Opinion of the Advocate General — ECLI:EU:C:2021:940
Date: 2021-11-18
Language of the case: French
Subject matter: Right of establishment;Approximation of laws
Procedure: Reference for a preliminary ruling
Origin: France

Summary C-397/20 – 1 
Case C-397/20 
Summary of the request for a preliminary ruling under Article 98(1) of the 
Rules of Procedure of the Court of Justice 
Date lodged:  
20 August 2020 
Referring court:  
Cour de cassation (France) 
Date of the decision to refer:  
1 April 2020 
Appellant:  
SR 
  
I. Subject matter of the main proceedings 
1 The case in the main proceedings concerns an application for a declaration of 
invalidity of procedural acts performed in the course of a judicial investigation 
into charges of insider dealing. The appellant challenges, in particular, the use of 
connection data which was made under national provisions that he regards as 
contrary to EU law (Directive 2002/58/EC), the Charter of Fundamental Rights 
and the European Convention on Human Rights. 
II. Subject and legal basis of the request for a preliminary ruling 
2 The Cour de cassation (Court of Cassation) considers that, in order to be in a 
position to give a ruling in the main proceedings, it must, under Article 267 
TFEU, refer to the Court of Justice of the European Union questions relating to 
the interpretation of provisions of EU law on market abuse, to the way in which 
those provisions can be reconciled with requirements concerning the protection of 
personal data and, as the case may be, to the possibility of temporarily 
maintaining the effects of national legislation intended to combat such abuse, if 
that legislation is held to be contrary to EU law. 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-397/20 
 
2  
III. Questions referred for a preliminary ruling 
‘1) Do Article 12(2)(a) and (d) of Directive 2003/6/EC of the European 
Parliament and of the Council of 28 January 2003 on insider dealing and market 
manipulation and Article 23(2)(g) and (h) of Regulation (EU) No 596/2014 of the 
Parliament and of the Council of 16 April 2014 on market abuse, which replaced 
the that directive from 3 July 2016, read in the light of recital 65 of that regulation, 
not imply that, account being taken of the covert nature of the information 
exchanged and the fact that the potential subjects of investigation are members of 
the general public, the national legislature must be able to require electronic 
communications operators to retain connection data on a temporary but general 
basis in order to enable the administrative authority referred to in Article 11 of the 
directive and Article 22 of the regulation, in the event of the emergence of 
grounds for suspecting certain persons of being involved in insider dealing or 
market manipulation, to require the operator to surrender existing records of 
traffic data in cases where there are grounds to suspect that the records so linked 
to the subject matter of the investigation may prove relevant to the production of 
evidence of the actual commission of the breach, to the extent, in particular, that 
they offer a means of tracing the contacts established by the persons concerned 
before the suspicions emerged? 
2) If the answer given by the Court of Justice is such as to prompt the Court of 
Cassation to form the view that the French legislation on the retention of 
connection data is not consistent with EU law, could the effects of that legislation 
be temporarily maintained in order to avoid legal uncertainty and to enable data 
previously collected and retained to be used for one of the objectives pursued by 
that legislation? 
3) May a national court temporarily maintain the effects of legislation enabling 
the officials of an independent administrative authority responsible for 
investigating market abuse to obtain connection data without prior review by a 
court or another independent administrative authority?’ 
IV Legal framework 
1. Provisions of EU law 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy 
in the electronic communications sector (Directive on privacy and electronic 
communications) 
Article 15 [This provision is invoked, but its content is not cited in the request for 
a preliminary ruling] 
SR 
 
