Full Text
FISCAL SECULARITY: A CONSTITUTIONAL DESIGN FOR SEPARATING MONEY, TAXATION AND GOVERNANCE IN DIGITAL PAYMENT SYSTEMS
Cash is disappearing, and digital payment systems give governments new powers: watching every purchase, freezing any account, and punishing citizens financially for unpopular opinions. Our paper introduces Fiscal Secularity, defined as the constitutional and technical separation of money, taxation and governance, and asks one research question: which constitutional rules and which technical design features allow a government to collect taxes automatically from digital payments without gaining the power to weaponize citizen money? Our research design combines a review of automated transaction tax proposals, most importantly the Automated Payment Transaction tax family of proposals, never adopted while total payment surveillance remained unaddressed; a comparative study of institutional safeguards, including the logged-access data infrastructure of Estonia; and the specification of six safeguards: an append-only payment ledger which no official can edit, payment records sealed by default, a citizen-visible log of every record opening, an evidence rule which makes payment records opened without judicial approval unusable in court, judicial pre-authorization with mandatory delay and appeal for any account restriction, and fully transparent system design. Each safeguard is evaluated against documented failure scenarios, including account freezes later found unlawful by courts, with the tax rate and the judicial action threshold named as open parameters. We anticipate two findings: first, citizens are more likely to adopt government-issued digital currency and accept automated taxation, whether as one flat percentage per payment or as automatic calculation of income and costs, when Fiscal Secularity and similar governance technologies remove the fear of financial punishment; second, automated taxation ends tax paperwork, makes small businesses easier to run, strengthens national competitiveness, increases the tax collection rate, and releases human intelligence from accounting compliance toward invention and production. Our paper recommends entrenching Fiscal Secularity in constitutional law, as a basic right resistant to amendment, before any government mandates a national digital payment system.
INTRODUCTION: MONEY IS BECOMING INFRASTRUCTURE, AND INFRASTRUCTURE HAS OWNERS
Cash is disappearing from daily life at a measurable speed. In Sweden, the share of people who paid cash for their most recent in-store purchase fell from around forty percent in 2010 to under ten percent in 2020, and the same survey series records five percent in 2025, down from ten percent in 2023; roughly one Swedish shopper in three who wanted to pay cash has met a store which refused cash (Sveriges Riksbank 2020; 2026). The replacement of cash is not only a private-sector story: one hundred forty-six countries and currency unions, representing over ninety-eight percent of world economic output, are exploring central bank digital currency, seventy-seven are in advanced phases, and three countries have fully launched (Atlantic Council 2026). When cash becomes database entries, money stops being an object citizens hold and becomes a service governments and payment companies operate. A service can be switched off; a coin cannot.
Two documented episodes show the new powers are real rather than hypothetical, and our paper deliberately presents both episodes through court findings rather than through political argument. In February 2022, the government of Canada announced emergency measures under which banks could freeze accounts connected to street protests without a court order, and more than two hundred accounts holding several million dollars were frozen without judicial authorization. A Federal Court judge later ruled the invocation of the emergency law unreasonable and found an infringement of constitutionally protected rights, and the Federal Court of Appeal dismissed the government appeal, noting a "lack of rigour" in identifying the people whose bank accounts were frozen (Tunney 2024; CBC News 2026). The second episode involved private gatekeepers rather than a state: in December 2010, the major card networks and an online payment company suspended or blocked payments to a publishing organization, and the Supreme Court of Iceland later ordered the regional card processor to resume processing the blocked donations (Greenberg 2010; WikiLeaks 2013). The two episodes teach one structural lesson: wherever payment infrastructure exists, both governments and intermediaries can restrict a person's economic life without any judge approving the restriction in advance.
Financial observation and financial punishment produce chilling effects, meaning citizens silence themselves in advance out of fear. The chilling effect is not speculation; the chilling effect has been measured. The first empirical legal study of regulatory chilling effects showed traffic to privacy-sensitive encyclopedia articles decreased after the surveillance revelations of June 2013, with visits dropping nearly thirty percent, and the decline changed the long-term trend rather than fading immediately (Penney 2016). Reading is intimate, but spending is even more intimate: donations, memberships, medicines, books, and travel all leave payment records. When citizens fear their money can be watched or frozen because of unpopular opinions, citizens stop donating, stop subscribing, and stop associating, and a democracy quietly loses the argument before the argument starts. Citizens already state the fear plainly: the European Central Bank consultation on the digital euro drew more than eight thousand two hundred responses, a record for such consultations, and forty-three percent of respondents ranked privacy as the most important feature, ahead of security at eighteen percent, across all countries and respondent types (European Central Bank 2021).
THE CONCEPT OF FISCAL SECULARITY AND OUR RESEARCH QUESTION
Secularity separates religion and government: the state may not use a citizen's belief against the citizen, and the state may not operate the machinery of belief. Our paper proposes the same separation for money. Fiscal Secularity is the constitutional and technical separation of money, taxation and governance: the government may operate payment infrastructure and may collect the lawful tax automatically, but the government may not watch citizen spending at will, may not block access to citizen money without a judge, and may not use payment records as an instrument of punishment for lawful behavior. Money deserves such protection because money is stored life energy: every unit represents hours of a citizen's finite life converted into transferable form.
