Judgment;Abstract — ECLI:EU:C:2023:631
Date: 2023-09-07
Language of the case: Lithuanian
Court formation: First Chamber
Subject matter: Approximation of laws;Telecommunications
Procedure: Reference for a preliminary ruling
Origin: Lithuania

Summary of the Court’s case-law on the application of Directive 2002/58 49. It is apparent from the first sentence of Article 15(1) of Directive 2002/58 that Member States may adopt a measure derogating from the principle of confidentiality enshrined in Article 5(1) of that directive where it is ‘necessary, appropriate and proportionate … within a democratic society’ and is ‘strictly’ proportionate to the intended purpose. (22) 50. In particular, whether Member States may justify a limitation on the rights and obligations laid down in Articles 5, 6 and 9 of Directive 2002/58 must be assessed in the light of the seriousness of the interference entailed by such a limitation and by verifying that the importance of the public interest objective pursued by that limitation is proportionate to that seriousness. (23) 51. ‘In order to satisfy the requirement of proportionality, the national legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data are affected have sufficient guarantees that those data will be effectively protected against the risk of abuse. That legislation must be legally binding under domestic law and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted …’. (24) 52. As regards the public interest objectives that may justify a measure taken pursuant to Article 15(1) of Directive 2002/58, in accordance with the principle of proportionality, there is a hierarchy of objectives based on their respective importance: the importance of the objective pursued by such a measure must be proportionate to the seriousness of the interference. (25) 53. In that hierarchy of objectives, safeguarding national security, read in the light of Article 4(2) TEU, ranks higher than safeguarding the other interests referred to in Article 15(1) of Directive 2002/58, namely defence, public security and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. The objective of combating crime in general, even serious crime, and of safeguarding public security, falls within that second category. (26) 54. It follows from that categorisation of objectives that: – the objective of safeguarding national security, ranked first in the order of precedence indicated by the Court, permits interferences as serious as those entailed by legislative measures allowing for the imposition on providers of electronic communications services of an obligation to retain, generally and indiscriminately, traffic and location data; (27) – the next-ranked objective, namely combating serious crime, may justify interferences such as, for example, the targeted retention of traffic and location data or IP addresses assigned to the source of a connection, for a period that is limited in time to what is strictly necessary. (28) 2. Application of that case-law to the present reference for a preliminary ruling 55. According to the referring court, the data at issue were obtained by means of serious interferences with the rights guaranteed by Articles 7, 8 and 11 of the Charter. (29) 56. The question here, I repeat, is not whether the collection of those data was initially lawful, that is to say, whether the interference was sufficiently justified in the light of the seriousness of the criminal offence targeted. 57. The referring court has taken a view on those two points (seriousness of the interference and seriousness of the offence) in terms which are not disputed in the main proceedings and are therefore not relevant to the reference for a preliminary ruling. 58. What matters at this juncture, according to the referring court, is whether those data: (a) may also be used in subsequent investigations aimed at combating crime in general (assuming that that concept covers the conduct to which the disciplinary measure at issue relates); or (b) may be used only in investigations aimed at combating serious crime. 59. The Czech Government and Ireland have examined whether or not the conduct at issue before the referring court should be classified as a ‘serious offence’ and have concluded that it should. 60. In my view, however, this is a matter on which the Court need not rule because the classification of the conduct is a matter for the referring court. 61. The referring court states that, if the use of data obtained by means of a serious interference with fundamental rights can be justified only in connection with combating serious crime and preventing serious threats to public security, such data cannot be used in investigations into corruption-related disciplinary offences, (30) in other words, in investigations such as the one at issue here. 62. Based on that assessment, what needs to be ascertained is whether disciplinary offences in respect of which action is to be taken using certain personal data must be qualitatively equivalent, as regards their seriousness, to the offences which justified the collection of those data. (31) 63. At the hearing, the Lithuanian Government acknowledged that the public prosecutor had been dismissed for professional misconduct. Whether that misconduct (leaking information about a pre-trial investigation) may be equated with a serious criminal offence or whether it presents a serious risk to the safeguarding of public security depends on a number of factors which only the referring court