3 
Directive 2003/6/EC of the European Parliament and of the Council of 
28 January 2003 on insider dealing and market manipulation (market abuse) 
Article 12(2)(a) and (d) 
‘… 
2. Without prejudice to Article 6(7), the powers referred to in paragraph 1 of this 
Article shall be exercised in conformity with national law and shall include at 
least the right to:  
(a) have access to any document in any form whatsoever, and to receive a copy 
of it;  
… 
(d) require existing telephone and existing data traffic records; 
…’ 
Regulation (EU) No 596/2014 of the European Parliament and of the Council 
of 16 April 2014 on market abuse (market abuse regulation) and repealing 
Directive 2003/6/EC of the European Parliament and of the Council and 
Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC  
Article 23(2)(g) and (h) 
‘In order to fulfil their duties under this Regulation, competent authorities shall 
have, in accordance with national law, at least the following supervisory and 
investigatory powers: 
…  
(g) to require existing recordings of telephone conversations, electronic 
communications or data traffic records held by investment firms, credit 
institutions or financial institutions; 
(h) to require, in so far as permitted by national law, existing data traffic records 
held by a telecommunications operator, where there is a reasonable 
suspicion of an infringement and where such records may be relevant to the 
investigation of an infringement of point (a) or (b) of Article 14 or 
Article 15; 
…’ 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-397/20 
 
4  
2. National provisions 
Code monétaire et financier (Monetary and Financial Code) 
Article L-621-10, first paragraph 
‘Investigators and controllers may, for the purposes of the investigation or control, 
require communication of any documents, irrespective of the medium used. 
Investigators may also require communication, and obtain copies, of the data 
retained and processed by telecommunications operators within the framework of 
Article L. 34-1 of the Code des Postes et Télécommunications [(Postal and 
Electronic Communications Code)] and the service providers referred to in 
Article 6 I (1) and (2) of the loi n° 2004-575 du 21 juin 2004 pour la confiance 
dans l’économie numérique [(Law No 2004-575 of 21 June 2004 on confidence in 
the digital economy)].’ 
Postal and Electronic Communications Code 
Article L.34-1 
‘… 
II. Electronic communications operators … shall erase or make anonymous any 
traffic data, subject to the provisions of paragraph III …. 
… 
III. For the purposes of investigating, establishing and prosecuting criminal 
offences … the procedures to erase or make anonymous certain categories of 
technical data may be postponed for a maximum period of one year. …’ 
Article R.10-13 
‘Pursuant to Article L. 34-1 III, electronic communications operators shall retain 
for the purposes of investigating, establishing and prosecuting criminal offences: 
(a) Information enabling the identification of the user; 
(b) Data relating to the telecommunication terminal equipment used; 
(c) The technical characteristics, date, time and duration of each 
communication; 
(d) Data relating to any additional services requested or used and the providers 
thereof; 
(e) Data enabling the identification of the recipient(s) of the communication.’  
SR 
 
5 
The Court of Cassation points out that the foregoing connection data are those 
data generated or processed as a result of a communication and relating to the 
circumstances of that communication and to the users of the service, to the 
exclusion of any indication of the content of the messages. 
V. Summary of the facts and the main proceedings 
3 On 22 May 2014, a judicial investigation was opened in respect of acts 
constituting the offence of insider dealing and concealment. 
4 Further to a report issued on 23 and 25 September 2015 by the Secretary General 
of the Autorité des marchés financiers (Financial Markets Authority; ‘the AMF’) 
and the communication of documents from an investigation by that independent 
public authority (including, inter alia, personal data relating to the use of 
telephone lines), that investigation was extended to securities in CGG, Airgas and 
Air Liquide or to any other related financial instruments that might be linked to 
them, in connection with the same offences as well as those of aiding and abetting, 
corruption and money laundering. 
5 AMF officials relied on Article L. 621-10 of the Monetary and Financial Code as 
the basis for collecting data relating to the abovementioned use of telephone lines. 
6 On 29 May 2017, the appellant was placed under judicial investigation for insider 
dealing in connection with acts relating to Airgas securities and related financial 
instruments; on 28 November 2017, he lodged an application for a declaration of 
invalidity of certain procedural acts. 
7 The chambre de l’instruction de la cour d’appel de Paris (Indictment Division of 
the Court of Appeal, Paris) ruled on that application in a judgment of 7 March 
2019. 
8 The appellant appealed on a point of law against that judgment. 
9 The first, third and fourth of his four pleas were rejected in the judgment making 
the reference and are irrelevant for the purposes of the present request for a 
preliminary ruling. 
10 His second plea alleges infringement of Articles 6 and 8 of the European 
Convention on Human Rights (ECHR), Article 15 of Directive 2002/58, 
Articles 7, 8, 11 and 52 of the Charter of Fundamental Rights of the European 
Union, Articles L. 34-1 and R.10-13 of the Postal and Electronic Communications 
Code, Article L. 621-10 of the Monetary and Financial Code as amended by the 
loi n° 2013-672 du 26 juillet 2013 (Law No 2013-672 of 26 July 2013), 
Articles 591 and 593 of the code de procédure pénale (Code of Criminal 
Procedure) as well as the principle of the primacy of EU law and the principle that 
evidence must be obtained fairly. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-397/20 
 
