, applying those conditions with the necessary adaptations. (Judgment, paras. 70–76.)

A person cannot meaningfully be required to complete an administrative procedure while the time available to bring the judicial claim expires. Nor can a preliminary procedure undermine the right to have the dispute resolved within a reasonable time. (Judgment, paras. 73–75.)

3. Evidence obtained without permission required a proportionality assessment

The evidence issue concerned the authority’s permission to obtain its internal list. That is distinct from the data subject’s consent as a lawful basis for processing.

The Court held that excluding the list as proof of an alleged data protection infringement would itself restrict the right to an effective remedy. The national court therefore had to establish that exclusion was provided for by national legislation, respected the essence of judicial protection, and was necessary and proportionate. (Judgment, paras. 87–91.)

• Preventing unauthorized use of internal documents could serve a legitimate general-interest objective. Protecting other people’s personal data on the list also mattered. But those interests required an assessment of the circumstances, including whether the list’s existence and Puškár’s inclusion were disputed and whether other evidence was available. (Judgment, paras. 90–93.)
• The right of access was particularly significant. If Puškár was entitled to access the personal data concerning him, excluding the evidence because he lacked the controller’s permission appeared disproportionate. Any restriction on information or access rights needed a legislative basis and justification under the Directive. Even where confidentiality was justified, the court had to consider whether other means could protect it within the proceedings. (Judgment, paras. 94–97.)

The Court did not establish a universal rule admitting all unlawfully obtained evidence. It required a legally grounded, proportionate decision about exclusion. (Judgment, para. 98.)

Practice Tip: Consider whether redaction, restricted disclosure, or other procedural safeguards can protect confidentiality and third-party data while allowing the claimant to substantiate the alleged violation. These are practical ways to address the Court’s requirement to consider alternatives.

4. Consent was one lawful basis among several

The absence of consent did not resolve the lawfulness of the list. Article 7 of the Directive provided an exhaustive set of alternative lawful bases. Article 7(e) permitted processing necessary for a task carried out in the public interest or the exercise of official authority. Tax collection and combating tax fraud could qualify. (Judgment, paras. 104–108.)

That conclusion required several further checks.

5. The authority needed a legal mandate encompassing the processing purpose

The national court had to determine whether Slovak legislation had entrusted the relevant tasks to the authorities compiling or receiving the list. A public purpose alone did not establish that a particular body had authority to conduct the processing. (Judgment, para. 109.)

• Purpose limitation also mattered. Because the processing purpose was inseparably linked to the public task, the legal assignment of that task had to encompass the purpose of the processing clearly. (Judgment, para. 110.)

6. Necessity had to be established for the list and the individual entry

The national court had to examine the list’s precise purpose, its effects, and whether it was public. It also had to consider whether the objectives could be achieved through less restrictive means. (Judgment, paras. 111–113.)

• That assessment extended to individual inclusion. Being listed could damage a person’s reputation and dealings with tax authorities, affect the presumption of innocence, and affect the freedom to conduct a business of associated companies. The Court therefore required sufficient grounds for suspecting the person of acting as a nominal director in a way that undermined tax collection and efforts against tax fraud. (Judgment, para. 114.)

7. A lawful basis did not replace the remaining data protection requirements

Even if the public-interest basis supported the processing, the authorities still had to satisfy the Directive’s other requirements, including data quality and information and access obligations. Any permitted restriction needed to be necessary for a recognized interest and based on legislation. (Judgment, paras. 115–117.)

Practice Tip: Document both the need for the register and the evidence supporting each inclusion. Public-task authority does not dispense with accuracy, necessity, or individual safeguards.

The Advocate General’s Opinion

Advocate General Juliane Kokott’s Opinion, delivered on 30 March 2017, developed the connection between procedural rules and effective judicial protection. Both a mandatory administrative complaint and an evidentiary exclusion could impair enforcement of EU rights and therefore required scrutiny under the Charter. (Opinion, points 46–70 and 78–93.)

• She also distinguished the Slovak administrative complaint, directed to the competent administrative bodies, from a complaint to the independent data protection supervisory authority. That distinction helps prevent the procedural holding from being read too broadly. (Opinion, points 37–45.)
• On the list itself, she emphasized the need for a legally assigned task, proportionate processing, and sufficient grounds for naming the individual. She also explained that a restriction permitting confidentiality could not resolve whether Puškár properly belonged on the list. (Opinion, points 99–113.)