Our paper asks one explicit research question, repeated here in full: which constitutional rules and which technical design features allow a government to collect taxes automatically from digital payments without gaining the power to weaponize citizen money? Our central thesis is a bundle thesis. Automated transaction taxation without Fiscal Secularity fails politically, because citizens correctly perceive total payment surveillance. Fiscal Secularity without automated taxation loses the enormous efficiency prize described in Section 8. The bundle of the two, and only the bundle, is viable, and the bundle is the contribution of our paper.
RESEARCH DESIGN
Our research design combines three activities. First, our paper reviews the historical family of automated transaction tax proposals and identifies the unresolved objection which stopped the proposals. Second, our paper conducts a comparative study of working institutional safeguards across five domains: Estonian data infrastructure, European data protection law, American evidence law, cryptographic engineering, and comparative constitutional law. Third, our paper specifies six safeguards, states the origin of each safeguard, and evaluates each safeguard against documented failure scenarios. Because our paper is a position paper, the two findings are anticipated findings; the exact tax rate and the exact judicial action threshold are named open parameters for national calibration, and a procedure for later empirical testing is defined in Section 7.
PRIOR ART: THE AUTOMATED PAYMENT TRANSACTION TAX
The idea of taxing payments automatically is not new. Feige proposed replacing personal and corporate income taxes, sales and excise taxes, capital gains taxes, import and export duties, and gift and estate taxes with a single flat tax on all transactions, assessed and collected automatically when transactions settle through the electronic technology of the banking and payments system (Feige 2000; Feige 2001). The design contains no deductions, no exemptions, and no exclusions, and the automated recording of payments removes the need to file tax returns and information returns entirely. Progressivity enters through the tax base rather than the rate schedule, because wealthy households carry out a disproportionate share of total transactions. The proposal was presented to the President's Advisory Panel on Federal Tax Reform in the United States in 2005 (Feige 2005). No major economy adopted the proposal.
Why did an engineering success become a political failure? Contemporaneous discussion records a privacy objection: a tax collected on every payment implies a government able to see every transaction in the economy. The objection was answered technically, never constitutionally, and our paper reads the history as follows: the Automated Payment Transaction tax solved the problem of how a state collects, and left unsolved the problem of how a citizen stops fearing the collector. Our paper supplies the missing constitutional half, and Section 5 shows every required component already works somewhere in the world.
A COMPARATIVE STUDY OF INSTITUTIONAL SAFEGUARDS
Estonia supplies the first component: logged, citizen-visible access to personal records. Every exchange on the Estonian national data exchange platform is encrypted, signed, logged, and verifiable, and the design lets users see who has retrieved or accessed their data. Since 2017, a dedicated data tracker lets any resident log into the state portal and review the full list of queries concerning personal information, including who accessed the information and for what reasons, and the national information authority describes the purpose of the tracker as giving each citizen a clear overview of operations performed with citizen data (e-Estonia 2019; Estonian Information System Authority 2024). Estonian officials report private data is better protected in the digital environment than in the paper environment, precisely because paper access is untraceable while digital access can be tracked. The Estonian lesson: the record of who looked is itself a record, and giving the log to the citizen converts surveillance anxiety into verifiable accountability.
European data protection law supplies the second component: protection as the default state rather than as an option. Article 25 of the General Data Protection Regulation requires, by default, processing of only the personal data necessary for each specific purpose (European Union 2016). Applied to central bank money, the European Data Protection Board took the position in 2021 that a digital euro should include privacy and data protection by default and by design (CNIL 2023). The European lesson: defaults are constitutional facts in miniature, because most citizens never change defaults.
American evidence law supplies the third component: courts can remove the reward for unlawful observation. The exclusionary rule prevents the government from using most evidence gathered in violation of the constitution, following the landmark search-and-seizure decision; the Supreme Court ruled in 1961 that illegally obtained evidence is inadmissible in state courts, extending the earlier federal rule first established in 1914 (Weeks v. United States 1914; Mapp v. Ohio 1961). The American lesson: when the fruits of unlawful access become unusable, the incentive to access unlawfully collapses.
Cryptographic engineering supplies the fourth component: records nobody can silently rewrite. Haber and Stornetta showed in 1991 how digital time-stamping can make back-dating and forward-dating of records computationally infeasible even with the collusion of the record-keeping service, using hash-linked chains into which nothing can feasibly be inserted or substituted and from which nothing can feasibly be deleted (Haber and Stornetta 1991; Bayer, Haber and Stornetta 1993). The same construction now runs at internet scale as public, verifiable, append-only logs for web certificates (Laurie 2014). A complementary engineering principle governs the design as a whole: a security system should remain secure even when everything about the system is public knowledge except the key, a principle formulated by Kerckhoffs in the nineteenth century and popularized by Shannon, because every secret in a system design creates a potential failure point and secrecy breeds brittleness (Kerckhoffs 1883).
