The Spanish National Appellate Court has overturned a penalty for obstructing the tax authorities’ activities, imposed on a company that refused to allow access to its computer systems for tax auditors who did not have a judicial order, but only an administrative authorization. This principle contrasts with that upheld by TEAC in a recent decision and comes as the Spanish Supreme Court has a number of outstanding cassation appeals on the same matters.
It has become common practice over recent years for tax auditors to turn up at companies’ officers (with no advance warning and accompanied by engineers from the Computer Audit Unit), request access to computers and servers and examine and make copies of accounting records together with any other information that, in their understanding, has tax implications. The document they rely on for all of this is usually an entry authorization from the competent administrative authority rather than a judicial order.
In view of these kinds of activities, an issue has arisen as to whether taxpayers’ refusal to allow access to electronic devices can qualify as the tax infringement involving resistance, obstruction, hindering or refusal to cooperate with the tax authorities’ activities as provided in article 203 of the Spanish General Taxation Law (Law 58/2003, of December 17, 2003, or the LGT), which is subject to fines ranging up to 2% of net revenues.
This issue has been examined in two recent rulings by the Central Economic-Administrative Court (TEAC) and the Spanish National Appellate Court which addressed and resolved it differently.
In the case examined by TEAC in a decision dated June 23, 2026, the tax auditors appeared at the company’s offices without a judicial order, just with an administrative warrant. The director refused to allow access to the systems on the basis that they were at a constitutionally protected domicile. For the inspectors, this did not present any obstacle at all, because the computers could be made available to them at other premises that did not have that protection. The company offered to provide the documents on paper, although it would not give access to the devices, and was fined for obstructing the tax authorities’ activities.
In its decision TEAC endorses the tax auditors’ conduct and notes that the company was not fined for preventing entry to its domicile, but instead for failing to make available, anywhere outside the constitutionally protected space, the data with tax implications stored on the IT systems. TEAC considered it “pointless” to discuss which spaces were protected or what effects the lack of judicial authorization had, because, in its judgment, they could simply rely on the ordinary powers acknowledged in articles 142 and 151.3 of the LGT and article 171 of Royal Decree 1065/2007 of July 27, 2007, which basically allow tax auditors to examine the accounting records, record books and other documents in electronic format.
In the case examined by the Spanish National Appellate Court (judgment dated September 26, 2026), the auditors appeared at the company’s offices, again, with no judicial order, just an administrative warrant. After waiting in the administrative staff’s area for someone to authorize access to the computers, that access was denied to them because the systems contained the director’s personal data.
The company was fined for obstructing the tax authorities’ activities. The auditors, and later TEAC, noted that a judicial order was not necessary because the field auditors had not entered or intended to enter the premises that could be classed as a constitutionally protected domicile. In other words, they considered that boundaries cannot be drawn for a company’s domicile in such a way as to determine that certain premises have constitutional protection and others do not.
The Spanish National Appellate Court completely rejected this view, describing it as “beyond questionable.” Drawing support from the supreme court judgment of September 29, 2023, it held that, without the data subject’s consent, access to information on computer systems requires judicial authorization. For that reason, it concluded that imposing a penalty for refusal to allow access to computer devices is tantamount to “punishing the lawful exercise of a fundamental right.”
It is a well-known fact that requests for access to electronic devices have a direct impact on the exercise of fundamental rights; which means a direct impact on both the constitutionally protected right to an inviolable domicile, and on new generation rights such as the “right to a virtual environment” (as coined by the Spanish Supreme Court (Chamber Two) in, among others, its judgment dated April 17, 2013). This case law was in fact the driving force behind the reform of the Criminal Procedure Law made by Organic Law 13/2015 of October 5, 2015, which introduced detailed provisions on physical and procedural safeguards for access to electronic devices and systems for mass storage of information (USB sticks, servers or the cloud) and recording them.
Those detailed provisions contrast, however, with the absolute legislative void in the area of judicial review for authorizing activities such as those described in a digital environment (inside and outside the constitutionally protected domicile).
In this context, when deciding on the outstanding cases the Spanish Supreme Court may be expected to establish solid case law that will provide legal certainty in relation to these types of activities and their penalty consequences. The Supreme Court has admitted, in decisions dated May 29, 2026 (appeals 4788/2025 and 4994/2025), two cassation appeals to clarify whether access to computers and data repositories always requires, regardless of where those devices are located, a judicial warrant giving the specific reasons determining that it is suitable, necessary and proportional, or whether a decision by the tax authorities is sufficient pursuant to articles 113 and 142 of the LGT.
Furthermore, regarding the penalty side of the refusal to allow access to electronic devices, the Spanish Supreme Court, in a decision dated September 23, 2026 (appeal 8049/2025), very similar to those mentioned above, also raises the issue of whether “the refusal by a taxpayer to allow the examination or obtaining of copies of information contained on computers, or mass storage devices for digital information or electronic data repositories constitutes a tax infringement due to resistance, obstruction, hindering or refusal to cooperate with the tax authorities’ activities, as provided for in article 203 of the General Taxation Law”.
Lastly, also worth noting is the supreme court decision dated March 5, 2026 (appeal 2113/2025), admitting a cassation appeal in connection with the search of a domicile in which tax auditors gained access to data belonging to the appellant in electronic format. In this appeal, the Spanish Supreme Court ruled that it had to be “determined whether the provision contained in article 8.6 of the Judicial Review Law which grants powers to the judicial review courts to authorize entry to domiciles and other places to which access requires the owner’s consent must have the status of an Organic Law, and, whether that article 8.6 of the Judicial Review Law meets the required “quality of the law” standard within the meaning of the case law of the European Court of Human Rights in interpreting article 8.2 ECHR”.
The principle that the Spanish Supreme Court determines in this last case will be decisive, because the points at issue are: (i) the very jurisdiction of the judicial review courts to authorize measures that may entail an encroachment on the right to an inviolable domicile and on the right to a virtual environment; and (ii) the quality and status of the law, as required by the case law of the European Court of Human Rights when interpreting article 8.2 of the European Convention of Human Rights (in other words, whether the law is clear, foreseeable and accessible for those concerned).
