Leitura 1

Prévia do material em texto

computer law & security review 35 (2019) 241–250 
Available online at www.sciencedirect.com 
journal homepage: www.elsevier.com/locate/CLSR 
The impact of GDPR on European Name & Shame 
tax defaulter lists 
Bernardo D. Olivares Olivares 
∗
University Complutense of Madrid 
a r t i c l e i n f o 
Keywords: 
Data protection 
Defaulters lists 
Taxpayers 
GDPR 
a b s t r a c t 
This research analyses and compares tax defaulters’ lists in Europe from the legal perspec- 
tive arising from the introduction of the General Data Protection Regulation. We examined 
various regulatory systems which reflect a cross section of these ‘Name & Shame’ lists in 
Greece, Ireland, Portugal, Spain and the United Kingdom. Our findings indicated some le- 
gal aspects that contravene the GDPR rules. As a solution we propose a minimum standard 
model that allows for the publication of tax defaulter information without impinging on 
citizens’ fundamental rights. 
© 2019 Bernardo D. Olivares Olivares. Published by Elsevier Ltd. All rights reserved. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
La Baya Baja (Elche), Alicante, 03292 Spain 
bernardo.olivares@icae.es 
ced Cross-Border Tax Information Exchange: Toward a Multilateral Taxpayer 
ka and Sebastiano Garufi, The Era of Exchange of Information and Fiscal 
of Good Governance in Tax Matters , 8 European Taxation, 394-408 (2012), 
oving VAT compliance – random awards for tax compliance , 51 European 
ineen, Europe moves towards a more transparent tax regime , 7 (17) Tax 
shame or not to shame: That is the question , 2 EJournal of Tax Research 
pecial: una reflexión retrospectiva , 167 Crónica Tributaria 183-184 (2017). 
rogeneous society: An evolutionary analysis , Economic Modelling, 42, 106- 
l Report , in Tax Secrecy and Tax Transparency. The Relevance of Confidentiality 
orck eds, Peter Lang GmbH, Frankfurt am Main, 2013) 27. 
t, in Tax Secrecy and Tax Transparency. The Relevance of Confidentiality in Tax 
ds, Peter Lang GmbH, Frankfurt am Main, 2013) 404-405; Kristina Äimä, 
fundamental rights , (IFA ed, Rotterdam, 2015), Philip Baker. Some Recent 
 European Taxation; 2-3 (2015) 107-110, and Alejandro Zapatero Gasco, 
1. Introduction 
The impact of the 2008 financial crisis has had significant eco-
nomic, social, and legal implications in the EU. The situation
decreased Member States incomes and increased their deficit
levels resulting in reduced levels of public spending. 
This situation led some EU countries to reform their tax
legislation by implementing measures to increase tax collec-
tion and combat tax fraud. One such action, amongst others
∗ Correspondence to: Bernardo David Olivares, Polígono 1, n. 60, 
E-mail addresses: bernardo@ucm.es , bolivares@goumh.umh.es , 
1 Arthur Cockfield, Protecting Taxpayer Privacy Rights Under Enhan
Bill of Rights , 2 (42) U.B.C. Law Review, 419-471 (2010), Alicja Brodz
Transparency: The Use of Soft Law Instruments and the Enhancement 
Jones Fooken, Thomas Hemmelgarn y Benedikt Herrmann, Impr
Commission Taxation Papers 1-24 (2014), Brian Duffy and May D
planning international: European tax service 4 (2015), K Datt, To 
486-505 (2016), and Laura Soto Bernabeu, La declaración tributaria es
2 Angelo Antoci and Paolo Russu, Tax evasion in a behaviorally hete
114 (2014). Also Eleonor Kristoffersson and Pasquale Pistone, Genera
in Tax Law (Kristoffersson, Lang, Pistone, Schuch, Staringer, and St
3 Kristina Äimä and Kenneth Hellsten, Finland, in General Repor
Law (Kristoffersson, Lang, Pistone, Schuch, Staringer, and Storck e
Finland , in IFA Cahiers vol. 100B: The practical protection of taxpayers’ 
Decisions of the European Court of Human Rights on Tax Matters.
La publicación de la lista de deudores como excepción a la reserva tributaria:
Fiscales, 259-273 (2016). 
https://doi.org/10.1016/j.clsr.2019.03.005 
0267-3649/© 2019 Bernardo D. Olivares Olivares. Published by Elsevier L
undertaken at the time, sought to address citizen’s discontent
by publishing tax defaulter lists.1 
In order to encourage better compliance with tax legisla-
tion some countries have introduced legal instruments with
the aim of exposing those who have failed to comply with
their duty to pay tax. Under the banner of more transparency 2
these countries use automated processing of taxpayers per-
sonal data as a tool to pursue tax fraud. These measures can
involve the publication of data within tax debtor registers 3
 una perspectiva comparada , 13 Documentos - Instituto de Estudios 
td. All rights reserved. 
https://doi.org/10.1016/j.clsr.2019.03.005
http://www.sciencedirect.com/science/journal/02673649
http://www.elsevier.com/locate/CLSR
http://crossmark.crossref.org/dialog/?doi=10.1016/j.clsr.2019.03.005&domain=pdf
mailto:bernardo@ucm.es
mailto:bolivares@goumh.umh.es
mailto:bernardo.olivares@icae.es
https://doi.org/10.1016/j.clsr.2019.03.005
242 computer law & security review 35 (2019) 241–250 
i
(
v 
H 
U
(
(
t
l
d
n
c
s
m
t
c
a
a
b
s 
o
r
fl
d
b
r
a
S
v
1
s
u
s
G
o
1
c
p
a
F
i
p
R
u
r
i
C
I
t
S
2
2
T
t
n
b
d
r
o
p
G
p
d
b
d
n 
M
i
t
i
s
o
w
ncluding a defaulter’s income and wealth,4 their tax debt 
including penalties incurred), and any associated legal con- 
ictions.5 These measures were introduced in Ireland (1997),
ungary (2003), Slovakia (2004), Portugal (2007), Sweden (2008),
nited Kingdom (2010), Greece (2011), Bulgaria (2012), Croatia 
2012), Romania (2012), Slovenia (2013), Estonia (2014), Finland 
2014), and Spain (2015).6 
Among the measures undertaken are tax defaulter lists. In 
he majority of cases, the legislation which allows for the pub- 
ication of taxpayers data by naming and shaming was passed 
uring the financial crisis. This endeavoured to address the 
eed to mitigate social discontent and apathy towards demo- 
ratic values and financial institutions. However these mea- 
ures are controversial as they hugely impact certain funda- 
ental rights such as the rights to private and family life and 
he protection of personal data. Moreover, we are dealing with 
ases where the illicit behaviour has already been pursued 
nd penalised. 
With the aim of improving the system and framing propos- 
ls for selected countries we examined the legal framework 
ehind tax defaulter lists in order: (i) to compare the legal and 
ocial reasoning behind tax defaulter listing; the subjective,
bjective formal and temporal scope of these lists; and the 
easons for exemptions; (ii) to determine the degree of con- 
ict with the fundamental right to the protection of personal 
ata; (iii) to propose a minimum standard model to strike a 
alance between the opposing legal and social interests. 