Comparative constitutional law supplies the fifth component: rules which survive future majorities. The German Basic Law, in Article 79(3), prohibits amendments removing the principles laid down in the articles on human dignity and on the democratic order, and constitutions in Brazil, the Czech Republic, Germany, Greece, India, Iran, Italy, Morocco, Norway and Turkey contain comparable entrenched or eternity clauses, which require supermajorities or referendums or are unamendable outright. Courts in India developed the parallel basic structure doctrine, under which core constitutional provisions receive special protected status against ordinary amendment (Kesavananda Bharati v. State of Kerala 1973). The constitutional lesson: societies already know how to place selected rules beyond the reach of temporary political anger.
Each jurisdiction above solved one fragment. No jurisdiction has bundled the five fragments around money. Fiscal Secularity is the bundle.
SPECIFICATION OF SIX SAFEGUARDS
Safeguard one: an append-only payment ledger which no official can edit. Nothing on the ledger is ever reversed, deleted, or rewritten; corrections of error, theft, and fraud happen as new compensating transactions ordered by a court and carried out by the obligated party. Reversal is a judicial act performed through people, never an administrative act performed on the ledger. Origin: the tamper-evident time-stamping construction of Haber and Stornetta and the public append-only log engineering of certificate transparency.
Safeguard two: payment records sealed by default. All payment records exist and are retained, but no official can read the records without legal cause; the design is sealed, not secret. Origin: the data-protection-by-default obligation of Article 25 and the European Data Protection Board position on a digital euro.
Safeguard three: a citizen-visible log of every record opening. Every opening of a citizen's payment records writes a permanent entry stating who opened, when, and for what stated reason, and the entry is immediately visible to the affected citizen. Origin: the Estonian data tracker on the national state portal.
Safeguard four: an evidence rule. Payment records opened without judicial approval, including records opened through covert or classified programs, are unusable in any court for any purpose. Origin: the exclusionary rule of American constitutional criminal procedure.
Safeguard five: judicial pre-authorization with deliberate friction for any account restriction. Freezing or blocking requires a prior court order naming the person and the cause, is time-limited, is logged and visible under safeguard three, and is appealable on an emergency schedule. Origin: the documented failure mode of February 2022, in which account freezes proceeded with no court order, no due process, and no appeal mechanism and which courts subsequently found unreasonable and rights-infringing; safeguard five converts the after-the-fact judicial findings into before-the-fact design.
Safeguard six: transparent system design. The complete design of the payment system, including the sealing, logging, and deduction mechanisms, is published; security rests on keys and law, never on secrecy of design. The slogan of safeguards two and six together: sealed data, transparent design. Origin: the principle of Kerckhoffs.
EVALUATION AGAINST FAILURE SCENARIOS AND OPEN PARAMETERS
Our paper evaluates the six safeguards against four structural failure scenarios, each drawn from the documented record but stated in system language rather than political language. Scenario one, mass restriction of a disfavored group: safeguard five blocks restriction without individual court orders, safeguard three makes every attempt visible, and safeguard four removes any courtroom value of records gathered along the way. Scenario two, covert reading of payment records: safeguard two denies default readability, safeguard three timestamps any breach into a citizen-visible log, and safeguard four makes the harvest worthless as evidence. Scenario three, blockade by private intermediaries: a central-bank payment instrument guarantees every citizen a public payment rail, and safeguard five applies the same judicial gate to the public rail which private networks never applied to themselves. Scenario four, threshold creep, in which exceptions expand step by step from serious crime toward speech-adjacent offenses: safeguard one prevents silent rewriting of history, and the entrenchment mechanism of Section 9 makes each expansion require constitutional-level consent rather than ordinary legislation.
Two parameters remain deliberately open. The first open parameter is the flat rate for automated transaction-based taxation; our working example is two and one half percent per transaction, a figure consistent with historically persistent flat levies which maintained perceived fairness across many centuries, and the cap on the rate belongs in the constitutional text itself. The second open parameter is the judicial action threshold, meaning the list of crimes for which courts may unseal records and order compensating transactions; our working specification limits the list to theft of funds and fraud, including obtaining funds by deception. The evaluation procedure for future empirical work is defined as follows: survey experiments measuring stated willingness to adopt a government payment instrument with and without the six safeguards, followed by staged national pilots instrumented to measure adoption, transaction volume, and compliance cost.
