Abstract;Judgment — ECLI:EU:C:2024:830
Date: 2024-10-04
Language of the case: German
Court formation: Grand Chamber
Subject matter: Telecommunications;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Austria

Summary C-548/21 – 1 
Case C-548/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
6 September 2021 
Referring court: 
Landesverwaltungsgericht Tirol (Austria) 
Date of the decision to refer: 
1 September 2021 
Complainant: 
C.G. 
Respondent authority: 
Bezirkshauptmannschaft Landeck 
  
Subject matter of the main proceedings 
Complaint concerning the seizure of a mobile telephone and the subsequent 
attempt by the police to extract data from it 
Subject matter and legal basis of the request 
Interpretation of EU law; Article 267 TFEU 
Questions referred for a preliminary ruling 
1) Is Article 15(1) (possibly read in combination with Article 5) of Directive 
2002/58/EC, as amended by Directive 2009/136/EC, read in the light of Articles 7 
and 8 of the Charter of Fundamental Rights, to be interpreted as meaning that 
public authorities’ access to data stored on mobile telephones entails interference 
with fundamental rights enshrined in those articles of the Charter which is 
sufficiently serious to entail that access being limited, in areas of prevention, 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-548/21 
 
2  
investigation, detection and prosecution of criminal offences, to the objective of 
fighting serious crime? 
2) Is Article 15(1) of Directive 2002/58/EC, as amended by Directive 
2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter 
of Fundamental Rights, to be interpreted as meaning that it precludes a national 
rule, such as that enacted in Paragraph 18 of the Strafprozessordnung (Austrian 
Code of Criminal Procedure), read in combination with Paragraph 99(1) thereof, 
which allows security authorities to grant themselves full and uncontrolled access 
to all digital data stored on a mobile telephone in the course of a criminal 
investigation without the authorisation of a court or independent administrative 
body? 
3) Is Article 47 of the Charter of Fundamental Rights, possibly read in 
combination with Articles 41 and 52 thereof, to be interpreted, from the point of 
view of equality of arms and from the point of view of an effective remedy, as 
meaning that it precludes a national rule, such as that enacted in Paragraph 18 of 
the Code of Criminal Procedure, read in combination with Paragraph 99(1) 
thereof, which allows data processing of a mobile telephone without advising the 
data subject before or, at the very least, after the measure is taken? 
Provisions of European Union law relied on 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy in 
the electronic communications sector, as amended by Directive 2009/136/EC, in 
particular Articles 5 and 15 
Charter of Fundamental Rights of the European Union, in particular Articles 7, 8, 
15, 41, 47 and 52 
Provisions of national law relied on 
Strafprozessordnung 1975 (Austrian Code of Criminal Procedure 1975, ‘the 
StPO’), in the version in force at the material time (Federal Law Gazette I, 
24/2020), in particular Paragraphs 17, 18, 91, 99, 109 to 111 and 113 
Bundesgesetz über Suchtgifte, psychotrope Stoffe und Drogenausgangsstoffe 
(Austrian Law on Narcotics, Psychotropic Substances and Drug Precursors, ‘the 
SMG’), in the version in force at the material time (Federal Law Gazette I, 
23/2016), in particular Paragraph 27 
Succinct presentation of the facts and procedure in the main proceedings 
The complainant is a German national. He works for an Austrian undertaking and 
lives in St. Anton am Arlberg. 
BEZIRKSHAUPTMANNSCHAFT LANDECK 
 
3 
On 23 February 2021, a package addressed to the complainant was seized by 
officers of Innsbruck customs office during a narcotics check. It contained 85 
grammes of herbal cannabis. 
On 6 March 2021, two police officers from St. Anton am Arlberg Police 
Department questioned the complainant about the consignor of the package of 
drugs and searched his home. 
The complainant was asked to provide access to the traffic data on his mobile 
telephone. He expressly refused to do so and he also refused to disclose his PIN. 
The mobile telephone was seized. 
The measures taken were not covered by a public prosecutor’s or court order. 
Officers at district police headquarters in Landeck were unable to unlock the 
mobile phone. It was therefore sent to the Bundeskriminalamt (Criminal Police 
Office) in Vienna, where another attempt was made to unlock the telephone and 
extract the data stored on it. 
By pleadings dated 31 March 2021, the complainant lodged a complaint 
concerning the seizure. 
The mobile telephone was returned to the complainant on 20 April 2021. 
The complainant was not advised at any time that attempts had been made to 
extract or process data stored on the mobile telephone; that fact only came to light 
when the police officer who had seized and subsequently initiated data processing 
of the mobile telephone was questioned under oath. Nor was the attempt to 
process the telephone documented in the file compiled by the criminal 
investigation department. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
Paragraph 110(2) of the StPO states that although, as a rule, seizure must be 
ordered by the public prosecutor’s office and carried out by the police, it may also 
be carried out by police officers acting on their own initiative where 
Paragraph 110(3) of the StPO applies. 
The attempted processing of the mobile telephone seized by the police, in the 
absence of a public prosecutor’s or court order, is allowed by law in the present 
case. 
The Austrian Code of Criminal Procedure lays down clear rules concerning when 
and by whom items may be seized, the generation of a back-up copy of 
information stored on data carriers and the safekeeping of seized property. 
However, the processing of seized items, including of information stored on data 
carriers, is not regulated conclusively. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-548/21 
 