is in a position to verify. (32) 64. During the hearing, numerous references were made to combating corruption, as the phenomenon underlying conduct such as that at issue here. Any debate on that point would require considerable fine-tuning, in the interests of the exactitude demanded of all expressions of the State’s power to punish. It would be necessary to determine, for instance, whether the term ‘corruption’ is used in a generic sense or whether it refers to a specific type of conduct within which, in the abstract, it would perhaps be unreasonable to include mere breach of the duty of secrecy without a corresponding advantage in favour of the official. (33) 65. In any event, if the referring court were to take the view that the professional misconduct punished in this case is less serious than the criminal offence whose investigation justified the measure taken under Article 15 of Directive 2002/58, the answer to the question referred for a preliminary ruling would be apparent from the following findings of the Court. – ‘… access to traffic and location data retained by providers in accordance with a measure taken under Article 15(1) of Directive 2002/58, which must be given effect in full compliance with the conditions resulting from the case-law interpreting Directive 2002/58, may, in principle, be justified only by the public interest objective for which those providers were ordered to retain those data. It is otherwise only if the importance of the objective pursued by access is greater than that of the objective which justified retention …’. (34) – ‘… in particular … access to such data for the purpose of prosecuting and punishing an ordinary criminal offence may in no event be granted where the retention of such data has been justified by the objective of combating serious crime or, a fortiori, by the objective of safeguarding national security’. (35) 66. Accordingly, in that respect, a kind of principle of equivalence applies between, on the one hand, the public interest objectives justifying the collection of personal data and, on the other, those warranting the subsequent use of those data. The only exception to that principle is, as I have just mentioned, where the importance of the objective pursued by access is greater than that of the objective which justified retention. 67. Any other interpretation would effectively distort the system of safeguards under Directive 2002/58. The rights safeguarded could be seriously interfered with outside of the situations provided for in Article 15 and the conditions determined by the case-law of the Court. 68. In particular, the protection of the right to confidentiality of communications may be legitimately removed only on the basis of the specific public interest objective pursued by such removal. That is why the legitimacy of access to retained data must be assessed on a case-by-case basis, whereby the seriousness of the interference is weighed against the importance of the public interest objective pursued by that interference. 69. What cannot be accepted is an interpretation of Directive 2002/58 according to which the grant of access in a first scenario where such access is properly justified clears the way for subsequent access (in actual fact, reuse of the data obtained) based on a lower-ranking objective than the objective pursued in the first scenario. 70. In that connection, the requirements for initial access (including the requirements established by the Court as regards authorisation of such access) (36) are capable of being applied to the subsequent use of the same data by other authorities. C. In the alternative: effect of Directive 2016/680 71. I have set out above what I consider to be the most appropriate way of answering the request for a preliminary ruling as it is worded, that is to say, by providing the referring court with an interpretation of Directive 2002/58, as sought by it. 72. If the data at issue in this case had been obtained not on the basis of Article 15(1) of Directive 2002/58 but directly by the criminal information services of the Member State in criminal proceedings, the situation would be different. 73. In those circumstances, the provisions of national law would come into play, subject to the application of Directive 2016/680 as regards the processing of personal data obtained in a criminal investigation. I have assumed that the actions of the criminal information services in cases like the present one fall within the scope of Directive 2016/680. That was confirmed at the hearing. 74. As I explained in my Opinion in Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of processing personal data – Criminal investigation), (37) ‘the GDPR and Directive 2016/680 form a cohesive system in which: – the role of the GDPR is to lay down general rules on the protection of natural persons with regard to the processing of their personal data; – Directive 2016/680 lays down specific rules on the processing of such data in the area of judicial cooperation in criminal matters and police cooperation’. (38) 75. I made the following observations in that Opinion. (39) – ‘The protection afforded by the body of rules established by both provisions is based on the principles of lawfulness, fairness, transparency and, in so far as is relevant for the present purposes, on the principle of the strict limitation of the collection and processing of data to the purposes laid down by law’. – ‘In particular, Article 5(1)(b) of the GDPR provides that data is to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”. Article 4(1)(b) of Directive 2016/680, as lex specialis, is also worded in those terms’. – ‘Therefore, personal data may not be collected or processed on a general basis but rather only by reference to certain specified purposes and subject to the conditions of lawfulness stipulated by the EU legislature’. (40) – ‘The principle that the collection and processing of data, on the one hand, must be strictly linked to the purposes that both operations must serve, on the other, is not absolute, since both the GDPR and Directive 2016/680 allow a degree of flexibility …’. 