TWO ANTICIPATED FINDINGS
Anticipated finding one: safety increases adoption. General technology-acceptance research supports the mechanism: acceptance of electronic commerce is driven by perceived usefulness and ease of use together with trust, and is suppressed by perceived risk (Pavlou 2003). The history of deposit insurance supports the mechanism by analogy: bank deposits returned when a credible guarantee removed the fear of loss, not when marketing improved. Central bank digital currency evidence supports the mechanism by contrast: Nigeria launched a retail digital currency in 2021, and the project did not move beyond an initial wave of limited adoption in a first year of otherwise undisrupted operation; adoption was, in the words of International Monetary Fund staff, "disappointingly low", with roughly fourteen thousand transactions per week, meaning ninety-eight and one half percent of downloaded wallets sat unused in any given week (Ree 2023). Fund staff conclude central banks must actively build public understanding and acceptance (International Monetary Fund 2024), and European civil-society analysis states the same conclusion for the digital euro: a project ignoring the privacy demand of citizens risks failing through lack of public trust rather than through regulation (EDRi 2026). Our anticipated finding follows: citizens are more likely to adopt government-issued digital currency, and more likely to accept automated taxation, whether as one flat percentage per payment or as automatic calculation of all income and costs, when Fiscal Secularity and similar governance technologies remove the fear of financial punishment. The finding is probabilistic and testable by the procedure of Section 7.
Anticipated finding two: automated taxation ends tax paperwork, helps small businesses, strengthens competitiveness, raises the collection rate, and releases human intelligence. On paperwork: Americans spend over seven point nine billion hours per year on tax compliance, worth roughly four hundred thirteen billion dollars in lost productivity plus one hundred thirty-three billion dollars out of pocket, totaling five hundred forty-six billion dollars, nearly two percent of national output, more than the corporate income tax collects and about twenty-six times the tax agency budget (Tax Foundation 2024); even the lowest available government estimates reach roughly one percent of national output (Government Accountability Office 2005). Automated deduction at the moment of payment, with the invoice generated automatically inside the payment itself, converts the transaction stream into the bookkeeping. On small businesses and competitiveness: most of the compliance burden falls on businesses, and fixed compliance costs weigh heaviest on the smallest firms, so removing filing, hired accountants, and tax software lowers the cost of running a small firm and shifts national resources from overhead toward production. On the collection rate: individual filers report ninety-nine percent of wage and salary income accurately, because employers both report the income and withhold the tax, while filers underreport fifty-five percent of income not subject to information reporting (Congressional Research Service 2023); where income faces both information returns and withholding, only about one percent goes unreported (Tax Policy Center 2024); and the projected gross tax gap reached six hundred ninety-six billion dollars for tax year 2022, with only eighty-five percent of true tax paid voluntarily and on time, while official studies consistently show compliance rises with third-party reporting and rises further with withholding (Internal Revenue Service 2019; 2024). Automated collection at settlement generalizes the highest-compliance regime, the withheld wage, to every payment in the economy, so the collection rate rises without new punitive powers. On intelligence: scarcity research shows administrative and financial burdens overload mental bandwidth, degrading decision-making and performance (Mullainathan and Shafir 2013); controlled studies found financial worries reduce cognitive performance, with the same farmers scoring worse before harvest, when poor, than after harvest, when paid, and the authors describe poverty as imposing a "bandwidth tax" (Mani, Mullainathan, Shafir and Zhao 2013). Compulsory tax accounting is exactly such a bandwidth tax levied on every firm and household; ending compulsory tax accounting releases human intelligence from compliance toward invention, design, and production. Internal management accounting may continue wherever firms find management accounting privately useful; what disappears is the compulsory layer.
RECOMMENDATION: ENTRENCH BEFORE MANDATING
The sequence is the recommendation. A government which mandates a national digital payment system first and promises restraint second builds the fear machine before asking for trust, and finding one predicts weak adoption exactly as observed in the mandated-first cases. Our paper recommends the reverse order: first entrench Fiscal Secularity in constitutional law, then issue the payment instrument, then collect the flat automated tax. Entrenchment should operate at the tier of basic rights, using the established toolbox: an unamendable core on the German model for the six safeguards and the rate cap, or supermajority plus referendum requirements where an unamendable core does not fit the national tradition, with the basic structure doctrine showing how courts can guard a protected core even without explicit text. The reason for constitutional-grade protection is historical: exceptions expand, from terrorism to money laundering to tax to speech-adjacent offenses, and the design goal is to make each expansion structurally expensive rather than dependent on official goodwill. One honest caveat accompanies the recommendation: comparative scholarship warns entrenchment taken to the point of unamendability can undermine the very commitments entrenchment protects, so our paper reserves the unamendable tier for the narrow core only: the seal, the log, the evidence rule, the judicial gate, and the rate cap.
CONCLUSION
Money is stored life energy, and a person who fears for their stored life energy censors present life. The separation of money and governance stands to economic life as the separation of religion and governance stands to belief: the state keeps the lawful revenue, and loses the instrument of intimidation. A century-old family of automated tax proposals failed while total payment surveillance remained unaddressed; five working institutions, from the Estonian access log to the exclusionary rule to the eternity clause, supply every missing part. Bundled as Fiscal Secularity, the parts turn a feared payment database into trusted public infrastructure, and turn taxation from an annual bureaucratic siege into an invisible, constant, capped flow. Our paper recommends one order of operations for every government now designing digital money: entrench first, issue second, collect third.