To achieve these objectives, we selected the following Eu- 
opean countries: Ireland, United Kingdom, Portugal, Spain 
nd Greece. These are the only countries which use Name & 
hame lists and reflect two different perspectives of privacy 
is a vis tax law compliance. On the one hand Ireland 
7 and 
4 See Laki verotustietojen julkisuudesta ja salassapidosta , n. º
346/1999. 
5 EC Tax collection practices Report (2013-2014) collect a good 
ample of countries. 
6 Bernardo D. Olivares Olivares, La publicidad de los deudores trib- 
tarios desde la perspectiva del derecho a la protección de los datos per- 
onales , 11 Quincena Fiscal 17–43 (2016), and Ana María Delgado 
arcía and Rafael Oliver Cuello, Regulations governing the publication 
f details of tax debtors and fraudsters , 23 Internet Derecho y Política 
–11 (2016), and Bernardo D Olivares Olivares, Las listas de los in- 
umplidores tributarios en Europa desde la perspectiva del derecho a la 
rotección de datos personales , 14 Quincena Fiscal 68–72 (2017). Also, 
bout the measures in other countries Annual report 2014 of the 
innish Tax Administration, at page 16: ‘The existence of the Reg- 
ster is also a general incentive for compliance with reporting and 
ayment obligations’ and E. Kristoffersson and P. Pistone, General 
eport, supra, at page 29:‘The publication of lists of taxpayers is 
sed in order to promote taxpaying. They are used either as car- 
ots or as sticks’. Some of the mentioned measures were analysed 
n the Fiscalis Workshop 2014 organised by the EU Joint Research 
entre, https://ec.europa.eu/jrc/ (29/05/2016). 
7 Section 1086 of the Taxes Consolidation Act 1997, and Statutory 
nstrument 643 of 2010. 
r
s
A
t
c
l
6
d
2
ç
A
a
c
p
o
p
T
m
t
he United Kingdom 
8 and on the other Greece,9 Portugal 10 and 
pain.11 
. The legal impact of Name & Shame lists 
.1. Legal interests disputed 
he disclosure of a tax defaulter’s identity has its origin in 
he various legal responses by legislatures facing situations of 
on-compliance within the tax system. This action is justified 
y the underlying financial interest of each state to collect its 
ue tax, but also lends itself to greater taxpayer transparency 
ules which in turn nudge all citizens to comply with their tax 
bligations.12 
This course of action may nevertheless fall foul of a tax- 
ayer’s right to protection of their personal data, governed by 
DPR.13 This right grants subjects the power to control the 
rocessing of their personal information, and requires that the 
ata be processed lawfully, fairly and in a transparent manner 
y data controllers.14 
Furthermore GDPR mandates that personal information 
isclosure must be adequate, relevant and limited to what is 
ecessary in relation to the purposes for which it is processed.
oreover, data must be accurate, kept up to date and disclosed 
n a form which permits identification of subjects for no longer 
han it is necessary.15 Additionally, subjects must be expressly 
nformed of their rights and the impending processing of per- 
onal data. But data subject rights are not absolute and may 
n occasion have to cede to other competing interests as we 
ill analyse. 
Tax information disclosure is an exception to the general 
ule of tax confidentiality in all the selected countries. For in- 
tance in Ireland, Section 1086(3) of the Taxes Consolidation 
ct 1997, states that: ‘Any obligation to secrecy imposed on 
he Revenue Commissioners by –the Acts or the Official Se- 
rets Act, 1963, is to be ignored (…) for publication of these 
ists’. In Portugal, tax confidentiality is recognised in article 
4.1 of the Portuguese Lei Geral Tributária: ‘ Não contende com o 
ever de confidencialidade: a) A divulgação de listas de contribuintes 
8 Section 94 of the Finance Act 2009, and Statutory Instrument 
010, n. 574. 
9 Article 9 under Law 3943/2011, and Circular 1185/2011. 
10 Article 64 da Lei General Tributária, seções 5 y 6, and Autoriza- 
ão n. º 676/2006, de 19 de Junho of the Portuguese Data Protection 
uthority. 
11 Article 95 bis Ley General Tributaria 58/2003. 
12 As we will analyse later in the paper, in the UK and Irish cases 
lso will be a public interest in the publication of details relating to 
riminal offences/convictions for the sake of increasing the trans- 
arency of criminal justice systems and raising public awareness 
f convicted criminals. 
13 This right is recognised expressly in the article 8 of the Euro- 
ean Union Charter of Fundamental Rights and article 16 of the 
reaty on the Functioning of the European Union. In addition, it is 
ainly legally developed by the General Data Protection Regula- 
ion. 
14 Article 5.1 (a) GDPR. 
15 Article 5.1GDPR. 
https://www.ec.europa.eu/jrc/
computer law & security review 35 (2019) 241–250 243 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
cuja situação tributária não se encontre regularizada ’.16 In Spain
Article 95.1 of the Ley General Tributaria also states secrecy as
the general rule during the processing of taxpayers’ informa-
tion: ‘ Los datos, informes o antecedentes obtenidos por la Adminis-
tración tributaria en el desempeño de sus funciones tienen carácter
reservado’ .17 But the list is also an exemption to confidential-
ity because Article 95 bis permits ‘…la publicación periódica de
listados comprensivos de deudores a la Hacienda Pública por deudas
o sanciones tributarias ’.18 
The next step in our research was to analyse and compare
the legal framework within which each tax defaulter list lies.
This task is possible because the jurisdictions involved have
common structural elements from which the comparison is
conceivable. Each country has norms regulating why a tax-
payer must be included, who may be exempted from the pub-
lished list, for how long and by what means (i.e. publishing
channel) the information is disclosed. 
2.2. Name & Shame: prerequisites and exemptions 
As outlined below, tax defaulter lists involve published in-
formation from which the identity of a natural person can
be ascertained.19 As a consequence, the processing and later
disclosure is subject to GDPR rules. 
In Spain, the Tax Administration publishes the identity of
tax defaulters when their tax debts and/or penalties equal
or exceed € 1000,000, and only after the tax payment period
has expired. The Tax Administration only considers debts and
penalties (deferred or suspended with its approval) at the mo-
ment of compiling the list.20 
In Ireland the defaulter’s identity is divulged only when a
court imposes a financial penalty (including those related to
taxation),21 and for failing to comply with the norms set down
in Section 1086 of the Taxes Consolidation Act of 1997 or any
instruments made thereunder.22 Additionally, the inclusion
on the list is carried out when Irish Revenue initiates tax col-
lection procedures in cases where the taxpayer had previously
failed to file tax returns correctly and has subsequently made
a settlement with Revenue.23 
It is important to note that in Ireland there is no minimum
threshold for inclusion on the tax defaulter list. The legis-
lation is aimed at sanctioning certain behaviour; specifically
16 The duty of confidentiality does not conflict with: a) The dis- 
closure of lists of taxpayers whose tax situation is not regularized. 
17 The data, reports or background obtained by the tax adminis- 
tration in the performance of its functions are reserved. 
