Governing the Exchange of Tax Data in Digital Public Infrastructure: Law, Rights, and the Protection of Citizens in Data-Driven Systems

Digital public infrastructure (DPI) can transform tax administration by enabling governments to identify taxpayers, link records, and exchange and analyse tax-relevant data across institutions at scale. DPI is better understood as a way of designing, governing, and using shared digital capabilities – including digital identity, digital payments, and secure exchange of data – to enable trusted interactions between people, businesses, and governments.

These systems can improve tax compliance, reduce fraud and evasion, and support public service delivery – but they also reshape how states exercise authority over citizens. Precisely because the exchange of data via these digital systems has significant potential benefits for tax authorities, citizens, and the broader DPI ecosystem, the use of these systems needs to be governed carefully from the outset to minimise the improper exercise of state authority. In taxation this shift is especially sensitive: revenue authorities increasingly rely on linked public and private data sources (identity, income, financial, transaction, customs, property, and behavioural data) to identify taxpayers, assess obligations, detect risks, and enforce compliance.

This brief argues that the exchange of tax data must be understood and governed as an exercise of public authority, not merely a technical or administrative function. Existing legal frameworks, including tax law, data protection law, administrative law, and rules for sharing public sector information, are often poorly suited to integrated, high-frequency, multi-actor data systems. This misalignment creates gaps in legal clarity, purpose limitation, transparency, oversight, and contestability. It can shift the burden of errors or data mismatches onto citizens – especially those with irregular incomes, incomplete records, limited documentation, or fewer resources to challenge decisions.

The brief proposes a citizen-centred approach to governance that prioritises legal clarity, purpose limitation, transparency, oversight, institutional capacity, participation, and effective recourse. Governance that protects rights is not a constraint on tax capacity, but a condition for trust, fairness, and voluntary compliance. The central message is that the exchange of tax data must be legally bounded, proportionate, accountable, operationally feasible, and open to challenge. With such safeguards, DPI-enabled tax systems can expand enforcement capacity, while also improving trust and fairness, and strengthening the fiscal social contract.

Key Messages:

• The exchange of tax data can strengthen tax capacity and improve services, but it is also public authority in action. It shapes how citizens are identified, assessed, and monitored, and how the state decides to act.
• The exchange of tax data therefore demands legal and institutional governance, not only technical interoperability. This means that governments must define who may access tax-relevant data, for what purposes, under which safeguards, and with what remedies for citizens.
• Data-driven tax systems create a structural asymmetry, and can shift risk onto citizens. Revenue authorities gain greater visibility over citizens’ personal and economic data, while citizens often have limited understanding of how their data is collected, combined, interpreted, and used. Third-party information can strengthen compliance, but when data is incomplete, inaccurate, poorly matched, or used without safeguards, citizens may bear the burden of correction, with that burden falling disproportionately on vulnerable groups.
• Governance that protects citizens strengthens tax capacity, trust, and compliance. Clear legal limits, transparency, oversight, accessible recourse, institutional capacity, and citizen participation help ensure that DPI-enabled tax systems are effective, fair, and trusted.