Cash is disappearing, and digital payment systems give governments new powers: watching every purchase, freezing any account, and punishing citizens financially for unpopular opinions. Our paper introduces Fiscal Secularity, defined as the constitutional and technical separation of money, taxation and governance, and asks one research question: which constitutional rules and which technical design features allow a government to collect taxes automatically from digital payments without gaining the power to weaponize citizen money? Our research design combines a review of automated transaction tax proposals, most importantly the Automated Payment Transaction tax family of proposals, never adopted while total payment surveillance remained unaddressed; a comparative study of institutional safeguards, including the logged-access data infrastructure of Estonia; and the specification of six safeguards: an append-only payment ledger which no official can edit, payment records sealed by default, a citizen-visible log of every record opening, an evidence rule which makes payment records opened without judicial approval unusable in court, judicial pre-authorization with mandatory delay and appeal for any account restriction, and fully transparent system design. Each safeguard is evaluated against documented failure scenarios, including account freezes later found unlawful by courts, with the tax rate and the judicial action threshold named as open parameters. We anticipate two findings: first, citizens are more likely to adopt government-issued digital currency and accept automated taxation, whether as one flat percentage per payment or as automatic calculation of income and costs, when Fiscal Secularity and similar governance technologies remove the fear of financial punishment; second, automated taxation ends tax paperwork, makes small businesses easier to run, strengthens national competitiveness, increases the tax collection rate, and releases human intelligence from accounting compliance toward invention and production. Our paper recommends entrenching Fiscal Secularity in constitutional law, as a basic right resistant to amendment, before any government mandates a national digital payment system.
INTRODUCTION: MONEY IS BECOMING INFRASTRUCTURE, AND INFRASTRUCTURE HAS OWNERS
Cash is disappearing from daily life at a measurable speed. In Sweden, the share of people who paid cash for their most recent in-store purchase fell from around forty percent in 2010 to under ten percent in 2020, and the same survey series records five percent in 2025, down from ten percent in 2023; roughly one Swedish shopper in three who wanted to pay cash has met a store which refused cash (Sveriges Riksbank 2020; 2026). The replacement of cash is not only a private-sector story: one hundred forty-six countries and currency unions, representing over ninety-eight percent of world economic output, are exploring central bank digital currency, seventy-seven are in advanced phases, and three countries have fully launched (Atlantic Council 2026). When cash becomes database entries, money stops being an object citizens hold and becomes a service governments and payment companies operate. A service can be switched off; a coin cannot.
Two documented episodes show the new powers are real rather than hypothetical, and our paper deliberately presents both episodes through court findings rather than through political argument. In February 2022, the government of Canada announced emergency measures under which banks could freeze accounts connected to street protests without a court order, and more than two hundred accounts holding several million dollars were frozen without judicial authorization. A Federal Court judge later ruled the invocation of the emergency law unreasonable and found an infringement of constitutionally protected rights, and the Federal Court of Appeal dismissed the government appeal, noting a "lack of rigour" in identifying the people whose bank accounts were frozen (Tunney 2024; CBC News 2026). The second episode involved private gatekeepers rather than a state: in December 2010, the major card networks and an online payment company suspended or blocked payments to a publishing organization, and the Supreme Court of Iceland later ordered the regional card processor to resume processing the blocked donations (Greenberg 2010; WikiLeaks 2013). The two episodes teach one structural lesson: wherever payment infrastructure exists, both governments and intermediaries can restrict a person's economic life without any judge approving the restriction in advance.
Financial observation and financial punishment produce chilling effects, meaning citizens silence themselves in advance out of fear. The chilling effect is not speculation; the chilling effect has been measured. The first empirical legal study of regulatory chilling effects showed traffic to privacy-sensitive encyclopedia articles decreased after the surveillance revelations of June 2013, with visits dropping nearly thirty percent, and the decline changed the long-term trend rather than fading immediately (Penney 2016). Reading is intimate, but spending is even more intimate: donations, memberships, medicines, books, and travel all leave payment records. When citizens fear their money can be watched or frozen because of unpopular opinions, citizens stop donating, stop subscribing, and stop associating, and a democracy quietly loses the argument before the argument starts. Citizens already state the fear plainly: the European Central Bank consultation on the digital euro drew more than eight thousand two hundred responses, a record for such consultations, and forty-three percent of respondents ranked privacy as the most important feature, ahead of security at eighteen percent, across all countries and respondent types (European Central Bank 2021).
THE CONCEPT OF FISCAL SECULARITY AND OUR RESEARCH QUESTION
Secularity separates religion and government: the state may not use a citizen's belief against the citizen, and the state may not operate the machinery of belief. Our paper proposes the same separation for money. Fiscal Secularity is the constitutional and technical separation of money, taxation and governance: the government may operate payment infrastructure and may collect the lawful tax automatically, but the government may not watch citizen spending at will, may not block access to citizen money without a judge, and may not use payment records as an instrument of punishment for lawful behavior. Money deserves such protection because money is stored life energy: every unit represents hours of a citizen's finite life converted into transferable form.