6  
VI. Main arguments of the appellant in the main proceedings 
11 The appellant criticises the judgment under appeal in that it rejected the plea 
alleging that Article 34-1 of the Postal and Electronic Communications Code and 
Article L. 621-10 of the Monetary and Financial Code are not consistent with 
Directive 2002/58 and Article 8 of the ECHR. 
12 The appellant argues that the Court of Justice ruled, in its judgment of 2 October 
2018, Ministerio Fiscal (C-207/16, EU:C:2018:788, paragraph 35), that 
‘Article 15(1), read in conjunction with Article 3 of Directive 2002/58, must be 
interpreted as meaning that the scope of the directive extends not only to a 
legislative measure that requires providers of electronic communications services 
to retain traffic and location data, but also to a legislative measure relating to the 
access of the national authorities to the data retained by those providers’. 
13 In its judgment of 21 December 2016, Tele2 Sverige and Watson and Others 
C-203/15 and C-698/15, EU:C:2016:970), the Court of Justice ruled that 
Article 15(1) of Directive 2002/58 ‘necessarily presupposes that the national 
measures referred to therein, such as those relating to the retention of data for the 
purpose of combating crime, fall within the scope of that directive’ 
(paragraph 73). By holding that the contested national provisions fall outside the 
scope of Directive 2002/58, on the ground ‘that … the CJEU appears to remove 
their scope from the provisions of Article 1(3) of the directive’, the Indictment 
Division misconstrued the Court of Justice’s interpretation of that directive. 
14 In the same judgment of 21 December 2016, Tele2 Sverige and Watson and 
Others, the Court of Justice ruled that Article 15(1) of Directive 2002/58 
‘preclud[es] national legislation which, for the purpose of fighting crime, provides 
for the general and indiscriminate retention of all traffic and location data of all 
subscribers and registered users relating to all means of electronic 
communication’ [paragraph 112]. It follows that national legislation must ‘lay 
down clear and precise rules governing the scope and application of such a data 
retention measure and imposing minimum safeguards’ and must ‘in particular, 
indicate in what circumstances and under which conditions a data retention 
measure may, as a preventive measure, be adopted, thereby ensuring that such a 
measure is limited to what is strictly necessary’ [paragraph 109]. The retention of 
data must also satisfy ‘objective criteria, that establish a connection between the 
data to be retained and the objective pursued’, and substantive conditions which 
are ‘such as actually to circumscribe, in practice, the extent of that measure and, 
thus, the public affected’ [paragraph 110]. Consequently, by refusing to declare 
null and void the telephone data of the appellant which was collected by the AMF 
on the basis of Article L. 34-1 and Article R. 10-13 of the Post and 
Telecommunications Code, the Indictment Division infringed the abovementioned 
legislative provision, since those articles provide for the general and 
indiscriminate retention of data, which constitutes a serious interference with the 
right to privacy, and do not provide for any safeguard to restrict the data retention 
measure to persons or data which are actually connected with serious crime. 
SR 
 