18 The periodic publication of comprehensive lists of debtors to 
the public treasury for debts or tax sanctions. About Tax confi- 
dentiality in Spain see Marina Serrat Romaní, La banalización de 
los datos con relevancia tributaria . In Ignacio Colomer Hernández dir. 
Cesión de datos personales y evidencias entre procesos penales y 
procedimientos administrativos sancionadores o tributarios 795- 
807 (Aranzadi, 2017). 
19 Article 4.1 GDPR. Any information relating to an identified or 
identifiable natural person (‘data subject’). 
20 Article 95 bis 1.b) Ley General Tributaria. 
21 Notes for Guidance – Taxes Consolidation Act 1997 – Finance 
Act 2014 Edition - Part 47, 38. 
22 Section 1086(2[b]) of the Taxes Consolidation Act 1997. 
23 Section 1086(2[c]) of the Taxes Consolidation Act, 1997 and Sec- 
tion 1086(2[d]) of the Taxes Consolidation Act 1997. 
 
 
 
 
 
that which results in a financial penalty being imposed due to
tax related transgressions. However, there is an exception ap-
plicable but only in those cases where the taxpayer consents
to pay a specified sum of money in settlement for any claim by
the Irish Revenue. In this case, the minimum threshold to be
added to the defaulters’ list must exceed € 33,000. Otherwise
the taxpayer remains anonymous.24 
But the monetary value is not the sole exception. The
Irish legislation acknowledges three further exceptions to
publication 
25 : 
(i) When the taxpayer makes a full disclosure to the Irish
Revenue prior to an investigation taking place. 
(ii) When the taxpayer is subject to a tax amnesty governed
by Section 72 of the Finance Act 1988, and Section 3 of
the Waiver of Certain Tax, Interest and Penalties Act
1993. 
(iii) When the fine does not exceed 15% of the taxdebt. 
Another feature of this list is that the payment does not
exempt the tax debtor from appearing on the Name & Shame
list. The information is processed and stored on the website
for an unlimited period. After analysis we see that Ireland is an
exception in this regard as all other countries limit the length
of time a citizen appears on the list. 
Portugal’s article 64.5 of the Lei Geral Tributária mandates
that to appear on the list it is necessary that the taxpayer has
failed to pay his or her taxes, which means that the voluntary
period to fulfil and pay the taxes must have expired, and it
therefore must occur during the enforcement period.26 
The law establishes two further prerequisites to include a
tax debtor on the list: 
(i) The expiration of the deadline to file an appeal against
the Tax Administration for the amount due. 
(ii) The notification of the debtor by the Tax Administration
of their inclusion on the list.27 
The minimum tax debt owed in order to be included on the
list is €7500 for natural persons and €10,000 for legal persons.28
The tax debt is subdivided further in order to present levels
of indebtedness. The minimum and maximum amounts for
natural persons ranges between €7500 and €25,000, with the
upper limit of €1000,000; and in the case of legal persons, it
ranges between €10,000 and 50,000 with the maximum thresh-
old set at €5000,000.29 
24 This amount is regulated under the Statutory Instrument 
643/2010. 
25 Section 1086 (4) Tax consolidation Act de 1997. 
26 Article 64.5, (a) da Lei Geral Tributária. 
27 Paragraph 4, ‘Relatório’ Autorização 676/2006, proceso n. º
1696/2006, Portuguese Data Protection Authority. 
28 https://www.e-financas.gov.pt/pubdiv/de-devedores.html 
(07/03/2018). 
29 Article 64.5 under Lei Geral Tributária: A divulgação de listas de 
contribuintes cuja situação tributária não se encontre regularizada, des- 
ignadamente listas hierarquizadas em função do montante em dívida . 
https://www.e-financas.gov.pt/pubdiv/de-devedores.html
244 computer law & security review 35 (2019) 241–250 
(
e
a
m
a
R
i
n
fi
i
d
r
o
i
c
a
f
L
l
E
s
u
h
p
f
L
K
c
P
(
i
n
p
t
a
c
w
a
&
(
t
t
d
c
w 
t
a
b
t 
s
t 
c
l 
c 
t
( 
t
v
t
o
t
o
s
Nevertheless the Portuguese Data Protection Authority 
PDPA) 30 further limits inclusion on the list by establishing five 
xceptions: 
(i) When the payment of the tax debt is deferred. 
(ii) When a special administrative appeal, under the Code 
of Procedure of the Administrative Courts has been 
filed.31 
(iii) When the taxpayer has requested a deferral of payment 
or is prepared to pay the debt with a property and a de- 
cision thereon has not yet been reached. 
(iv) When the taxpayer has obtained the suspension of a 
property seizure process, until the dispute has been re- 
solved. 
(v) When the taxpayer is involved in insolvency proce- 
dures, an extrajudicial conciliation procedure permitted 
by law; or when the notification of the personal citation 
to be included in the list had not been made. 
In the United Kingdom the inclusion takes place after an 
ssessment process which depends on three verifications that 
ust be positive: 32 there must be a relevant tax penalty 33 as 
 consequence of an investigation conducted by Her Majesty’s 
evenue and Customs (HMRC); 34 the relevant penalty must be 
mposed when the maximum reduction to the tax debt has 
ot been awarded,35 and the taxpayer action must be classi- 
ed as potential lost revenue, which occurs when the loss of 
ncome for HMRC is in excess of £25,000.36 
The regulation has two exceptions. The first, does not allow 
isclosure until the penalty becomes final.37 The second is a 
elative exception because it is ultimately left to the discretion 
f the deputy director of HMRC to make the final decision of 
nclusion on the tax defaulter list.38 
In Greece the data of debtors who have outstanding finan- 
ial obligations to the state for an amount in excess of €150,000 
re published.39 However, more than one year must elapse 
rom the expiration of the required payment.40 In any case, the 
30 Article 5 Autorização 676/2006 PDPA. 
31 Código de Processo nos Tribunais Administrativos, regulado en la 
ei n. º 15/2002, de 22 de Fevereiro : http://www.pgdlisboa.pt/leis/ 
ei _ mostra _ articulado.php?nid=439&tabela=leis (07/03/2018). 
32 Dean Roxburgh, United Kingdom - 2009 Budget. Tax Revenues , 49 
uropean Taxation 57-59 (2009). 
33 Section 94 (2) (a), (b), (c), (d) Finance Act 2009. See Statutory In- 
trument 2010/574, (1) and (2). 
34 Section 94 (1) (a) Finance Act 2009. 
35 Section 94 (10) (a) and (b) Finance Act 2009. 
36 Section 94 (1) (b) Finance Act 2009. 
37 See Section 94 (7) y (11) Finance Act 2009, http://www.hmrc.gov. 
k/manuals/chmanual/CH190940.htm (08/03/2018). 
38 See http://www.hmrc.gov.uk/manuals/chmanual/ch191060. 
tm (08/03/2018). 
