Draft law on the publication of tax debts: Legal implications for citizens and businesses

What does the “list of shame” of debtors entail and when could it have real legal effects?

The draft law on the adoption of measures to increase the financial capacity of administrative-territorial units of the Ministry of Development, Public Works and Administration proposes fundamental changes in the administration of local tax receivables, particularly with regard to tax secrecy, the exchange of information between authorities, the conditions for acquiring ownership rights, and introduces the obligation for tax authorities to publish online lists of debtors with outstanding obligations. This legislative initiative aims to guarantee fiscal transparency and to compel taxpayers to settle outstanding amounts, but it raises serious concerns regarding data protection in Romania, the processing of personal data GDPR compliance with Law No. 190/2018 on measures to EU Regulation 2016/679. This article analyses the current status of the draft law, its compatibility with the right to privacy, its impact on property rights and the legal remedies available to citizens and businesses, in the broader context of GDPR and compliance, GDPR requirements, and general data protection regulation compliance.

In this context, the Romanian law firm Pavel, Mărgărit and Associates provides specialised legal services in tax law, administrative law, and data protection law services in Romania, in accordance with privacy GDPR, the EU GDPR compliance framework, and the European GDPR regulations. Our team assists both individuals and companies, including through GDPR consultant services, privacy law lawyers, data protection lawyer, and data privacy attorney support, as well as representation by a litigation lawyer in Romania and a litigation lawyer in Bucharest in proceedings such as a court actionequivalent, administrative litigation, requests for suspension of administrative acts, and suspension of enforcement, ensuring full data privacy compliance and lawful processing of personal data GDPR.

Data protection lawyer in Romania. Current status of the draft law and mandatory legislative steps until its entry into force

The draft law is currently at an early stage, namely the phase of public and interinstitutional consultation, during which citizens and interested organisations may submit recommendations and proposals. Following this transparency stage, the document must obtain opinions from relevant ministries and competent institutions, after which it must be adopted by the Romanian Government in an official session. Subsequently, the draft enters parliamentary debate, where amendments may be introduced, and after final adoption by Parliament, it must be promulgated by the President and published in the Official Gazette to produce legal effects. Until the completion of this process, tax authorities cannot publish the lists, but once in force, these regulations may significantly affect the public and financial image of companies and individuals, particularly through the exposure of personal data GDPR, and sensitive fiscal information.

Through this draft law, tax authorities will be obliged to publish on their own websites lists of debtors, both natural and legal persons, who have outstanding tax liabilities. The measure aims to ensure fiscal transparency and to encourage debtors to fulfil their obligations to the state. However, a crucial aspect that must be considered is compliance with EU GDPR compliance, as such a measure may significantly affect the right to privacy and the lawful processing of personal data GDPR under the European GDPR regulations.

While, in the case of legal entities, much of this information is already publicly accessible, natural persons may be seriously affected by excessive processing of personal data GDPR, which can lead to social stigmatisation and, in some cases, loss of employment or business relationships. In this context, tax authorities should apply a strict necessity and proportionality test, verifying whether the publication of personal information is justified under GDPR requirements and consistent with general data protection regulation compliance.

Engaging the services of a litigation lawyer in Romania, a litigation lawyer in Bucharest, privacy law lawyers, a data protection lawyer, or a data privacy attorney, together with GDPR solicitors and European data privacy experts, can provide comprehensive legal assistance in assessing compliance. Likewise, a tax lawyer or specialists in tax litigation and tax disputes can offer guidance on administrative challenges, suspension of enforcement, and court proceedings.

Privacy law lawyers in Romania. Personal data protection: Compatibility with GDPR and the right to privacy

If the draft law is adopted in its current form, the publication on authority websites of names, fiscal domiciles, and debts of natural persons presents major risks of non-compliance with EU GDPR compliance and privacy GDPR, by infringing the right to private life through excessive processing of personal data GDPR.

Ordinarily, such a legislative change should be preceded by a Data Protection Impact Assessment, given that large-scale exposure of personal information may lead to serious consequences, including loss of employment or commercial partnerships. Authorities must demonstrate that publication is strictly necessary for the public interest and that no less intrusive alternatives exist, in line with GDPR requirements, general data protection regulation compliance, and the standards applied by experts in navigating GDPR.

Although the stated aim of the project is to enhance fiscal transparency, publishing personal data of taxpayers with debts may infringe EU GDPR compliance and violate the European GDPR regulations. The draft should therefore be accompanied by appropriate safeguards to limit unjustified exposure of personal data GDPR and ensure effective data privacy compliance.

The absence of appropriate assessments and safeguards may lead to excessive processing of personal data and real negative consequences for taxpayers, particularly in situations such as security incidents or cases where the debt is contested as unlawful or is subsequently paid off, but the data continues to be displayed in public lists.