4  
a) The first question referred: 
Although the case-law of the Court of Justice of the European Union to date 
primarily concerns access by public authorities to personal data retained by 
providers of communications services (traffic data and location data), the referring 
court considers that comparisons can be drawn between the legal questions at 
issue in these proceedings and those addressed by that case-law. 
By its judgment of 2 October 2018, Ministerio Fiscal, C-207/16, paragraph 52 et 
seq., the Court dealt with the question of the need for special protection for 
communications data (albeit, in this case, in the form of traffic and location data) 
and answered the question as to the factors that should be taken into consideration 
in order to assess whether the offences in respect of which the police may be 
authorised, for the purposes of an investigation, to have access to personal data 
(retained by providers of electronic communications services) are sufficiently 
serious to warrant the interference entailed by such access with the fundamental 
rights enshrined in Articles 7 and 8 of the Charter, as interpreted by the Court in 
its judgments of 8 April 2014, Digital Rights Ireland and Others C-293/12 and 
C-594/12, and of 21 December 2016, Tele2 Sverige and Watson and Others, 
C-203/15 and C-698/15. 
In that regard, the Court has held that, in areas of prevention, investigation, 
detection and prosecution of criminal offences, only the objective of fighting 
serious crime is capable of justifying public authorities’ access to personal data 
retained by providers of electronic communications services which, taken as a 
whole, allow precise conclusions to be drawn concerning the private lives of the 
persons whose data is concerned (paragraph 54). 
However, the Court explained its interpretation by reference to the fact that the 
objective pursued by legislation governing that access must be proportionate to 
the seriousness of the interference with the fundamental rights in question that that 
access entails (paragraph 55) as, in accordance with the principle of 
proportionality, serious interference can be justified, in areas of prevention, 
investigation, detection and prosecution of criminal offences, only by the 
objective of fighting crime which must also be defined as ‘serious’ 
(paragraph 56). 
By contrast, when the interference that such access entails is not serious, that 
access is capable of being justified by the objective of preventing, investigating, 
detecting and prosecuting ‘criminal offences’ generally (paragraph 57). Therefore, 
it is necessary to start by examining whether, in the light of the facts of the present 
case, the interference with fundamental rights enshrined in Articles 7 and 8 of the 
Charter that police access to the data at issue in the main proceedings entails is to 
be regarded as ‘serious’ (paragraph 58). 
The Court then found that the processing of personal data retained by providers of 
electronic communications services, the sole purpose of which is to identify the 
BEZIRKSHAUPTMANNSCHAFT LANDECK 
 
