Constitutional and legal limits of financial monitoring: proportionality of restricting the right to privacy in the case law of the European Court of Human Rights

Abstract

The expansion of the powers of financial monitoring entities to access banking and other confidential personal data, driven by the reform of Ukraine’s AML system in line with the EU’s 2024 AML package (Regulation (EU) 2024/1624 and Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority) and the FATF Recommendations, raises pressing questions about the constitutional limits of such interference with the right to privacy. Article 8 ECHR and Article 32 of the Constitution of Ukraine require that any interference be proportionate, yet this requirement remains insufficiently elaborated in Ukrainian legal scholarship as applied to financial monitoring.

The purpose of the article is to systematise, on the basis of ECtHR case law, the constitutional and legal limits of financial monitoring through the proportionality test applicable to restrictions of the right to privacy, and to propose ways of aligning Ukraine’s AML legislation with these standards.

The study relies on formal-legal, comparative-legal and case-law analysis. The Article 8 ECHR framework is reconstructed through the Council of Europe’s official guidance and three illustrative judgments – Michaud v. France (2012), M.N. and Others v. San Marino (2015) and Ferrieri and Bonassisa v. Italy (2025) — each addressing a different facet of access to financial data (professional reporting duties, judicial cooperation, tax administration) and together illustrating compliant and non-compliant models. This framework is then applied to Ukraine’s Law No. 361-IX of 6 December 2019.

Article 8 ECHR applies to banking and financial data as part of both private life and correspondence; compliance depends not on the absence of interference but on three cumulative safeguards — an accessible and foreseeable legal basis, a legitimate aim, and necessity-related guarantees, in particular independent oversight, scope limitation, and an effective remedy. Violation cases share a common deficiency – lack of effective independent control – while Michaud v. France complied due to a filtering mechanism protecting legal privilege. The article proposes amendments to Ukraine’s AML mechanism: an independent audit mechanism, risk-differentiated scope, and enhanced protection for attorney-client privilege.