7 
15 Again in its judgment of 21 December 2016, Tele2 Sverige and Watson and 
Others C-203/15 and C-698/15, EU:C:2016:970), the Court of Justice ruled that 
‘since the legislative measures referred to in Article 15(1) of Directive 2002/58 
must … “be subject to adequate safeguards”, a data retention measure must … lay 
down clear and precise rules indicating in what circumstances and under which 
conditions the providers of electronic communications services must grant the 
competent national authorities access to the data’ [paragraph 117]. Consequently, 
the Indictment Division infringed Article 15(1) of Directive 2002/58, by refusing 
to declare null and void the telephone data of the appellant transmitted by 
telephone operators to AMF investigators on the basis of the second sentence of 
Article L. 621-10 of the Monetary and Financial Code, since those national 
provisions place no restrictions on the right of those investigators to receive data 
retained and processed by telecommunications operators and do not provide for 
any ‘safeguards appropriate to ensure a balanced reconciliation between the right 
to privacy, on the one hand, and the prevention of breaches of public order and the 
identification of criminals’, on the other, as was pointed out by the Conseil 
constitutionnel (Constitutional Council), which held that those provisions were 
unconstitutional (Décision n° 2017-646/647, question prioritaire de 
constitutionnalité du 21 juillet 2017 (Decision No 2017-646/647, priority question 
on constitutionality of 21 July 2017)). 
16 The appellant submits that any interference by a public authority with the exercise 
of the right to privacy must be necessary and proportionate. The Indictment 
Division could not, without infringing Article 8 of the European Convention on 
Human Rights, refuse to declare the appellant’s telephone data null and void, 
since those data had been retained by telephone operators and then transmitted to 
AMF investigators on the basis of national legislation which did not provide for 
adequate safeguards to limit abuse. 
VII. Reasons for the reference for a preliminary ruling 
17 In rejecting the plea as to the incompatibility of Article L. 621-10 of the Monetary 
and Financial Code and Article L. 34-1 of the Postal and Electronic 
Communications Code with the requirements of Directive 2002/58 read in the 
light of the case-law of the Court of Justice, the judges of the Indictment Division, 
after recalling the circumstances in which the personal data were collected, note 
that Article L. 621-10 of the Monetary and Financial Code, which confers the 
power to procure connection data on those officials of an administrative authority 
who are so authorised and bound by professional secrecy, does not appear to be 
contrary to Article 15(1) of Directive 2002/58. 
18 The judges of the Indictment Division find that the same is true of the provisions 
of Article L.34-1 of the Postal and Electronic Communications Code owing to the 
restrictions imposed by Article R. 10-3 I as regards both the data to be retained by 
operators and the duration of their retention. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-397/20 
 