5 
owners of SIM cards activated over a period of 12 days with the IMEI code of a 
stolen mobile telephone and which is confined to access to the telephone numbers 
corresponding to those SIM cards and to the data relating to the identity of the 
owners of those cards, such as their surnames, forenames and, if need be, 
addresses, cannot be defined as ‘serious’ interference with the fundamental rights 
of the persons concerned (paragraph 61). 
However, that classification as ‘non-serious’ interference was based on the 
assumption that those data do not make it possible to ascertain the date, time, 
duration and recipients of the communications made with the SIM card or cards in 
question, nor the locations where those communications took place or the 
frequency of those communications with specific people during a given period. 
Those data do not therefore allow precise conclusions to be drawn concerning the 
private lives of the persons whose data is concerned (paragraph 60). 
In the present case, however, processing of the mobile telephone entails fully 
uncontrolled access to all the data subject’s digital communications. The 
information obtained thus makes it possible to reconstruct a detailed and in-depth 
picture of almost all areas of his private life (communications data allow almost 
all contacts to be reconstructed in terms of the frequency, time and duration of 
communications, as well as of the content of communications via text messages 
and other messenger services, and processing of photographs and browser history 
gives a very close insight into the data subject’s private life). 
Furthermore, it has to be noted that the offence of which the complainant stands 
accused in the criminal investigation, which is provided for in Paragraph 27(1) of 
the SMG, carries a penalty of up to 1 year’s imprisonment although, according to 
the subdivision in Paragraph 17 of the Strafgesetzbuch (Austrian Criminal Code, 
‘the StGB’), it qualifies simply as a misdemeanour. 
b) The second question referred: 
As the Court (Grand Chamber) ruled in its judgment of 2 March 2021 in Case 
C-746/18, it is for national law to determine the conditions under which providers 
of electronic communications services must grant the competent national 
authorities access to the data in their possession. However, in order to satisfy the 
requirement of proportionality, such legislation must lay down clear and precise 
rules governing the scope and application of the measure in question and imposing 
minimum safeguards, so that the persons whose personal data are affected have 
sufficient guarantees that data will be effectively protected against the risk of 
abuse. That legislation must be legally binding under domestic law and must 
indicate in what circumstances and under which conditions a measure providing 
for the processing of such data may be adopted, thereby ensuring that the 
interference is limited to what is strictly necessary (paragraph 48). 
In particular, national legislation governing the access of the competent authorities 
to retained traffic and location data, adopted pursuant to Article 15(1) of Directive 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-548/21 
 
6  
2002/58, cannot be limited to requiring that the authorities’ access to the data be 
consistent with the objective pursued by that legislation, but must also lay down 
the substantive and procedural conditions governing that use (paragraph 49). 
Accordingly, and since general access to all retained data, regardless of whether 
there is any, at least indirect, link with the intended purpose, cannot be regarded as 
being limited to what is strictly necessary, the national legislation concerned must 
be based on objective criteria in order to define the circumstances and conditions 
under which the competent national authorities are to be granted access to the data 
in question. In that regard, such access can, as a general rule, be granted, in 
relation to the objective of fighting crime, only to the data of individuals suspected 
of planning, committing or having committed a serious crime or of being 
implicated in one way or another in such a crime. However, in particular 
situations, where for example vital national security, defence or public security 
interests are threatened by terrorist activities, access to the data of other persons 
might also be granted where there is objective evidence from which it can be 
deduced that that data might, in a specific case, make an effective contribution to 
combating such activities (paragraph 50). 
In order to ensure, in practice, that those conditions are fully observed, it is 
essential that access of the competent national authorities to retained data be 
subject to a prior review carried out either by a court or by an independent 
administrative body, and that the decision of that court or body be made following 
a reasoned request by those authorities submitted, inter alia, within the framework 
of procedures for the prevention, detection or prosecution of crime. In cases of 
duly justified urgency, the review must take place within a short time 
(paragraph 51). 
As the Advocate General has observed, in essence, in point 105 of his Opinion in 
case C-746/18, one of the requirements for that prior review is that the court or 
body entrusted with carrying it out must have all the powers and provide all the 
guarantees necessary in order to reconcile the various interests and rights at issue. 
As regards a criminal investigation in particular, it is a requirement of such a 
review that that court or body must be able to strike a fair balance between, on the 
one hand, the interests relating to the needs of the investigation in the context of 
combating crime and, on the other, the fundamental rights to privacy and 
protection of personal data of the persons whose data are concerned by the access 
(paragraph 52). 
Where that review is carried out not by a court but by an independent 
administrative body, that body must have a status enabling it to act objectively and 
impartially when carrying out its duties and must, for that purpose, be free from 
any external influence (paragraph 53). 
It follows from the foregoing considerations that the requirement of independence 
that has to be satisfied by the authority entrusted with carrying out the prior 
review referred to in paragraph 51 of the judgment in Case C-746/18 means that 
BEZIRKSHAUPTMANNSCHAFT LANDECK 
 