39 Aikaterini Pantazatou, Greece , in Tax Secrecy and Tax Trans- 
arency. The Relevance of Confidentiality in Tax Law 501 (Kristof- 
ersson, Lang, Pistone, Schuch, Staringer, and Storck eds, Peter 
ang GmbH, Frankfurt am Main, 2013); Fereniki Panagopoulou- 
outnatzi, The Practice of Naming and Shaming through the Publi- 
ising of Culprit Lists , in Human Rights and the Impact of ICT in the 
ublic Sphere: Participation, Democracy, and Political autonomy 145-155 
M. Christina and N. Akrivopoulou eds, IGI Global, Hershey, 2014). 
40 Article 9.1 Law 3943/2011 and Article 1 Decree 1185/2011. 
m 
a
t
p
o
c
t
p
d
t
a
p
p
S
f
f 
i
t
a
dentity of the debtor is not disclosed when, through mecha- 
isms established under the legislation, the deferment of the 
ayment of the tax debt has been guaranteed by the legal au- 
hority or when it has been suspended by judicial order.41 
After analysing the various legal regimes, the norms which 
llow inclusion on tax defaulter lists are triggered by two 
auses: the non-payment of tax debts and non-compliance 
ith relevant tax legislation. This situation is evident by the 
rray of exceptions to a debtor being exempted from Name 
 Shame lists. For the countries that focus on the first cause 
Spain, Portugal, Greece), the debt payment or suspension of 
ax income, allows the subjects not to appear in it later; while 
hose nations who focus on the second cause (United King- 
om and Ireland), wish to nudge their citizens into better 
onduct as opposed to focussing solely on the duty to pay. 
Accordingly, Spain, Portugal, and Greece link publication 
ith regard only to the amount due, because in these cases,
he relevance falls on the unpaid tax debt. In contrast, Ireland 
nd the United Kingdom focus the public blame on specific 
ehaviour rather than the debtors themselves. Therefore, in 
he first group of states, the cause for inclusion is not is not
o much the committing of an infraction which causes harm 
o the state that is at play rather the tangible result of non-
ompliance, i.e. the non-payment. These countries only pub- 
ish the details of tax debtor when they do not pay, either be-
ause they do not want to or because they are not in a position
o do so. 
This characteristic can be observed in the temporal aspect 
i.e. when a defaulter is first included on a list and for how long
hey remain on that list). Portugal and Spain maintain that the 
oluntary payment period needs to elapse. Greece establishes 
he limit of one year from the moment when the non-payment 
ccurs. Therefore, these three countries condition compliance 
o the time factor, not to the commission of any unlawful act 
ther than non-payment. 
On the other hand, the United Kingdom submits the inclu- 
ion to an evaluation process conditioned by the legal require- 
ents, and there is no time period linked to the tax debt as
 prerequisite. Undoubtedly, this is the country that employs 
he most exhaustive method of assessment, endeavouring to 
lace the behaviour of the tax debtor within a legal context 
n a case by case basis. In a similar sense, Ireland publicises 
ertain behaviours,mainly those related to the imposition of 
ax fines or penalties, regardless of whether they have been 
aid or not. Consequently, the United Kingdom and Ireland 
o not intend to directly sanction a taxpayer’s default rather 
hey wish to highlight their bad behaviour. 
The quantitative element (i.e. the amount of debt involved) 
lso plays an important role, as those individuals or entities 
ublished on the lists have caused a significant loss to the 
ublic purse. Therefore, if the justification of these Name & 
hame lists is to publically reproach behaviour which is harm- 
ul to public finances, the debt threshold beyond which a de- 
aulter is added should be high. However, as we have just seen,
t varies substantially depending on the country. Portugal dis- 
inguishes between natural and legal persons and establishes 
 gradual and phased system. However, any individual is likely 
41 Article 9.2 Law 3943/2011 and Article 3 Decree 1185/2011. 
http://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=439&tabela=leis
http://www.hmrc.gov.uk/manuals/chmanual/CH190940.htm
http://www.hmrc.gov.uk/manuals/chmanual/ch191060.htm
computer law & security review 35 (2019) 241–250 245 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
45 Section 94 (1) of Finance Act 2009. 
to appear if she has debts equal to or in excess of €7500. The
scale establishes an additional reproach since it also shows
the degree of financial damage caused. The other countries
publish the specific amount involved. Spain is the country
that sets the highest threshold of tax debt/penalty at €1 mil-
lion, followed by Greece at €150,000. On the other hand, the
United Kingdom requires that the financial impact must ex-
ceed £25,000 to be considered relevant, and Ireland establishes
a similarly low limit, at around €33,000. 
There are two systems used to scale the debts owed: dis-
crete and continuous. Portugal uses a ranged debts option or-
dered in a progressive scale in which the exact amount due by
each listee cannot be exactly determined. In contrast, Spain,
Greece, United Kingdom and Ireland employ systems stating
the exact amount due alongside the citizen’s identity. 
The threshold value which triggers a defaulter’s listing is
of major importance: setting it low means many more data
subjects and their personal information will be published.42 
Exceptions to inclusion on the list an be classified accord-
ing to the ‘reproach type’. In countries where the emphasis on
the financial impact predominates, we found that the suspen-
sion of debt collection due to legal processes and/or the defer-
ral of tax debt are common conditions to be excluded. Nev-
ertheless, we found differences. For example, the regulations
in Portugal, in contrast to Spain and Greece, do not permit the
naming of tax debtors who are appealing their case or who are
in bankruptcy. If the reproach pursued by the legislation is to
solely expose a citizen’s default then why do the Spanish and
Greek regulations not consider bankruptcy? It seems dispro-
portionate to publically impugn a debtor’s reputation because
insolvency precludes them from paying their taxes. 
By contrast, Ireland and the United Kingdom have other
types of exclusion. Ireland excludes citizens who voluntarily
furnish Irish Revenue with complete information of their tax
matters before any investigation starts and for those involved
in any tax amnesty. In comparison, the United Kingdom con-
siders publication only when all matters are finalized and all
means of appeal have been exhausted. 
2.3. The subjective and objective scope 
Along with the publication requirements and their exceptions,
it is concomitant to assess which information can be disclosed
and about whom. 
The national regulations portray a wide range of terms
to include every natural or legal person. Spain uses the
term ‘deudores’,43 Ireland ‘every person’,44 United Kingdom
42 As an example, in the Spanish case, the probability to pub- 
lish personal information is lesser than in the Portuguese case. 
In Spain, the natural persons in the lists are around the 130-150. 
In the Portuguese tax debtor lists the number of natural persons 
included are around 20,000. 
43 It means debtors. Article 95 bis (1) and (2) Ley General Tribu- 
taria. 