Our paper asks one explicit research question, repeated here in full: which constitutional rules and which technical design features allow a government to collect taxes automatically from digital payments without gaining the power to weaponize citizen money? Our central thesis is a bundle thesis. Automated transaction taxation without Fiscal Secularity fails politically, because citizens correctly perceive total payment surveillance. Fiscal Secularity without automated taxation loses the enormous efficiency prize described in Section 8. The bundle of the two, and only the bundle, is viable, and the bundle is the contribution of our paper.
RESEARCH DESIGN
Our research design combines three activities. First, our paper reviews the historical family of automated transaction tax proposals and identifies the unresolved objection which stopped the proposals. Second, our paper conducts a comparative study of working institutional safeguards across five domains: Estonian data infrastructure, European data protection law, American evidence law, cryptographic engineering, and comparative constitutional law. Third, our paper specifies six safeguards, states the origin of each safeguard, and evaluates each safeguard against documented failure scenarios. Because our paper is a position paper, the two findings are anticipated findings; the exact tax rate and the exact judicial action threshold are named open parameters for national calibration, and a procedure for later empirical testing is defined in Section 7.
PRIOR ART: THE AUTOMATED PAYMENT TRANSACTION TAX
The idea of taxing payments automatically is not new. Feige proposed replacing personal and corporate income taxes, sales and excise taxes, capital gains taxes, import and export duties, and gift and estate taxes with a single flat tax on all transactions, assessed and collected automatically when transactions settle through the electronic technology of the banking and payments system (Feige 2000; Feige 2001). The design contains no deductions, no exemptions, and no exclusions, and the automated recording of payments removes the need to file tax returns and information returns entirely. Progressivity enters through the tax base rather than the rate schedule, because wealthy households carry out a disproportionate share of total transactions. The proposal was presented to the President's Advisory Panel on Federal Tax Reform in the United States in 2005 (Feige 2005). No major economy adopted the proposal.
Why did an engineering success become a political failure? Contemporaneous discussion records a privacy objection: a tax collected on every payment implies a government able to see every transaction in the economy. The objection was answered technically, never constitutionally, and our paper reads the history as follows: the Automated Payment Transaction tax solved the problem of how a state collects, and left unsolved the problem of how a citizen stops fearing the collector. Our paper supplies the missing constitutional half, and Section 5 shows every required component already works somewhere in the world.
A COMPARATIVE STUDY OF INSTITUTIONAL SAFEGUARDS
Estonia supplies the first component: logged, citizen-visible access to personal records. Every exchange on the Estonian national data exchange platform is encrypted, signed, logged, and verifiable, and the design lets users see who has retrieved or accessed their data. Since 2017, a dedicated data tracker lets any resident log into the state portal and review the full list of queries concerning personal information, including who accessed the information and for what reasons, and the national information authority describes the purpose of the tracker as giving each citizen a clear overview of operations performed with citizen data (e-Estonia 2019; Estonian Information System Authority 2024). Estonian officials report private data is better protected in the digital environment than in the paper environment, precisely because paper access is untraceable while digital access can be tracked. The Estonian lesson: the record of who looked is itself a record, and giving the log to the citizen converts surveillance anxiety into verifiable accountability.
European data protection law supplies the second component: protection as the default state rather than as an option. Article 25 of the General Data Protection Regulation requires, by default, processing of only the personal data necessary for each specific purpose (European Union 2016). Applied to central bank money, the European Data Protection Board took the position in 2021 that a digital euro should include privacy and data protection by default and by design (CNIL 2023). The European lesson: defaults are constitutional facts in miniature, because most citizens never change defaults.
American evidence law supplies the third component: courts can remove the reward for unlawful observation. The exclusionary rule prevents the government from using most evidence gathered in violation of the constitution, following the landmark search-and-seizure decision; the Supreme Court ruled in 1961 that illegally obtained evidence is inadmissible in state courts, extending the earlier federal rule first established in 1914 (Weeks v. United States 1914; Mapp v. Ohio 1961). The American lesson: when the fruits of unlawful access become unusable, the incentive to access unlawfully collapses.
Cryptographic engineering supplies the fourth component: records nobody can silently rewrite. Haber and Stornetta showed in 1991 how digital time-stamping can make back-dating and forward-dating of records computationally infeasible even with the collusion of the record-keeping service, using hash-linked chains into which nothing can feasibly be inserted or substituted and from which nothing can feasibly be deleted (Haber and Stornetta 1991; Bayer, Haber and Stornetta 1993). The same construction now runs at internet scale as public, verifiable, append-only logs for web certificates (Laurie 2014). A complementary engineering principle governs the design as a whole: a security system should remain secure even when everything about the system is public knowledge except the key, a principle formulated by Kerckhoffs in the nineteenth century and popularized by Shannon, because every secret in a system design creates a potential failure point and secrecy breeds brittleness (Kerckhoffs 1883).
