Alice and Bob live in a flat together. Bob mentions to Alice, that he is buying and reselling merchandise but not reporting it to the tax office, because he does not want to register a business.
One day, Bob leaves the flat but leaves his computer turned on and the door to his room open. Alice looks at the monitor, sees the evidence for tax fraud in the online selling/buying history and decides to take pictures of it to report it to the authorities.
Is Alice within legal boundaries?
Don't do it.
So clearly tax fraud is bad and the state can prosecute this when tipped off. Alice is also clearly allowed to report the possible tax fraud to authorities and to serve as a witness if necessary.
The problem is that Alice can expose herself to various liabilities, and could be sued by Bob or by the state.
On what grounds did Alice snoop around in Bob's room? Even if they are roommates, Alice might not have a right to enter the room. Even if she has grounds to enter the room, she might not have permission to trawl through Bob's private stuff. A glance at a computer screen is also quite unlikely to show evidence of tax fraud, as even selling lots of stuff does not imply running a business.1
On what grounds can Alice collect and share personal data with authorities? There is no constitutional right for snooping and snitching.2 Alice must instead identify a legal basis for sharing such screenshots or pictures with third parties. Data protection law such as the GDPR does recognize that there might be a legitimate interest, but Alice is unlikely to have such a legitimate interest unless she is personally affected by Bob breaking the law. For example, some people have been sued for overly enthusiastic reports of parking violations.
Footnotes:
People can sell goods e.g. on eBay without running a business that would have to be registered with the tax office. A business in this context is any regular business-like for-profit activity. Thus, a registration might not be necessary for occasional activity, or if the activity isn't for profit.
For example, a person selling their old stuff for less than they bought it for is not acting with a profit motive. Even if there is occasional profit, this can be a privates Veräußerungsgeschäft (private sale). Whether such a sale is taxable depends on the duration between acquisition and sale. If it is taxable, it has to be reported as part of income tax filings. Generally, the profit is free from income tax after one year.
VAT is a different matter. Private sales don't involve VAT. When a sole proprietor registers a business, they can elect to ignore VAT until they reach certain turnover or profit limits (Kleinunternehmerregelung).
This kind of tax fraud is typically not a crime, and more of an administrative offence. Thus, intrusive investigations are not proportional – and even then, they would be up to the state, not to individuals. It is worth noting that Germany has extremely poor whistleblower protections and has failed to implement relevant EU laws.
Taking a photo of Bob’s room from the corridor is completely legal. Since it is her photograph she can share it with whoever she wants, even the tax authorities.
Even if Alice was outside the law (e.g. by trespassing), Bob can only sue her for the damage she causes. Being charged with tax evasion and fined/jailed is not “damage” caused by Alice. The overriding public interest in detecting and punishing crime means that no one has standing to sue someone who reports them to the authorities even if the activities of that person were not, strictly speaking, legal.
The GDPR does not apply to Alice because her processing is for a “purely personal or household activity and thus with no connection to a professional or commercial activity.”
In any event, a person can report a crime that they suspect without any evidence - it’s the role of the authorities to collect evidence.
A screenshot is not hard-copy evidence. Authorities can be ripped but the screenshot would have to be an official transcript provided by the owner of the information (a subscriber's account provider).