7 
that authority must be a third party in relation to the authority which requests 
access to the data, in order that the former is able to carry out the review 
objectively and impartially and free from any external influence. In particular, in 
the criminal field, as the Advocate General has observed, in essence, in point 126 
of his Opinion, the requirement of independence entails that the authority 
entrusted with the prior review, first, must not be involved in the conduct of the 
criminal investigation in question and, second, has a neutral stance vis-à-vis the 
parties to the criminal proceedings (paragraph 54). 
That case-law of the Court, applied to traffic and location data, raises the 
following question with regard to personal data stored on a mobile telephone: 
c) The third question referred: 
For the purpose of measures taken by criminal investigation officers, the StPO 
does not require the authorities to document the digital processing of a mobile 
telephone in writing, or to issue confirmation of the official act, or to otherwise 
give the person concerned the opportunity, such as by inspecting the files, to learn 
that his or her mobile phone was subjected to data processing. That lack of 
notification deprives parties (data subjects) of their most important rights in the 
proceedings. Thus, no preventive remedy exists against any intended processing. 
Nor, however, is the data subject given the opportunity to seek any form of 
judicial protection for verification purposes. 
During the course of the legal proceedings pending in this case, the defendant 
authority, the Bezirkshauptmannschaft Landeck (Landeck District 
Administration), was ordered by procedural order of 1 April 2021 to submit the 
entire file and all related documentation to the Landesverwaltungsgericht Tirol 
(Regional Administrative Court, Tirol). Although the Landeck District 
Administration complied with that order, the (attempted) digital processing of the 
complainant’s mobile telephone was never documented. The complainant, and the 
adjudicating court, ultimately only obtained knowledge of that fact from the 
testimony given by a police officer examined under oath at the hearing in open 
court before the Regional Administrative Court. 
That gives rise to serious concerns as regards Paragraph 18 of the StPO, read in 
combination with Paragraph 99(1) thereof, including (and in particular) from the 
point of view of the guarantee of a fair trial supported by the principle of equality 
of arms within the meaning of Article 47 of the Charter. As the official act was 
neither logged nor otherwise documented, there are no established facts on which 
the data subject can base a legal remedy. However, that would appear to be at 
odds with the principle of equality of arms. 
Furthermore, Article 52(1) of the Charter states that any limitation on the exercise 
of the rights and freedoms recognised by this Charter must be provided for by law 
and respect the essence of those rights and freedoms. Subject to the principle of 
proportionality, limitations may be made only if they are necessary and genuinely 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-548/21 
 
8  
meet objectives of general interest recognised by the Union or the need to protect 
the rights and freedoms of others. According to the case-law of the Court, it is for 
the national courts to carry out a global assessment of the circumstances in which 
restrictive legislation was adopted and implemented on the basis of the evidence 
provided by the competent authorities of the Member State, seeking to 
demonstrate the existence of objectives capable of justifying a restriction of a 
fundamental freedom guaranteed by the Treaty on the Functioning of the 
European Union and its proportionality (judgments of 28 February 2018, Sporting 
Odds Ltd, C-3/17, paragraph 53, citing judgment of 14 June 2017, Online Games 
and Others, C-685/15, paragraph 65). 
The questionable nature of that approach arises by reference to the settled case-
law of the Court, according to which the requirements flowing from the protection 
of general principles recognised in the Community legal order, including the 
principle of the protection of legitimate expectations, are also binding on Member 
States when they implement Community rules, and that consequently they are 
bound, as far as possible, to apply the rules in accordance with those requirements. 
(see judgments of 27 June 2006, C-540/03; of 24 March 1994, Bostock, C-2/92, 
paragraph 16, and of 18 May 2000, Rombi and Arkopharma, C-107/97, 
paragraph 65; see also, to that effect, the judgment in ERT, paragraph 43). 
According to Article 47 of the Charter, entitled ‘Right to an effective remedy and 
to a fair trial’, everyone whose rights and freedoms guaranteed by the law of the 
Union are violated has the right to an effective remedy before a tribunal. The 
obligation imposed on the Member States in the second subparagraph of 
Article 19(1) TEU, to provide remedies sufficient to ensure effective legal 
protection in the fields covered by Union law, corresponds to that right (judgment 
of 16 May 2017, Berlioz Investment Fund, C-682/15, paragraph 44). 
A limitation on that may be justified, in accordance with Article 52(1) of the 
Charter, but only to the extent that it is provided for by law, it respects the essence 
of that law, it is necessary, subject to the principle of proportionality, and it 
genuinely meets objectives of the public interest recognised by the EU or the need 
to protect the rights and freedoms of others (see judgment of 20 September 2017, 
Protect Natur-, Arten- und Landschaftsschutz Umweltorganisation, C-664/15, 
paragraph 90, citing judgment of 27 September 2017, Puškár, paragraphs 61 to 
71).