44 Section 94 (1) of Finance Act 2009. 
‘any person’,45 Portugal ‘contribuintes’ 46 and Greece ‘ ϕυσ ικό ή
νομικό πρόσωπο’.47 
The information disclosed about each listee varies depend-
ing on the country. The Spanish Tax Authority publishes de-
tails of the debtors which include the full name in the case of
a natural person or the business name if it is a legal person,
the tax identification number, and the exact amount of the tax
debt plus the sum of the penalty.48 
In Ireland, alongside the full name/business name, Irish
Revenue may publish any details relating to the imposed fine
that it deems fit. This normally results in the publication of
principal addresses, occupations, and any other information
which facilitates precise identification. It also adds a summary
description of the origin of the liability and any related cir-
cumstances.49 
Similarly, the data disclosed in the United Kingdom is the
full name of the natural person, the business name, the prin-
cipal address, the nature of any business carried out by the
person, the amount of the fine or penalty and the potential
lost revenue to HMRC, the period of time within which the in-
fraction gave rise to the penalty, and any other information
that the HMRC considers appropriate to ensure that the iden-
tity of the person can be ascertained.50 
Similarly to Spain, Portugal only discloses the fiscal iden-
tification number and the full name or business name with
the debt classified within a range, without stating the exact
amount.51 
The Greek case is different however insofar as it also pub-
lishes the names of people who are under the legal age, those
who are deceased and their heirs.52 In every case, the fis-
cal identification number is published together with the full
name or the business name, the total debt (which is divided
between basic debt and any customs duties involved), the
fines and a section for observations. In the case of the dis-
closure of a minor’s information, it only publishes the initials
alongside the debt with the observation ‘minor’. 
If the citizen is an heir, the name is disclosed noting this
as an observation and indicating the full name of the orig-
inal debtor. On the other hand if the information disclosed
refers to a legal person, the legislation establishes an addi-
tional sanction by divulging the address of the registered of-
fice with its postal code. Moreover, in any one of the afore-
mentioned cases, the section for observation can be used to
indicate details about any additional legal procedures which
have been undertaken. In all cases, the exact amount of the
debt differentiated from the surcharges and interest is also
disclosed.53 
46 It means taxpayers. Article 64.5.a) Lei Geral Tributária. 
47 It means any natural or legal person who has debts with the 
State. Article 9.1 under Law 3943/2011. 
48 Article 95 bis (2) (a) and (b) Ley General Tributaria. 
49 Section 1086 (5) of the Taxes Consolidation Act 1997. 
50 Section 94 (4) of Finance Act 2009. 
51 Autorização 676/2006 PDPA. The tax defaulter list can be 
consulted at https://www.e-financas.gov.pt/pubdiv/de-devedores. 
html (09/03/2018). 
52 Articles 9.1 and 9.3 Law 3943/2011, and Articles 1 and 2 Decree 
1185/2011. 
53 Article 2 Decree 1185/2011. 
https://www.e-financas.gov.pt/pubdiv/de-devedores.html
246 computer law & security review 35 (2019) 241–250 
fi
v
e
i
m
s
l
E
t
s
m 
b
 
T
p
i
d
m
S
t
t
b
e
w
d
w
2
T
m
S
m
‘
d
T
p
i
e
s
b
t
9
T
w
t
t
s
o
a
p
t
G
s
n
d
f
s
m
t 
C
f
o
2
t
t
w
p
i
t
t
r
a
c
d
t
i
h
t 
f
A
s
a
m
l
t
h(
57 ECJ judgements C-92/09 y C-93/09, and C–131/12. 
58 Article 95 bis. 6.b) Ley General Tributaria. 
59 Section 1086 (3) Taxes Consolidation Act 1997. 
60 http://www.revenue.ie/en/press/defaulters/archive/index. 
html (visited 19/03/2018). Section 94 (7) y (8) Finance Act 2009. 
61 See https://www.thetimes.co.uk/article/revenue- cuts- back- 
tax- list- of- shame- 6bjf69nwq (visited 15/03/2018). 
Each country analysed links the debtor’s identity with any 
nancial data related to the tax default and/or penalties in- 
olved. However, some of these disclosure procedures may be 
xcessive, at least from a data protection perspective, specif- 
cally GDPR. This requires that any personal data disclosed 
ust be appropriate, relevant and limited to what is neces- 
ary in relation to the purposes for which they are processed. 
Therefore national legislation must only allow for the pub- 
ication of indispensable personal data in order to comply with 
CJ 54 rulings on data minimisation.55 
On examination of the disclosed information we conclude 
hat Ireland and the United Kingdom are at one end of the 
pectrum when it comes to the amount of personal infor- 
ation published. These data include addresses, profession,
usiness activities and details of the infractions committed. 
At the opposite end of the spectrum are Spain and Portugal.
hese two countries are more closely aligned with the princi- 
le of minimisation. According to our study, Portugal solely 
dentifies the data subject without mentioning the exact debt 
ue, but offers enough information to the reader to know how 
uch damage the behaviour causes to the public purse. The 
panish tax defaulter list is characterised by identifying only 
he subject with the total amount due without apportioning 
he quantity of the debt and its penalty. 
In this respect, Greece is aligned with Spain and Portugal 
ut establishes a system of disclosure that tries to adapt to 
ach circumstance by disclosing more detailed information 
hen warranted, reducing the disclosed information when 
ealing with natural persons and increasing it when dealing 
ith legal persons. 
.4. Sanctioning the tax defaulter: modality and duration 
he manner in which Name & Shame tax lists are imple- 
ented reveals important differences about each country. In 
pain, it is carried out only after the completion of two ad- 
inistrative acts: firstly, the ‘inclusion proposal’, and then the 
settlement publication’ where the defaulter along with their 
ebts are identified. On December 31 of each year the Spanish 
ax Administration analyses the situation of defaulters and 
repares the inclusion proposal. Next, it notifies each debtor 
ndividually, giving them ten days to appeal if there were any 
rrors of fact, material or arithmetic, relating to their inclu- 
ion on the list. If any errors are encountered the debtor will 
e exempted from further disclosure.56 
Once the Spanish Tax Administration gives the taxpayer 
he opportunity to rectify the erroneous information, Article 
5 bis.4 under the Ley General Tributaria mandates the Spanish 
ax Administration General Director to publish the settlement 
ith taxpayer identities and debts by electronic means within 
he first semester of every year. 
The Spanish law obliges the tax authority data processor to 
ake measures that will prevent the list from being indexed by 
earch engines. This mandate is in line with the requirements 
54 Paragraph 81 ECJ Judgement C-92/09 y C-93/09. 
55 Article 5.1 (c) GDPR. 
56 Article 95 bis Ley General Tributaria. D
f the ECJ 57 and prevents defaulter’s names being presented as 
 result of a search query. 