76. In view of how the Court has interpreted Article 4(2) of Directive 2016/680, (41) it would be difficult to accept that personal data collected in criminal proceedings could be used for the same purpose in subsequent disciplinary proceedings against a public official. 77. I should point out, however, that under Article 4(2) of Directive 2016/680, ‘processing by the same or another controller for any of the purposes set out in Article 1(1) other than that for which the personal data are collected shall be permitted in so far as: (a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and (b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law’. 78. It is on the basis of that premiss that the referring court will have to examine whether or not the (different) purpose of the further processing is among the purposes laid down in Article 1(1) of Directive 2016/680. – If it is (reassignment ad intra), the referring court will have to determine whether the two requirements laid down in Article 4(2) of Directive 2016/680 are met. – If it is not (reassignment ad extra), Article 9(1) of Directive 2016/680 will apply. 1. Use of data under Article 4(2) of Directive 2016/680 79. The first of the two requirements established by that provision will be met only if the Member State law takes the form of legislation (42) governing the circumstances in which the controller is permitted to process personal data. That legislation must, moreover, contain binding rules that are clear and precise. (43) 80. However, that is, of course, a matter for the referring court to determine, after examining Article 177 of the CCP, Article 19(3) of the LCI and the Recommendations of the Prosecutor General’s Office. (44) On the basis of those factors, the referring court will have to gauge the extent to which national law allows information obtained in criminal proceedings to be used, subject to certain conditions, in an investigation into disciplinary offences. In that determination, the findings set out in the ECtHR judgment in Adomaitis may prove useful. (45) 81. As regards the second requirement, the referring court will have to assess whether, in the data processing at issue in this case, the interference was necessary and proportionate. (46) 82. Again, the guidance provided in the ECtHR judgment in Adomaitis may assist in that assessment. – As regards the issue of necessity, consideration will have to be given to whether it was actually necessary, owing to the inadequate evidential value of other data available in the disciplinary proceedings, for the data at issue to be used, in order to ensure the success of the investigation under way. (47) – As regards the issue of proportionality, the seriousness of the offence giving rise to the disciplinary proceedings will have to be assessed, on the understanding that, as the Lithuanian Government has argued and as is apparent from the ECtHR judgment in Adomaitis, (48) the use of personal data is restricted to offences attracting the most severe disciplinary penalty, namely dismissal. 2. Use of data under Article 9 of Directive 2016/680 83. Under Article 9(1) of Directive 2016/680, personal data collected by competent authorities for the purposes set out in Article 1(1) thereof may be processed for purposes other than those set out in Article 1(1) if such processing is authorised by EU or Member State law. In those circumstances, the GDPR will apply unless the processing is carried out in the course of an activity which falls outside the scope of EU law. (49) 84. If the referring court considers Article 4(2) of Directive 2016/680 to be inapplicable, it will have to have recourse to the GDPR. In accordance with the GDPR, it will have to determine whether, in addition to the legal basis, at least one of the conditions for lawful processing of personal data listed exhaustively in Article 6(1) thereof is met. V. Conclusion 85. In the light of the foregoing considerations, I propose that the Court of Justice give the following reply to the Lietuvos vyriausiasis administracinis teismas (Supreme Administrative Court of Lithuania): 1. Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), read in conjunction with Article 7, Article 8, Article 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that it does not allow the competent public authorities to collect data retained by providers of electronic communications services which may provide detailed information about a user and to use those data in investigations into conduct constituting less serious offences than the offences whose investigation may have justified access to those data at the time. 2. In the alternative: Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Articles 6 and 10 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, must be interpreted as not precluding the use, in administrative proceedings of a disciplinary nature, of personal data obtained lawfully and directly by public authorities in a criminal investigation, provided that, in accordance with clear, precise and binding rules of national law, those proceedings and that investigation are linked and in so far as the use of the data pursues a legitimate aim and is necessary and proportionate, which is a matter for the referring court to determine. 