Comparative constitutional law supplies the fifth component: rules which survive future majorities. The German Basic Law, in Article 79(3), prohibits amendments removing the principles laid down in the articles on human dignity and on the democratic order, and constitutions in Brazil, the Czech Republic, Germany, Greece, India, Iran, Italy, Morocco, Norway and Turkey contain comparable entrenched or eternity clauses, which require supermajorities or referendums or are unamendable outright. Courts in India developed the parallel basic structure doctrine, under which core constitutional provisions receive special protected status against ordinary amendment (Kesavananda Bharati v. State of Kerala 1973). The constitutional lesson: societies already know how to place selected rules beyond the reach of temporary political anger.
Each jurisdiction above solved one fragment. No jurisdiction has bundled the five fragments around money. Fiscal Secularity is the bundle.
SPECIFICATION OF SIX SAFEGUARDS
Safeguard one: an append-only payment ledger which no official can edit. Nothing on the ledger is ever reversed, deleted, or rewritten; corrections of error, theft, and fraud happen as new compensating transactions ordered by a court and carried out by the obligated party. Reversal is a judicial act performed through people, never an administrative act performed on the ledger. Origin: the tamper-evident time-stamping construction of Haber and Stornetta and the public append-only log engineering of certificate transparency.
Safeguard two: payment records sealed by default. All payment records exist and are retained, but no official can read the records without legal cause; the design is sealed, not secret. Origin: the data-protection-by-default obligation of Article 25 and the European Data Protection Board position on a digital euro.
Safeguard three: a citizen-visible log of every record opening. Every opening of a citizen's payment records writes a permanent entry stating who opened, when, and for what stated reason, and the entry is immediately visible to the affected citizen. Origin: the Estonian data tracker on the national state portal.
Safeguard four: an evidence rule. Payment records opened without judicial approval, including records opened through covert or classified programs, are unusable in any court for any purpose. Origin: the exclusionary rule of American constitutional criminal procedure.
Safeguard five: judicial pre-authorization with deliberate friction for any account restriction. Freezing or blocking requires a prior court order naming the person and the cause, is time-limited, is logged and visible under safeguard three, and is appealable on an emergency schedule. Origin: the documented failure mode of February 2022, in which account freezes proceeded with no court order, no due process, and no appeal mechanism and which courts subsequently found unreasonable and rights-infringing; safeguard five converts the after-the-fact judicial findings into before-the-fact design.
Safeguard six: transparent system design. The complete design of the payment system, including the sealing, logging, and deduction mechanisms, is published; security rests on keys and law, never on secrecy of design. The slogan of safeguards two and six together: sealed data, transparent design. Origin: the principle of Kerckhoffs.
EVALUATION AGAINST FAILURE SCENARIOS AND OPEN PARAMETERS
Our paper evaluates the six safeguards against four structural failure scenarios, each drawn from the documented record but stated in system language rather than political language. Scenario one, mass restriction of a disfavored group: safeguard five blocks restriction without individual court orders, safeguard three makes every attempt visible, and safeguard four removes any courtroom value of records gathered along the way. Scenario two, covert reading of payment records: safeguard two denies default readability, safeguard three timestamps any breach into a citizen-visible log, and safeguard four makes the harvest worthless as evidence. Scenario three, blockade by private intermediaries: a central-bank payment instrument guarantees every citizen a public payment rail, and safeguard five applies the same judicial gate to the public rail which private networks never applied to themselves. Scenario four, threshold creep, in which exceptions expand step by step from serious crime toward speech-adjacent offenses: safeguard one prevents silent rewriting of history, and the entrenchment mechanism of Section 9 makes each expansion require constitutional-level consent rather than ordinary legislation.
Two parameters remain deliberately open. The first open parameter is the flat rate for automated transaction-based taxation; our working example is two and one half percent per transaction, a figure consistent with historically persistent flat levies which maintained perceived fairness across many centuries, and the cap on the rate belongs in the constitutional text itself. The second open parameter is the judicial action threshold, meaning the list of crimes for which courts may unseal records and order compensating transactions; our working specification limits the list to theft of funds and fraud, including obtaining funds by deception. The evaluation procedure for future empirical work is defined as follows: survey experiments measuring stated willingness to adopt a government payment instrument with and without the six safeguards, followed by staged national pilots instrumented to measure adoption, transaction volume, and compliance cost.