In addition the Spanish law establishes a time limit on the 
ublished data ensuring that the information is only available 
o third parties for three months after first disclosure.58 
In Ireland, the list is published quarterly in the Official 
azette ( Oifigiúil ),59 and Irish Revenue reproduces it on its web- 
ite in Excel and PDF formats which contain the identities of 
atural and legal persons, the sanctions imposed and other 
etails as previously outlined.60 Moreover, once the tax de- 
aulter list is published it is stored indefinitely on the web- 
ite, but recently, Irish taxpayers have won the right to be re- 
oved resulting in a decision by Irish Revenue to delete quar- 
erly lists of tax defaulters from its website after two years.
onsequently a 15-year archive of lists has now disappeared 
rom the site after defaulters complained that keeping names 
nline indefinitely was a disproportionate punishment.61 
In the United Kingdom, Section 94 (5) of the Finance Act 
009 gives freedom to the manner in which HMRC publishes 
he tax defaulter list. This institution uses a format file con- 
aining the list which can be downloaded by anybody from its 
ebsite, and only presents the information during a 12-month 
eriod after the initial publication. Moreover, the HRMC must 
nform the people involved before publication, allowing them 
he opportunity to submit an appeal.62 
Portugal discloses the data on a specific website, where 
ax defaulters are grouped into two different lists which sepa- 
ates natural from legal persons. All subjects are ordered in an 
scending scale of monies owed. In contrast with the others 
ountries, the Portuguese list is continually updated, adding or 
eleting taxpayers when necessary. The information is main- 
ained until taxpayers have fulfilled their obligation, by pay- 
ng the amount due or until the statute of limitations period 
as expired.63 Before the list is published, those included on 
he list must be informed by means of a preliminary hearing,
ollowing that they will have ten days to submit an appeal.64 
dditionally, it is also explained during the hearing that the 
ubject may exercise the right to access, rectify and/or delete 
ny erroneous personal data.65 
In Greece the lists are published by the Treasury Depart- 
ent, which also separates legal from natural persons.66 The 
egislation does not mandate any action related to informing 
he taxpayer about the future disclosure in a preliminary 
earing. Nonetheless the Hellenic Data Protection Authority 
HDPA) obliges the Greek Treasury Department to inform 
62 Section 94 (6) Finance Act 2009. 
63 Article 9 Autorização 676/2006 de la CNPD. 
64 Article 7 Autorização 676/2006 de la CNPD. 
65 Article 10 Autorização 676/2006 de la CNPD. 
66 Articles 9.1, 9.4 Law 3943/2011, and Articles 1, 2, and 5 under 
ecree 1185/2011. 
http://www.revenue.ie/en/press/defaulters/archive/index.html
https://www.thetimes.co.uk/article/revenue-cuts-back-tax-list-of-shame-6bjf69nwq
computer law & security review 35 (2019) 241–250 247 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
those included on the list, prior to any publication, of their
rights to the protection of their personal data.67 
In this case, the information is reviewed quarterly, includ-
ing again only the debtors who continue to owe the due
amount, while those citizens who successfully exercised their
right to rectify the information or do not satisfy the require-
ments, are removed from the list. 
From the situations analysed, we can confirm that four
structural elements related to how the countries disclose the
information coexist: (i) the publication channel, (ii) the tem-
poral limitation, (iii) the possibility of indexation by search en-
gines, and (iv) the level of any prior communication to the data
subjects of their inclusion on the tax defaulter lists. 
In every case, public sanctioning is carried out by means of
lists found on the tax administration’s website and is available
to all. 
The publication channel by which defaulter information is
accessed is important to gauge the proportionality of the right
to the protection of personal data. Allcountries use freely ac-
cessible disclosure systems such as an official gazette and/or
websites published by the tax administration or other relevant
ministries. The internet is the obvious communication chan-
nel to inform the general public, and it also maximises the
potential for transparency. The accessibility, search capability
and ease granted by the internet makes the disclosure more
potentially impactful than the use of other more traditional
means, such as the publication of notices in newspapers.68 
In this context, the approval of legal measures impeding
the indexation of the website by search engines is an essential
aspect to determine any conflict with the fundamental right
to the protection of personal data.69 The only country that ex-
plicitly regulates the necessity to take measures to prevent in-
dexation is Spain. On the other hand, Portugal and Greece did
not directly legislate for this but have nevertheless taken mea-
sures to prevent indexation. Remarkably neither the United
Kingdom nor Ireland apply any action to prevent the location
of tax defaulters by means of search engines. 
The temporal limitation of the publication is another im-
portant aspect. The possibility to disclose the data related of
the subject’s identity indefinitely without taking into account
the later fulfilment of the tax obligation or the statute of lim-
itation expiration period may be a disproportionate sanction.
Spain and Greece have shorter temporal limitations (three
months), followed by the United Kingdom (twelve months).
Portugal continuously updates lists by deleting data subjects
when they pay their debts and/or after the statute of limita-
tions. Ireland is the only country without an established dis-
closure period although at present this period is restricted to
two years by the Irish Revenue. 
Regarding the different format of defaulter lists, Portugal
and Greece publish two lists differentiating between natural
67 Opinion 4/2011 HDPA. 
68 Lisa Collingwood and Graeme Broadbent, Offending and being 
offended online: Vile messages, jokes and the law , 31 Computer law & 
security review 770–773 (2015). 
69 International Working Group on Data Protection in Telecom- 
munications, ‘ Working Paper and Recommendations on the Publication 
of Personal Data on the Web, Website Contents Indexing and the Protec- 
tion of Privacy ’, 53rd Meeting – Prague, 15-16 April 2013, p.1. 
and legal persons; Spain, Ireland, and the United Kingdom dis-
tinguish this difference within the lists themselves. Addition-
ally Ireland further identifies data subjects who have had ex-
tra penalties imposed by the courts. We understand that Por-
tugal and Greece, by formatting in this manner, aim to grant a
higher level of reproach to legal persons, as Ireland also does
with respect to certain other infractions.70 
Finally, we must point out that the majority of countries
grant the possibility of appeal against the inclusion in the
list, after they have been personally notified. As we have seen,
Spain, Portugal, Greece and the United Kingdom foresee this
guarantee in their legislation. On the other hand, Ireland does
not expressly provide for it. 
3. Analysis of personal information 
disclosure and proportionality 
3.1. Main implications of the GDPR 
In line with what has been revealed in the preceding sections,
after studying and reflecting on the Name & Shame list inclu-
sion requirements, exceptions, disclosure scope and manner
of reproach, we question how this all stands up against the
GDPR. 
The substance of the right to the protection of personal in-
formation grants a data subject the power to control the pro-
cessing of their data. Specifically the power to rectify any er-
roneous data and/or delete that which is deemed superflu-
ous to the stated goal.71 Both rights allow subjects to correct
their information, by removing or adding to the personal data
stored which will be ultimately subjected to processing and
disclosure. 
As it stands the only country which explicitly grants full
GDPR rights to those on their tax defaulter lists is Portugal.
On analysis the optimum moment for defaulters to exercise
these rights is immediately after being notified of their inclu-
sion on the list. All countries except Ireland recognise the right
for potential listees to challenge their inclusion on the lists.72
It is important to note that these rights are not limited to any
time period nor are they limited in the manner which these
rights can be executed as stipulated under the GDPR.73 There-
fore, we understand that their exercise is not restricted to the
period granted to formulate the claim or appeal. 
GDPR data minimisation and storage limitation principles
strictly determine how tax defaulters’ personal information
must be treated. These principles oblige data controllers to
limit the publication information to that which is ‘adequate,
relevant and limited’ to the task of tax defaulter lists. Further-
more it mandates that the data is kept in a form that allows for
70 Greece discloses more information about legal persons and 
Portugal also regulates a larger scale for them. 
71 Articles 16 and 17 GDPR. See Bernardo D Olivares Olivares, Tech- 
nological innovation within the Spanish tax administration and data sub- 
jects’ right to access: An opportunity knocks , 34 Computer law & secu- 
rity review 628-629 (2018). 