8  
19 Those judges point out that Article 23(1)(h) of Regulation No 596/2014 on market 
abuse allows the competent authorities to require, in so far as permitted by 
national law, existing data traffic records held by a telecommunications operator, 
where there is a reasonable suspicion of an infringement and where such records 
may be relevant to the investigation of an infringement either of point (a) or (b) of 
Article 14, concerning the prohibition on engaging or attempting to engage in 
insider dealing and on urging or inciting a third party to engage in insider dealing, 
or of Article 15, concerning the prohibition of market manipulation. 
20 Those judges infer from the foregoing that no invalidity can arise from the 
application of provisions which comply with a European regulation, that is to say 
an EU legal act of general application which is binding in all of its provisions and 
is directly applicable erga omnes in the legal order of the Member States. 
21 In support of his claim that the judgment under appeal should be set aside, the 
appellant submits, in essence, the fact that the data were collected on the basis of 
the abovementioned provisions, which provide for the general and indiscriminate 
retention of data, was in breach of Directive 2002/58/EC, as interpreted by the 
Court of Justice, and that the provisions of Article L. 621-10 of the Monetary and 
Financial Code, in the version resulting from the Law of 26 July 2013, impose no 
limits on the right of AMF investigators to procure retained data. 
22 On that point, the Advocate General [to the Court of Cassation] concludes that it 
is necessary to put two questions to the Court of Justice, the first concerning the 
compatibility of the conditions governing the retention of personal connection 
data by private operators, the second concerning the conditions under which the 
AMF may access those data under Article L. 621-10, cited above, in the version 
applicable at that time, account being taken of the provisions of Regulation 
No 596/2014 on market abuse and of the obligations incumbent on Member States 
under that regulation, which repealed Directive 2003/6/EC of the European 
Parliament and of the Council of 28 January 2003 on insider dealing and market 
manipulation. 
23 In response, according to the appellant, there is no need to refer a question to the 
Court of Justice for a preliminary ruling, since that Court has already given a clear 
ruling on the meaning of Directive 2002/58. 
24 For the purposes of examining this plea, a distinction must be drawn between the 
detailed rules for accessing connection data, on the one hand, and those governing 
the retention of such data, on the other. 
a) Access to the connection data 
25 In its judgment of 21 December 2016, Tele2 Sverige and Watson and Others 
C-203/15 and C-698/15, EU:C:2016:970), the Court of Justice held that 
Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and 
Article 52(1) of the Charter of Fundamental Rights of the European Union, must 
SR 
 
9 
be interpreted as ‘precluding national legislation governing the protection and 
security of traffic and location data … where the objective pursued by that access, 
in the context of fighting crime, is not restricted solely to fighting serious crime, 
where access is not subject to prior review by a court or an independent 
administrative authority, and where there is no requirement that the data 
concerned should be retained within the European Union’ (paragraph 125). 
26 For its part, the Constitutional Council, by decision of 21 July 2017, declared the 
first paragraph of Article L. 621-10 of the Monetary and Financial Code to be 
unconstitutional on the ground that the procedure for access by the AMF, as it 
existed at the material time, was not consistent with the right to respect for private 
life, protected by Article 2 of the Déclaration des droits de l’homme et du citoyen 
(Declaration of the Rights of Man and of the Citizen). However, taking the view 
that the immediate repeal of the contested provisions would have manifestly 
excessive consequences, the Constitutional Council postponed that repeal until 
31 December 2018. Drawing the necessary inferences from that declaration of 
unconstitutionality, the legislature, by the loi n° 2018-898 du 23 octobre 2018 
(Law No 2018-898 of 23 October 2018), introduced a new Article L. 621-10-2, 
which provides that all access to connection data by AMF investigators is to be 
subject to prior authorisation by another independent administrative authority 
known as ‘the access request controller’. 
27 Given that the temporal effects of the decision of the Constitutional Council were 
postponed, the view must be taken that the unconstitutionality of the legislative 
provisions applicable at the material time is not such as to support an inference of 
invalidity. However, even though, according to Article L. 621-1 of the Monetary 
and Financial Code, both in the version applicable at the time of the contested acts 
and in its current version, the AMF is ‘an independent public authority’, the power 
conferred on its investigators to obtain connection data without prior review by a 
court or other independent administrative authority was not consistent with the 
requirements laid down in Articles 7, 8 and 11 of the Charter of Fundamental 
Rights of the European Union, as interpreted by the Court of Justice. 
28 The only question that arises is whether the incompatibility of Article L. 621-10 of 
the Monetary and Financial Code [with EU law] may be postponed. 
b) Retention of connection data 
29 In its judgment of 21 December 2016, Tele2 Sverige and Watson and Others 
C-203/15 and C-698/15, EU:C:2016:970), the Court of Justice held that 
Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and 
Article 52(1) of the Charter of Fundamental Rights of the European Union, must 
be interpreted as ‘precluding national legislation which, for the purpose of 
fighting crime, provides for the general and indiscriminate retention of all traffic 
and location data of all subscribers and registered users relating to all means of 
electronic communication’ (paragraph 112). 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-397/20 
 