TWO ANTICIPATED FINDINGS
Anticipated finding one: safety increases adoption. General technology-acceptance research supports the mechanism: acceptance of electronic commerce is driven by perceived usefulness and ease of use together with trust, and is suppressed by perceived risk (Pavlou 2003). The history of deposit insurance supports the mechanism by analogy: bank deposits returned when a credible guarantee removed the fear of loss, not when marketing improved. Central bank digital currency evidence supports the mechanism by contrast: Nigeria launched a retail digital currency in 2021, and the project did not move beyond an initial wave of limited adoption in a first year of otherwise undisrupted operation; adoption was, in the words of International Monetary Fund staff, "disappointingly low", with roughly fourteen thousand transactions per week, meaning ninety-eight and one half percent of downloaded wallets sat unused in any given week (Ree 2023). Fund staff conclude central banks must actively build public understanding and acceptance (International Monetary Fund 2024), and European civil-society analysis states the same conclusion for the digital euro: a project ignoring the privacy demand of citizens risks failing through lack of public trust rather than through regulation (EDRi 2026). Our anticipated finding follows: citizens are more likely to adopt government-issued digital currency, and more likely to accept automated taxation, whether as one flat percentage per payment or as automatic calculation of all income and costs, when Fiscal Secularity and similar governance technologies remove the fear of financial punishment. The finding is probabilistic and testable by the procedure of Section 7.
Anticipated finding two: automated taxation ends tax paperwork, helps small businesses, strengthens competitiveness, raises the collection rate, and releases human intelligence. On paperwork: Americans spend over seven point nine billion hours per year on tax compliance, worth roughly four hundred thirteen billion dollars in lost productivity plus one hundred thirty-three billion dollars out of pocket, totaling five hundred forty-six billion dollars, nearly two percent of national output, more than the corporate income tax collects and about twenty-six times the tax agency budget (Tax Foundation 2024); even the lowest available government estimates reach roughly one percent of national output (Government Accountability Office 2005). Automated deduction at the moment of payment, with the invoice generated automatically inside the payment itself, converts the transaction stream into the bookkeeping. On small businesses and competitiveness: most of the compliance burden falls on businesses, and fixed compliance costs weigh heaviest on the smallest firms, so removing filing, hired accountants, and tax software lowers the cost of running a small firm and shifts national resources from overhead toward production. On the collection rate: individual filers report ninety-nine percent of wage and salary income accurately, because employers both report the income and withhold the tax, while filers underreport fifty-five percent of income not subject to information reporting (Congressional Research Service 2023); where income faces both information returns and withholding, only about one percent goes unreported (Tax Policy Center 2024); and the projected gross tax gap reached six hundred ninety-six billion dollars for tax year 2022, with only eighty-five percent of true tax paid voluntarily and on time, while official studies consistently show compliance rises with third-party reporting and rises further with withholding (Internal Revenue Service 2019; 2024). Automated collection at settlement generalizes the highest-compliance regime, the withheld wage, to every payment in the economy, so the collection rate rises without new punitive powers. On intelligence: scarcity research shows administrative and financial burdens overload mental bandwidth, degrading decision-making and performance (Mullainathan and Shafir 2013); controlled studies found financial worries reduce cognitive performance, with the same farmers scoring worse before harvest, when poor, than after harvest, when paid, and the authors describe poverty as imposing a "bandwidth tax" (Mani, Mullainathan, Shafir and Zhao 2013). Compulsory tax accounting is exactly such a bandwidth tax levied on every firm and household; ending compulsory tax accounting releases human intelligence from compliance toward invention, design, and production. Internal management accounting may continue wherever firms find management accounting privately useful; what disappears is the compulsory layer.
RECOMMENDATION: ENTRENCH BEFORE MANDATING
The sequence is the recommendation. A government which mandates a national digital payment system first and promises restraint second builds the fear machine before asking for trust, and finding one predicts weak adoption exactly as observed in the mandated-first cases. Our paper recommends the reverse order: first entrench Fiscal Secularity in constitutional law, then issue the payment instrument, then collect the flat automated tax. Entrenchment should operate at the tier of basic rights, using the established toolbox: an unamendable core on the German model for the six safeguards and the rate cap, or supermajority plus referendum requirements where an unamendable core does not fit the national tradition, with the basic structure doctrine showing how courts can guard a protected core even without explicit text. The reason for constitutional-grade protection is historical: exceptions expand, from terrorism to money laundering to tax to speech-adjacent offenses, and the design goal is to make each expansion structurally expensive rather than dependent on official goodwill. One honest caveat accompanies the recommendation: comparative scholarship warns entrenchment taken to the point of unamendability can undermine the very commitments entrenchment protects, so our paper reserves the unamendable tier for the narrow core only: the seal, the log, the evidence rule, the judicial gate, and the rate cap.
CONCLUSION
Money is stored life energy, and a person who fears for their stored life energy censors present life. The separation of money and governance stands to economic life as the separation of religion and governance stands to belief: the state keeps the lawful revenue, and loses the instrument of intimidation. A century-old family of automated tax proposals failed while total payment surveillance remained unaddressed; five working institutions, from the Estonian access log to the exclusionary rule to the eternity clause, supply every missing part. Bundled as Fiscal Secularity, the parts turn a feared payment database into trusted public infrastructure, and turn taxation from an annual bureaucratic siege into an invisible, constant, capped flow. Our paper recommends one order of operations for every government now designing digital money: entrench first, issue second, collect third.