72 In the Spanish case see Article 95 bis. 4, and in the United King- 
dom Section 94 (6) Finance Act 2009. 
73 Jef Ausloos, The ‘Right to be Forgotten’ - Worth remembering? , 28 
Computer law & security review 151-153 (2012). 
248 computer law & security review 35 (2019) 241–250 
t
c
t 
u
r
t
 
T
t
d
d
b
G
p
t
p
e
o
E
t
i
l
w
l
b
o
p
t
a
d
g
p
b
a
t
d
d
i
a
c
4
2
o
s
i
s
m
a
M
E
t 
w
a
m 
a
o
a
a
o
fi
W
c
t
i
i 
a
o
t
s
t
c
t
m
b
i
d
l
t
t
p
b
e 
3
A
a
m
s 
T
p
d
e
s
t
b
he identification of the subject only for as long as required to 
arry out the task. This mandates data controllers to minimize 
he impact of the list when personal information is published,
sing only the minimum information and introducing tempo- 
ary restrictions in the legal instruments that enable publica- 
ion, in effect the disclosure cannot be unlimited.74 
Moreover, the data must be accurate and kept up to date.
his mandate implies that the tax administration authori- 
ies must take all reasonable precautions to ensure accurate 
ata is published. The data controller/tax authorities must 
o everything possible to complete or correct the information 
efore it is published. 
In this context, the ECJ judgment Volker und Markus Schecke 
bR (C–92/09) and Hartmut Eifert (C-93/09) is particularly im- 
ortant. It has its origin a number of petitions opposing 
he publication of data by a group of CAP beneficiaries who 
etitioned the European Commission and the German gov- 
rnment not to disclose the value of grants they received 
n the website of the Bundesanstalt für Landwirtschaft und 
rnährung (Federal Agency of Agriculture and Food) alongside 
heir personal data. 
The ECJ ruled that the publication of the information was 
ntended to promote transparency, in order to show how pub- 
ic spending was allocated, therefore who the beneficiaries 
ere and how much each beneficiary received was in the pub- 
ic interest. The court noted that the aim of transparency must 
e nevertheless weighed against a citizen’s right to protection 
f their personal information. 
The resulting judgement found that less intrusive data- 
oints should have been considered, for example by limiting 
he disclosed information to certain periods of time, and by 
ssociating the frequency, type and magnitude of the funds 
elivered.75 
Therefore, in order to balance legal interests, the German 
overnment should have assessed whether a publication of 
ersonal data limited by the above stipulations would have 
een sufficient to achieve the objectives of EU transparency 
nd data protection regulations. The ECJ understoodthat 
hese requirements would have protected the conflict of the 
isclosure with articles 7 and 8 under the Charter of Fun- 
amental Rights of the European Union, without preventing 
t from offering the wider public the transparency of public 
ctivity.76 
A further case sheds light on the data minimisation prin- 
iple vis a vis personal data disclosure: The second opinion 
/2009 on the World Anti-Doping Agency (WADA) of the Article 
9 Working Party.77 This ruling found out that the disclosure 
f personal data, which includes ‘…data about offences – pos- 
ibly not [yet] confirmed in an appeal procedure - constitutes 
nterference with the right to respect of privacy and to per- 
onal data protection. For such interference to be valid, it has 
74 Articles 5 (c) and (d). 
75 ECJ Judgments C-92/09 y C-93-09, paragraphs 81 and 89. 
76 Also Advocate General Eleanor Sharpston referring to the judg- 
ent, paragraphs 102-123. 
77 The Article 29 Working Party is an advisory body made up of 
 representative from the data protection authority of each EU 
ember State, the European Data Protection Supervisor and the 
uropean Commission. 
T
L
e
o be necessary in order to attain a specific legitimate purpose,
hich implies, among others, that there has to be a reason- 
ble link of proportionality between the consequences of the 
easure for the person involved and this legitimate purpose,
nd that there are no other, less intrusive means available to 
btain the purpose.’ 78 
Giving due consideration to proportionality and the neg- 
tive impact that any erroneous publication might have on 
 citizen’s right to privacy, we believe that disclosure should 
nly take place at the moment at which the sanctions become 
nal.79 
Under the current legal framework, the ECJ, the Article 29 
orking Party, and in particular the minimisation principle 
learly require that each legislature must assess the propor- 
ionality measures taken relative to the stated aim of the leg- 
slation. If the aim of the legislation is to name those who are 
n debt to the treasury then public disclosure needs to present,
t most, the name of the defaulters alongside the amount they 
we and the specific infringement committed. 
From our perspective, no other data is necessary to achieve 
he purpose intended with the tax defaulter lists. Disclosure 
hould be limited only to harmful behaviours to the public in- 
erest, and in any case, linked to a temporal, quantitative and 
ausal restriction to ensure proportionally. The lists, if they are 
o comply with GDPR guidelines must not be used as an instru- 
ent to disclose information about every aspect of taxpayer 
ehaviour, without limits, in particular when the published 
nformation is associated with special categories of personal 
ata such as criminal convictions. 
These specifications would require countries such as Ire- 
and and the United Kingdom to moderate the information 
hey disclose. Ireland does not consider any causal limitation 
o remove a listee before the recently introduced two year ex- 
iration period. In the case of Spain, it would be advisable that 
efore publication the amount of debt owed is finalised and 
xceptions should be made to debtors who are in bankruptcy.
.2. Formulating a minimum standard model in the eU 
fter considering the various legal and cultural environments 
nd giving due regard to national legislatures’ right to deter- 
ine their own tax management and justice system we must 
trive to find a balance between competing legal interests.
hese include the economic well-being of the state, the trans- 
arency of public administration and taxpayers’ right to confi- 
entiality. We propose a model anchored in minimum param- 
ters to guide disclosure of personal information while at the 
ame time lending protection to taxpayers’ fundamental right 
o data protection. This model requires identity disclosure to 
e governed by the following guidelines: 
(i) Any personal data published must be the minimum re- 
quired to achieve the intended purpose of the tax de- 
faulter lists. We propose that public information should 
78 Pages 16-17. 
79 Eleonor Kristoffersson and Pasquale Pistone, General Report , in 
ax Secrecy and Tax Transparency. The Relevance of Confidentiality in Tax 
aw 26 (Kristoffersson, Lang, Pistone, Schuch, Staringer, and Storck 
ds Peter Lang GmbH, Frankfurt am Main; 2013). 
computer law & security review 35 (2019) 241–250 249 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
80 Antonio Carlos Dos Santos and Clotilde Celorico Palma, Portu- 
gal , in Tax Secrecy and Tax Transparency. The Relevance of Confidential- 
ity in Tax Law 879(Kristoffersson, Lang, Pistone, Schuch, Staringer 
and Storck eds., Peter Lang GmbH, Frankfurt am Main, 2013), and 
Texaira Gloria, Manual de Direito Fiscal , footnote 672 (Almedina, 
2015). In other countries see M E Kornhauser, Doing the Full Monty: 
Will Publicizing Tax Information Increase Compliance? , 1 Canadian 
Journal of Law and Jurisprudence 1-18 (2005),I Sheldon, J D Banoff, 
and M Richard, Tax Delinquents Exposed! Are ‘Websites of Shame’ 
Working (or Backfiring)? , 1 Journal of Taxation 1-2 (2014), Ken Devos 
and Marcus Zackrisson, Tax compliance and the public disclosure of 
tax information: An Australia/Norway comparison , 1 EJournal of Tax 
Research 108-129 (2015), Ricardo Pérez-Truglia and Ugo Troiano, 
only entail the tax debtor’s identity and limited details
of the default involved. 