10  
30 In the present case, retained data was accessed by the AMF on suspicion of insider 
dealing and market abuses likely to constitute serious criminal offences and on the 
ground that, in the interests of the effectiveness of its investigation, it needed to 
cross-check various items of data retained for a certain period of time in order to 
identify inside information, shared between several interlocutors, revealing the 
existence of unlawful practices in that regard. 
31 Those investigations by the AMF meet the obligations which Directive 2003/6 
imposes on Member States to designate a single administrative authority, the 
powers of which, defined in Article 12(2)(d), include the power to demand 
‘existing telephone and existing data traffic records’. 
32 Regulation No 596/2014 of 16 April 2014 on market abuse, which replaced the 
abovementioned directive with effect from 3 July 2016, establishes the existence, 
as expressed by the definition of its purpose in Article 1 thereof, of ‘a common 
regulatory framework for insider dealing, the unlawful disclosure of inside 
information and market manipulation … as well as measures to prevent market 
abuse to ensure the integrity of financial markets in the Union and to enhance 
investor protection and confidence in those markets’. 
33 It provides, in Article 23(2)(g) and (h) thereof, that the competent authority may 
require existing recordings of telephone conversations, electronic communications 
or data traffic records held by investment firms, credit institutions or financial 
institutions. 
34 The competent authority may also require, in so far as permitted by national law, 
existing data traffic records held by a telecommunications operator, where there is 
a reasonable suspicion of an infringement and where such records may be relevant 
to the investigation of an infringement of point (a) or (b) of Article 14, concerning 
insider dealing and unlawful disclosure of inside information, or Article 15, 
concerning market manipulation. 
35 That text also emphasises (in recital 65) that such connection data constitute 
crucial, and sometimes the only, evidence to detect and prove the existence of 
insider dealing and market manipulation, since they offer means of establishing 
the identity of a person responsible for the dissemination of false or misleading 
information or that persons have been in contact at a certain time, and that a 
relationship exists between two or more people. 
36 Noting that the exercise of such powers may amount to interferences with the 
right to respect for private and family life, home and communications, that 
regulation requires Member States to have in place adequate and effective 
safeguards against any abuse in the form of limits confining those powers 
exclusively to situations in which they are necessary for the proper investigation 
of serious cases where the States have no equivalent means for effectively 
achieving the same result. It follows from this that some of the market abuses 
concerned by that provision are to be regarded as serious offences (recital 66). 
SR 
 
11 
37 In the present case, the inside information likely to form the material element of 
unlawful market practices was essentially verbal and secret. 
38 The question therefore arises as to how Article 15(1) of Directive 2002/58, read in 
the light of Articles 7, 8 and 11 of the Charter of Fundamental Rights of the 
European Union, is to be reconciled with the requirements laid down in the 
abovementioned provisions of Directive 2003/6 and Regulation No 596/2014. 
39 Given that, for the purposes of answering such a question, the existing case-law 
does not appear to shed the necessary light on this unprecedented legal and factual 
framework, it cannot be said that there is no scope for any reasonable doubt as to 
the correct application of EU law. It is therefore necessary to refer a question to 
the Court of Justice for a preliminary ruling. 
40 If the answer given by the Court of Justice is such as to prompt the Court of 
Cassation to form the view that the French legislation on the retention of 
connection data is not consistent with EU law, it seems appropriate to ask whether 
the effects of that legislation could be temporarily maintained in order to avoid 
legal uncertainty and to enable data previously collected and retained to be used 
for one of the objectives pursued by that legislation. 
41 It is therefore necessary to refer to the Court of Justice for a preliminary ruling the 
questions set out above.