The judgment largely followed that approach on the issues it decided.

What the Court did—and did not—decide

The Court established conditions under which tax authorities could maintain a list without consent. It did not declare that the contested list, or Puškár’s inclusion, met those conditions. Those assessments remained for the national court. (Judgment, paras. 109–117.)

The judgment also did not require automatic admission of every document obtained without authorization. It required courts to justify exclusion by reference to legislation, the essence of judicial protection, and proportionality. The claimant’s access rights and the availability of other confidentiality safeguards were relevant to that assessment. (Judgment, paras. 87–98.)

The procedural holding needs particular care.

• In BE v Nemzeti Adatvédelmi és Információszabadság Hatóság, Case C-132/21, the CJEU held that the supervisory-authority route under Articles 77 and 78 and the judicial remedy under Article 79 may be pursued concurrently and independently. Member States must regulate their relationship consistently with effective protection and consistent application of the GDPR. (Judgment of 12 January 2023, paras. 30–57.)
• Accordingly, Puškár should not be cited as establishing a general GDPR requirement to exhaust the supervisory-authority complaint process before suing a controller or processor. Its enduring procedural lesson is that national rules governing access to justice and evidence remain subject to effective judicial protection.

Conclusion

Puškár requires scrutiny of both the public authority’s processing and the individual’s ability to challenge it.

A public task may justify processing without consent, but the legal mandate, necessity of the register, and grounds for naming each person remain essential. Administrative requirements and evidentiary rules must likewise preserve an effective opportunity to obtain judicial protection.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-73/16, Peter Puškár.

• Court of Justice of the European Union, Second Chamber, Case C-73/16, Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy, Judgment of 27 September 2017, ECLI:EU:C:2017:725. Read the Judgment.
• Opinion of Advocate General Juliane Kokott, Case C-73/16, delivered 30 March 2017, ECLI:EU:C:2017:253. Read the Opinion.
• Regulation (EU) 2016/679, particularly Articles 5, 6, 23, and 77–79. Read the GDPR.

Useful reading from The de la Torre Review

• Material Scope of the GDPR — Explains which processing operations fall within the GDPR and the limits of its exclusions. Provides the broader framework for Puškár’s conclusion that tax-related processing did not fall outside the Directive merely because the information might later be used in criminal proceedings. Read the Article.

Related case law

• ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing — Explains why the Directive’s lawful bases formed an exhaustive and restrictive list, which Member States could clarify but could not rewrite. Puškárexpressly relies on ASNEF at paragraph 105, providing the foundation for assessing whether the public-interest basis could justify the tax authorities’ processing without consent. Read the Article.
• Huber: “Necessary” Really Means Necessary — Explains why a legitimate public task does not, by itself, justify every collection, use, or disclosure of personal data. Provides context for Puškár’s requirement that both maintaining the tax-fraud list and including particular individuals be appropriate and necessary, with consideration of less restrictive alternatives. Read the Article.
• Bara and Others, C-201/14 — Cited in Puškár on tax data, the cumulative requirements for lawful processing, and the need for legislative measures to restrict information and access rights. (Judgment, paras. 34, 41, 96, 104.) Read the Judgment.
• BE v Nemzeti Adatvédelmi és Információszabadság Hatóság, C-132/21 — Later GDPR authority explaining the concurrent and independent exercise of administrative and judicial remedies. Read the Judgment.
• Tele2 Sverige and Watson and Others, Joined Cases C-203/15 and C-698/15 — Cited for the requirement that limitations on personal data protection remain strictly necessary. (Judgment, para. 112.) Read the Judgment.
• What Is “Public Task” under the GDPR? — Explains the legal foundation and necessity requirements for processing under Article 6(1)(e). Provides the broader framework for understanding Puškár’s conclusion that tax authorities could process personal data without consent, provided their legally assigned tasks encompassed the processing and both the list and individual inclusion were justified. Read the Article.
• What Is “Consent” under the GDPR? — Explains why consent is one of six lawful bases, rather than the default requirement for processing personal data. Helps place Puškár in context: the absence of consent did not establish unlawfulness where the public-interest basis could apply, subject to necessity and the remaining data protection safeguards. Read the Article.