(ii) The publication period must be limited. The regulations
must consider a causal or temporal limit consistent
with the purpose and the impact of the damage caused.
(iii) The disclosure of the lists through the internet must be
configured to prevent indexing by third parties. 
(iv) The conflict with the fundamental right to data protec-
tion must be balanced by introducing quantitative and
qualitative criteria such as frequency, magnitude, and
type of non-compliance. 
(v) Taxpayers must be informed before their identity is dis-
closed and the possibility of rectifying or removing per-
sonal data must be granted before the list is published. 
4. Conclusions 
Our aim was to compare and contrast the range of legal ratio-
nale behind the publication of tax defaulters’ personal data in
five European jurisdictions. 
We conclude that these Name & Shame lists all have as
their basis an infraction of national tax regulations. The data
suggest that the rationale for publication can be broadly split
into two camps: those countries that wish the emphasis to
be on debt recovery (Spain, Greece, Portugal) and those that
wish to nudge the wider public into better behaviour (Ireland,
United Kingdom). 
Furthermore, all countries regardless of their emphasis, es-
tablish a financial threshold above which defaulters are placed
on the lists. This threshold reflects the impact caused and the
conduct pursued and so establishes the defaulter profile from
a quantitative and qualitative standpoint. 
This allows for the creation of various models reflecting
each country’s attitude to specific behaviour. For example
Spain names and shames only those who have significant
debts, whereas Portugal discloses information on those with
much smaller debts. Greece, the United Kingdom and Ireland
maintain the middle ground. 
Regarding exemptions from Name & Shame lists we can
see that Spain is the only country which does not allow for
bankruptcy to be a valid reason for exemption. However Spain,
along with Greece and Portugal, does allow for exemptions in
cases of payments deferred or suspended with administrative
or judicial approval. Moreover, the filing of an appeal before
the administrative act of disclosure is a common basis for ex-
emption in Greece, Portugal and the United Kingdom. Albeit
that the United Kingdom only allowsappeals of the imposed
penalties and not the tax debt itself. 
From our findings in the analysis of the subjective scope of
the publication, we can affirm that this is common in all cases
since the identity of natural and legal persons is disseminated
in any event by the their names being published on defaulter
lists. On the other hand, we have verified that there is a vast
difference in the objective scope of publication between Ire-
land, and United Kingdom, which disclose considerably more
data on defaulters than Spain, Greece, and Portugal. 
On examination of the mode and duration of the disclosure
we see that all countries publish Name & Shame lists on the
internet using an array of formulas. Greece and Portugal differ-
entiate between natural and legal persons and Ireland explic-
itly notes those who have been indicted. Both Spain and the
United Kingdom limit the time a debtor remains on the list
to three and twelve months respectfully; on the other hand,
Greece and Portugal do not establish any time limit but fore-
see but provide legal instances for the automatic withdrawal
of a defaulter from the list. Ireland had previously allowed for
indefinite inclusion on Name & Shame lists but currently has
been forced by a decision of Irish Revenue to limit the duration
to two years due to data protection legislation principles. 
Search engine indexing is a further noteworthy element in
the endeavour to limit disclosure. After analysis, we can con-
clude that Greece, Spain, and Portugal have measures to ex-
clude listees from search engine results whereas Ireland and
the United Kingdom do not. 
Regarding the specific impact in the right to the protection
of personal data, we found that all countries except Ireland
have certain guarantees in their legislation that ensure com-
patibility with data protection regulation. In particular, Portu-
gal’s legislation is the most robust in this respect, regulating
when and how the tax administration applies the duty to in-
form, the minimisation of data and the rights to rectification
and erasure. At the other end of the scale is Ireland. With its
current legal wording behind Name & Shame lists being most
susceptible to failing GDPR requirements. 
Regarding our third objective, we can affirm that, using
the minimum model proposed above, Ireland, and the United
Kingdom disproportionately limit the right to the protection
of personal data. Both countries establish an objective scope
of publication that, from our point of view, goes beyond its re-
mit. They publish more information than needed to accom-
plish their goal of public reproach. Also, Ireland and the United
Kingdom do not establish measures to prevent list indexation.
Whereas Spain, Portugal and Greece are exemplary for their
proportionality. They disclose the minimum data necessary to
achieve their objective. 
On examination of the mechanics of the publication pro-
cess we would recommend that the ideal moment for tax ad-
ministrations to apply the duty to inform and right to rectifi-
cation and erasure should be when the data subject is initially
notified of their inclusion on the list. 
Finally, the outcome of the research conducted specifically
with the information from Greece and Portugal show that the
publication of the lists is a useful measure to collect unpaid
tax liabilities.80 In the case of Spain and the other countries
there are still no data in this regard. This is an essential aspect
Fernando Feitosa
250 computer law & security review 35 (2019) 241–250 
f
t
t
l
i
t
t
C
O
w
S
i
A
R 
t
D
F
t
A
S
S
f
or assessing the conflict or impact on the fundamental right 
o the protection of personal data. 
The formulation of our objectives had a precise purpose: 
o measure the compatibility of various Name & Shame pub- 
ication models with GDPR. We find there is much room for 
mprovement in the models analysed. Furthermore we note 
he need for more and deeper empirical studies to measure 
he efficacy and proportionality of Name & Shame lists. 
ontact details editorial office 
ne author has been designated as the corresponding author 
ith the following contact details: 
haming Tax Delinquents Theory and Evidence from a Field Experiment 
n the United States , w21264 NBER Working Paper 1-28 (2016). 
cknowledgement 
esearch carried out within the R&D Project: ‘ I + D + I “La pro-
ección de los derechos fundamentales y humanos en el 
erecho Financiero y Tributario” DER2015-65832-P (MINECO- 
EDER). Funded by the Ministerio de Economía y Competi- 
ividad. Duración: 2016–2019. Main researchers: José Manuel 
lmudí Cid and Miguel Ángel Martínez Lago. 
upplementary materials 
upplementary material associated with this article can be 
ound, in the online version, at doi: 10.1016/j.clsr.2019.03.005 . 
https://doi.org/10.1016/j.clsr.2019.03.005
	The impact of GDPR on European Name & Shame tax defaulter lists
	1 Introduction
	2 The legal impact of Name & Shame lists
	2.1 Legal interests disputed
	2.2 Name & Shame: prerequisites and exemptions
	2.3 The subjective and objective scope
	2.4 Sanctioning the tax defaulter: modality and duration
	3 Analysis of personal information disclosure and proportionality
	3.1 Main implications of the GDPR
	3.2 Formulating a minimum standard model in the eU
	4 Conclusions
	 Contact details editorial office
	 Acknowledgement
	 Supplementary materials