1 Original language: Spanish. 2 Directive of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37). 3 Directive of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89). 4 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). 5 The leading cases in that line of decisions include, but are not limited to, the judgments of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238); of 21 December 2016, Tele2 Sverige and Watson and Others (C‑203/15 and C‑698/15, EU:C:2016:970); of 6 October 2020, La Quadrature du Net and Others (C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791) (‘the judgment in La Quadrature du Net’); of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications) (C‑746/18, EU:C:2021:152); and of 5 April 2022, Commissioner of An Garda Síochána and Others (C‑140/20, EU:C:2022:258) (‘the judgment in Commissioner of An Garda Síochána’). 6 Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). 7 Law of the Republic of Lithuania on electronic communications, in the version of Law No IX-2135 of 15 April 2004, as amended by Law No XIII-2172 of 6 June 2019; ‘the LEC’. 8 The data listed in that annex (‘Categories of data to be protected’) are those necessary to identify the source and destination of a communication, its date, time, length and type, and the location of the users’ communication (including mobile communication) hardware. 9 Law of the Republic of Lithuania on criminal intelligence, in the version of Law No XI-2234 of 2 October 2012, as amended by Law No XIII-1837 of 20 December 2018; ‘the LCI’. 10 I will use the term ‘information’ rather than ‘intelligence’ to refer to the services that conduct the relevant investigations. 11 Code of Criminal Procedure of the Republic of Lithuania of 14 March 2002, in the version applicable to the main proceedings; ‘the CCP’. 12 According to the Ikiteisminio tyrimo duomenų teikimo ir panaudojimo ne baudžiamojo persekiojimo tikslais ir ikiteisminio tyrimo duomenų apsaugos rekomendajos (Recommendations on the provision and use of pre-trial investigation data for non-prosecution purposes and the protection of pre-trial investigation data) approved by Decree No 1 279 of the Prosecutor General of 17 August 2017, as amended by Decree No 1 211 of 25 June 2018, in particular paragraph 23 thereof, upon receiving a request for access to investigation data, the public prosecutor is to decide whether such data should be provided. If so, the public prosecutor must specify the extent to which they may be provided. 13 As stated at the hearing, the respective criminal proceedings against A.G. and the lawyer for those acts are still ongoing. 14 See footnote 13 to this Opinion. 15 Judgment in La Quadrature du Net, paragraph 103: ‘where the Member States directly implement measures that derogate from the rule that electronic communications are to be confidential, without imposing processing obligations on providers of electronic communications services, the protection of the data of the persons concerned is covered not by Directive 2002/58, but by national law only, subject to the application of [Directive 2016/680]’. 16 Paragraph 37 of the order for reference. 17 Judgments of 4 December 2018, Minister for Justice and Equality and Commissioner of An Garda Síochána (C‑378/17, EU:C:2018:979, paragraph 26), and of 22 December 2022, Airbnb Ireland and Airbnb Payments UK (C‑83/21, EU:C:2022:1018, paragraph 82). 18 The clear reference to Directive 2002/58 in the operative part of the order for reference and the fact that the legal reasoning in that order is silent on Directive 2016/680 militate in favour of the same conclusion. The fact remains, however, that the Court – without overstepping the boundaries of the question – may provide the referring court with useful guidance for its ruling, possibly invoking other provisions of EU law. See, to that effect, judgment of 18 September 2019, VIPA (C‑222/18, EU:C:2019:751, paragraph 50 and the case-law cited). 19 Paragraph 35 of the order for reference. Emphasis added. 20 It is therefore not necessary for the Court to rule on the lawfulness of those previous operations. If it were to do so, it would have to repeat that access to data held by providers of electronic communications services may be granted only if the retention of those data complied with Article 15(1) of Directive 2002/58. See, to that effect, the judgment in La Quadrature du Net, paragraph 167. That provision, read in the light of Article 7, Article 8, Article 11 and Article 52(1) of the Charter, precludes legislative measures which, for such purposes, provide, as a preventive measure, for the general and indiscriminate retention of traffic and location data (the judgment in La Quadrature du Net, paragraph 168). 21 I will, however, refer to that directive in the alternative in the last part of this Opinion. 22 The judgment in La Quadrature du Net, paragraph 129. 23 The judgment in La Quadrature du Net, paragraph 131 and the case-law cited. 24 The judgment in Commissioner of An Garda Síochána, paragraph 54. 25 The judgment in Commissioner of An Garda Síochána, paragraph 56. 