Home entry and access to computer equipment: the court order must give specific reasons for digital access (STS 1122/2024)

In judgment no. 1122/2024 of 25 June (Contentious-Administrative Chamber, Second Section, cassation appeal no. 7845/2022, rapporteur Mr Dimitry Berberoff Ayuda), the Spanish Supreme Court held that a court order authorising entry into protected premises under article 113 of Law 58/2003 of 17 December, the General Tax Act (LGT), must give specific reasons for access to the computer equipment found there. The reason is that such access may affect rights under article 18 of the Spanish Constitution other than the inviolability of the home.

The outcome of the case, however, is not what that doctrine might lead one to expect: the Supreme Court finds that the order under review was sufficiently reasoned and upholds it, including full imaging of the company’s devices.

It is helpful to begin with the legal framework, because readers who do not specialise in tax procedure are often unfamiliar with how the constitutional protection of the home interacts with the inspection powers of the Spanish Tax Agency (AEAT).

Article 18.2 of the Constitution enshrines the inviolability of the home. No official may enter a taxpayer’s home without (i) the taxpayer’s consent or (ii) a court decision, save in the case of flagrante delicto. Article 113 LGT carries this requirement into tax procedure: where the inspectorate needs to enter constitutionally protected premises and lacks the taxpayer’s consent, it must obtain authorisation from the administrative courts.

That authorisation is not a formality. Over successive judgments, the Supreme Court has refined the requirements an order must meet to be valid. STS 1122/2024 addresses one specific question within that body of case law: access to the computers, servers and digital files located on the premises.

The facts reflect a common situation in modern tax inspection. The AEAT applied for authorisation to enter the offices of CVC Investment Advisory Services, S.L., and the application expressly covered access to computers, servers, databases and files stored in the cloud. Madrid Administrative Court no. 29 (order 162/2021) authorised the entry, including full imaging of the devices, that is, a complete copy of their contents, with subsequent filtering of anything irrelevant. In executing the order, the inspectors downloaded more than one million emails and more than forty thousand documents.

The company appealed to the High Court of Justice, which dismissed the appeal on the basis that access to digital information did not require specific reasoning. The cassation appeal was brought against that judgment.

The order admitting the appeal asked whether a court order authorising entry must contain explicit, specific and individualised reasoning on access to information held in telematic repositories, in order to safeguard the rights recognised in article 18(1) and (3) of the Constitution. It also asked whether the inspectorate may request the interception of communications.

The Supreme Court answers the first question in the affirmative. Its starting point is that authorisation to enter the home does not, by itself, authorise interference with the other rights in article 18: personal privacy (paragraph 1), secrecy of communications (paragraph 3) and the protection of personal data (paragraph 4).

From there, the Chamber restates the requirements its case law already imposed on entry orders, citing, among others, its judgments of 23 September 2021 (appeal 2672/2020) and 14 June 2023 (appeal 6104/2022): sufficient indications justifying the entry, suitability of the measure, necessity and proportionality, and reasoning that explains each of these points.

The judgment’s contribution lies in digital access. Where the entry extends to computer equipment located on the premises, the order must specifically justify that access, having regard to (i) its necessity and proportionality in relation to the purpose of the inspection; (ii) the nature of the data to be accessed, given the possible impact on privacy and secrecy of communications; and (iii) the impact on the business or professional activity of the devices or servers, and the rights of their holder, depending on whether it is a natural or a legal person.

The judgment adds a relevant point on consequences. Any infringement of privacy or secrecy of communications through access to specific documents could render that evidence null, without affecting the legality of the entry itself.

On that basis, the Supreme Court quashes the High Court judgment, which had ruled out the need for specific reasoning. When it goes on to decide the appeal, however, it does not annul the order.

The Chamber finds that both the Administration’s application and the court order gave sufficient reasons for the necessity, suitability and proportionality of access to the devices, including full imaging with subsequent filtering. In doing so, it takes into account that the appellant was a legal person and that the devices were located at its offices. It therefore dismisses CVC’s appeal against the order.

In our opinion, the doctrine strikes a sound balance between inspection powers and fundamental rights. Access to emails, servers and cloud files affects several rights in article 18 at once, and an authorisation that addresses only physical entry leaves the most intrusive part of the operation outside judicial control.

The outcome of the case nonetheless calls for tempered expectations. The requirement is one of reasoning, not prohibition: an order that explains why access is necessary and proportionate may cover even full imaging. The judgment also suggests that the standard is less demanding where the inspected party is a legal person and the devices are at its offices, which is precisely the usual scenario in corporate dawn raids.

In our view, where an order contains no specific reasoning on digital access, the taxpayer will have grounds to challenge the validity of the evidence taken from the devices, under the general rules on evidence obtained in breach of fundamental rights (article 11(1) of the Organic Law on the Judiciary). This is our own inference; the judgment does not put it in those terms.

In connection with the same entry into CVC’s premises, judgment no. 1173/2024 of 2 July (Fourth Section, cassation appeal no. 5831/2023) dealt with a different step taken during the entry: questioning directors and employees without prior notice. The Supreme Court held that this did not infringe article 18 of the Constitution but did infringe the right to effective judicial protection and to a defence under article 24, in the way it was carried out, and annulled it.

Some practical guidance for a company facing an entry follows from both judgments.

First, it is worth examining the scope of the order: its validity period, the identification of the premises and of the purpose of the inspection and, in particular, whether it covers and gives reasons for access to computers, servers or cloud files. If it does not, the inspection should not extend to those elements without the taxpayer’s consent.

Second, it is advisable not to consent to any extension of the authorised scope, while not physically obstructing the operation within the terms authorised. In light of STS 1173/2024, any request to question directors or employees during the entry should also be assessed with legal assistance.

Finally, the company should keep a documentary record of the operation: a copy of the order, the official record of the entry, a list of the devices accessed, the scope of the imaging and any reservations made. That record will be the basis for any later challenge.

In conclusion, what this Supreme Court doctrine makes clear is that an entry order must give specific reasons for access to computer equipment and digital repositories, although, as the case itself shows, an order that reasons the need for access may cover even full imaging with subsequent filtering.