The list of petitioners in this case is long and startling: it was brought by 29 banks, Uganda’s development bank and the umbrella body for Uganda’s banks. Their petition dealt with several issues, but the central legal fight concerned a series of notices sent to the banks by the Commissioner General (CG) of the Ugandan Revenue Authority (URA).
The information required must have caused the banks to do a double take when they first received the notice: the breadth of the demand will certainly astonish readers of the judgment.
They were initially given just a couple of weeks to supply, in electronic format, a complete list of every single account held by the various banks for the full calendar years of 2016 and 2017 plus a raft of sensitive information about each account. The deadline was later extended by a further couple of weeks.
Among other details for each client, the URA wanted the account name and number, the name of the signatory and the type of account. It also wanted the taxpayer number, national ID number or business registration number of each account holder, the total credit in each account for both the two years, the total debits, the current balance as well as the phone number and email address of each client.
Even not particularly sophisticated cyber-criminals would have had rich pickings with such a treasure trove of data, and at the level of security risks alone, it seems to have been badly thought-through on the part of the URA. But was it even lawful? Did it measure up to the constitution?
The banks claimed the move was unconstitutional. They said the notices, issued to all financial institutions in Uganda in relation to every account held with them, was ‘an indiscriminate fishing exercise’ that lacked ‘any objective and rational basis’. It impaired the constitutionally guaranteed right to privacy of all bank account holders in Uganda in a way that goes beyond what is necessary to accomplish the objective of tax collection. And it was thus ‘beyond what is acceptable and demonstrably justifiable in a free and democratic society’ contrary to article 43 (2) (c) of the constitution.
Thus, the banks asked for a declaration that the laws under which the notices were issued were unconstitutional and void. As to the notices themselves, the banks wanted the court to declare that they impaired the right to privacy of all bank account holders in Uganda in a way that ‘far exceeds what is necessary to accomplish the objective of tax collection and is accordingly beyond what is acceptable and demonstrably justifiable in a free and democratic society’ in terms of the constitution.
According to the attorney-general, however, the petition was improperly before the court since it raised no issues or questions of interpretation of the constitution.
The court was informed that the URA had subsequently withdrawn the contentious notices ‘to indicate that it does not intend to insist on their enforcement’. But the banks said the case should continue. This was because they believed that, unless the court ruled on the question, the tax authority would make another attempt to issue similar notices in the future.
Having held that the matter should go ahead as it did indeed raise constitutional issues, the court carefully examined arguments put up by both sides.
On the question of the notices, with their demand for blanket information about every bank client, Justice Christopher Madrama Izama, who wrote the unanimous decision, said the CG had wide powers to demand information about specific taxpayers.
By way of illustration, he pointed to the fact that, for the purposes of ‘administering any provision of tax law’, the CG ‘shall have at all times and without prior notice, full and free access to any premises of place, any record, including a record in electronic format and any data storage device.’ The CG also had power to retrieve or extract ‘any copy of any record, including records in electronic format’ and was further empowered to seize ‘any device or data storage device that may contain data relevant to a tax obligation.’
However, it was clear that the law ‘envisages a tax investigation, and not a blanket investigation as demonstrated in the notices’. The CG also had to respect the privacy and the property of a taxpayer and had to exercise these powers constitutionally. This meant that there must be ‘probable cause’ before the CG exercised these investigatory powers.
‘Further, each taxpayer is an individual and therefore the information sought should be information required of the account holder lawfully sought in tax matters, rather than information required of the petitioner banks.’ And if taxpayers failed to produce tax returns and the information required by the URA, then the CG could ‘require it’ from whoever had the relevant details.
If the CG exercised these powers properly, then the tax law sections challenged by the banks were not unconstitutional, the court found. However, the CG ‘should comply with … the constitution and only exercise the powers in accordance with the accepted principles such as when there is a real investigation of suspected tax evasion or breach of a tax law of a specified individual.’
‘[T]he blanket notices issues by the Commissioner violated the rights of the account holders and were further in breach of article 27 of the constitution …. Though the respondents’ counsel submitted that the notices were withdrawn, I would declare that the notices were unconstitutional, null and void ….’
There was no probable cause behind the issue of the notices. They were ‘issued generally to third parties affecting account holders, without any investigation into any possible breach of the tax law [by] any of the account holders thereby arbitrarily violating their right to privacy.’
The upshot was that the sections of the tax law challenged by the banks were held not to be in conflict with the constitution. The notices, on the other hand, were found to be unconstitutional. The court also ordered that the URA should pay the legal costs of the petition, while the attorney general should bear its own costs.