26 The judgment in La Quadrature du Net, paragraphs 135 and 136, in which the Court explained that national security is the sole responsibility of the State, a responsibility corresponding to the primary interest in protecting the essential functions of the State and the fundamental interests of society against activities capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities. Those threats can be distinguished, by their nature and particular seriousness, from the general risk that tensions or disturbances, even of a serious nature, affecting public security will arise. Accordingly, the objective of safeguarding national security is capable of justifying measures entailing more serious interferences with fundamental rights than those which might be warranted by those other objectives. 27 The judgment in Commissioner of An Garda Síochána, paragraph 58. 28 The judgment in La Quadrature du Net, paragraph 168. 29 That is clear from paragraph 46 of the order for reference, alluding to data which may provide information regarding the communications made by a user of a means of electronic communication or regarding the location of the terminal equipment which he or she uses, and which allow precise conclusions to be drawn concerning the private lives of the persons concerned. 30 Order for reference, paragraph 46, in fine. 31 The judgment of the European Court of Human Rights (ECtHR) of 18 January 2022, Adomaitis v. Lithuania (CE:ECHR:2022:0118JUD001483318; ‘the ECtHR judgment in Adomaitis’), concerning the interception of electronic communications in a case involving a continued abuse of power by a prison governor, provides some guidance in assessing that equivalence. 32 Punishable conduct tried in criminal proceedings and purely professional misconduct in respect of which a penalty is handed down in disciplinary proceedings cannot, in principle, be equated. Criminal proceedings and disciplinary proceedings differ, in terms of their subject matter, as to the nature and seriousness of the conduct in question. The diverse nature of proceedings is, in that regard, indicative of the varying degrees of seriousness of the subject matter involved. 33 The Convention drawn up on the basis of Article K.3(2)(c) of the Treaty on European Union on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union (OJ 1997 C 195, p. 2) makes provision for passive corruption (‘the deliberate action of an official, who, directly or through an intermediary, requests or receives advantages of any kind whatsoever, for himself or for a third party, or accepts a promise of such an advantage, to act or refrain from acting in accordance with his duty or in the exercise of his functions in breach of his official duties’) and active corruption (‘the deliberate action of whosoever promises or gives, directly or through an intermediary, an advantage of any kind whatsoever to an official for himself or for a third party for him to act or refrain from acting in accordance with his duty or in the exercise of his functions in breach of his official duties’), both of which must be made a criminal offence. 34 The judgment in Commissioner of An Garda Síochána, paragraph 98. 35 The judgment in La Quadrature du Net, paragraph 166. 36 The judgment in Commissioner of An Garda Síochána, paragraph 106, citing the judgment in Prokuratuur, paragraph 51. 37 C‑180/21 (EU:C:2022:406); ‘the Opinion in Inspektor v Inspektorata’. 38 The Opinion in Inspektor v Inspektorata, point 35. 39 The Opinion in Inspektor v Inspektorata, points 36 to 39. 40 Article 5(1)(a) of the GDPR (Article 4(1)(a) of Directive 2016/680) establishes the ‘lawfulness’ requirement and Article 6 thereof lists the conditions for such lawfulness. For the present purposes and under Article 6(1)(e) of the GDPR, the processing must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 41 Judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of processing personal data – Criminal investigation), C‑180/21 (EU:C:2022:967); ‘the judgment in Inspektor v Inspektorata’. 42 I share the Commission’s view that, since the subsequent use of personal data obtained in a criminal investigation interferes with the fundamental rights guaranteed by Articles 7 and 8 of the Charter, it is imperative, under Article 52(1) of the Charter, that such interference be provided for by law. 43 Point 51 of this Opinion. 44 Footnote 12 to this Opinion. 45 In § 83 of that judgment, the ECtHR found that the guarantee of legality of the interference ensured by national legislative provisions and by the case-law of the Constitutional Court of Lithuania was sufficient. 46 As the Commission points out, the present case is not very different from the one examined in the judgment of the ECtHR of 16 June 2016, Versini-Campinchi and Crasnianski v. France (CE:ECHR:2016:0616JUD004917611). In § 57 of that judgment, the ECtHR held that the use, in disciplinary proceedings for breach of professional secrecy, of communications intercepted in the course of criminal proceedings pursues a legitimate aim under Article 8 of the ECHR. The close substantive overlap between the subject matter of criminal proceedings and that of disciplinary proceedings means that the legitimacy of the aims of both sets of proceedings converge. 47 The ECtHR judgment in Adomaitis, § 85. 48 The ECtHR judgment in Adomaitis, § 87. 49 That exception was interpreted restrictively in the judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 66).