Under these circumstances, the processing risks becoming unlawful from a personal data protection perspective, exposing public authorities to possible sanctions data breach in Romania under GDPR from the ANSPDCP (National Supervisory Authority for Personal Data Processing).

A data protection lawyer, data privacy attorney, privacy law lawyers, supported by European data privacy experts, can assist with compliance checks, complaints to the supervisory authority, and litigation concerning breaches of EU Regulation 2016/679.

Tax lawyer in Romania. Restrictions on the purchase of homes and cars: Impact on property rights and economic freedom

A significant change introduced by the draft concerns the redefinition of tax secrecy by expressly excluding debt-related information, through the amendment of Article 11(2) of the Fiscal Code, thereby strengthening the legal framework for processing sensitive fiscal data. In parallel, the project reinforces cooperation between central and local tax authorities by mandating the transmission of information regarding income sources of natural persons and notarial deeds concerning transfers of ownership over real estate and vehicles, via the PatrimVen system. These measures raise substantial issues regarding data protection in Romania, personal data GDPR, and GDPR and compliance.

Another major impact is the conditioning of the acquisition of ownership rights over buildings, land, and vehicles on the presentation of a tax clearance certificate proving the settlement of all local tax debts, or alternatively, an electronic verification of the fiscal situation. Acts concluded in breach of this obligation are sanctioned with absolute nullity, directly affecting real estate and automotive transactions and potentially generating complex tax disputes and tax litigation.

This controversial provision effectively blocks acquisitions by persons with outstanding local debts and may constitute an unjustified restriction of property rights and economic freedom guaranteed by the Constitution. It also introduces the possibility of assigning tax receivables to private operators, intensifying enforcement and raising additional concerns regarding personal data GDPR and lawful processing under EU GDPR compliance.

A tax lawyer, litigation lawyer in Romania, litigation lawyer in Bucharest, or specialists in tax disputes and tax litigation, together with privacy law lawyers, data protection lawyer, and GDPR solicitors, can provide assistance in challenging disproportionate measures, initiating court proceedings, suspending enforcement, and ensuring full data privacy compliance.

Litigation lawyer in Romania. How individuals and companies can protect themselves: Listing errors, debt assignment, and legal remedies

If a person is erroneously included on the debtor list or if the published amount is incorrect, legal mechanisms include notifying the competent authorities for rectification and deletion of inaccurate data. Where publication has occurred in breach of EU GDPR compliance and privacy GDPR, the affected individual may lodge a complaint with the national data protection authority, invoking violations of EU Regulation 2016/679 and general data protection regulation.

In cases of debt assignment, taxpayers have defensive tools such as challenging enforcement actions, invoking the unlawfulness of the title or procedural acts if enforcement is initiated. Prudent management of tax obligations and periodic verification of official records remain essential measures to avoid transactional blockages, tax disputes, and violations of data privacy.

“Fiscal transparency is necessary in a modern state, but it must respect the fundamental right to privacy and data protection in Romania. Any measure that publicly exposes natural persons must be proportionate, justified, and accompanied by real safeguards against abuse and administrative errors,” stated Dr. Radu Pavel, Managing Partener of the Romanian law firm Pavel, Mărgărit and Associates.

In conclusion, the draft law on the publication of tax debts introduces severe coercive mechanisms that may irreversibly affect the private life and economic freedom of citizens and companies in Romania. The compatibility of these measures with EU Regulation 2016/679, the European GDPR regulations, and constitutional property rights remains a subject of intense legal debate, given the risks of stigmatisation and administrative error. Protecting fundamental rights requires a strategic approach through remedies such as data rectification, complaints to the supervisory authority, administrative challenges, and court actions, with the support of a litigation lawyer in Romania, a tax lawyer, and European data privacy experts capable of ensuring full general data protection regulation compliance and effective defence against these emerging challenges.

Pavel, Margarit and Associates Law Firm is one of the top law firms in Romania, providing high-quality legal services. The firm’s clients include multinational and domestic companies of great magnitude. In 2025, the law firm’s success stories brought it international recognition from the most prestigious international guides and publications in the field. As a result, Pavel, Margarit and Associates Law Firm ranked 3rd in Romania in the Legal 500’s ranking of business law firms with the most relevant expertise. The law firm is internationally recognized by the IFLR 1000 Financial and Corporate 2025 guide. Additionally, Pavel, Margarit and Associates Law Firm is the only law firm in Romania recommended by the international director of Global Law Experts in London in the Dispute Resolution practice area. All relevant information about Pavel, Margarit and Associates Law Firm can be found on the website www.avocatpavel.com.