Opinion of the Advocate General — ECLI:EU:C:2026:222
Date: 2026-03-19
Language of the case: Estonian

Summary C-354/24 – 1 
Case C-354/24 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
15 May 2024 
Referring court: 
Tallinna Halduskohus (Estonia) 
Date of the decision to refer: 
15 May 2024 
Applicant: 
Elisa Eesti AS 
Respondent: 
Vabariigi Valitsuse julgeolekukomisjoni küberjulgeoleku nõukogu 
Tarbijakaitse ja Tehnilise Järelevalve Amet 
  
Subject matter of the main proceedings 
Action by which Elisa Eesti AS seeks the annulment in its entirety of the decision 
of the Vabariigi Valitsuse julgeolekukomisjoni küberjulgeoleku nõukogu 
(Cybersecurity Council of the Security Committee of the Government of the 
Republic of Estonia) of 27 October 2022 and in part of the decision of the 
Tarbijakaitse ja Tehnilise Järelevalve Amet (Office of Consumer Protection and 
Technical Supervision) of 25 November 2022, and an order requiring the 
respondents to comply accordingly. 
Subject matter and legal basis of the request 
The request for a preliminary ruling pursuant to Article 267(2) TFEU concerns the 
interpretation of Directive 2018/1972 of the European Parliament and of the 
Council establishing the European Electronic Communications Code, in particular 
Article 1(3)(c) thereof in conjunction with Article 4(2) TEU and Article 12(1) 
EN 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
2  
thereof, Articles 34 and 36 TFEU and the second sentence of Article 17(1) of the 
Charter of Fundamental Rights of the European Union. 
Questions referred 
1. Does a national legislative package (Paragraph 873(2), (3), (6), (7) and (8), 
Paragraph 874(1) to (4) and Paragraph 1965(1) to (4) of the Elektroonilise 
side seadus (Electronic Communications Act; ‘the ESS’)), which, in order to 
ensure national security, requires a communications company to obtain 
authorisation for the use of hardware and software in its communications 
network, fall within the scope of Directive 2018/1972 of the European 
Parliament and of the Council of 20 December 2018 establishing a European 
Electronic Communications Code? 
2. If the previous question is answered in the affirmative: Is Article 1(3)(c) [of 
Directive 2018/1972] in conjunction with Article 4(2) [TEU] to be 
interpreted as meaning that the introduction of such restrictions falls within 
the exclusive competence of the Member State and constitutes a purely 
national measure to which the provisions of Directive 2018/1972 do not 
apply? 
3. If Question 2 is answered in the negative: Does a national legislative 
package (Paragraph 873(2), (3), (6), (7) and (8), Paragraph 874(1) to (4) and 
Paragraph 1965(1) to (4) of the ESS) that does not allow a communications 
company to use hardware and software in its communications network 
without obtaining authorisation from an administrative authority for the use 
of that hardware and software constitute a restriction on the freedom to 
provide electronic communications networks and services within the 
meaning of Article 12(1) [of Directive 2018/1972]? 
4. If Question 3 is answered in the affirmative: Is such national legislation to 
be disapplied if it has not been notified to the European Commission in 
advance in accordance with Article 12(1) of [Directive 2018/1972]? 
5. If Question 2 is answered in the affirmative: Is it compatible with Article 36 
TFEU and the principle of proportionality for national legislation to require 
a communications company to obtain authorisation for the use of hardware 
and software in its communications network in order to ensure national 
security, and not to require the administrative authority, when assessing the 
threat posed by high-risk hardware and software: (a) to examine whether the 
risks associated with the manufacturer are projected onto the specific 
hardware and software; (b) to assess the functionality, location and 
importance of the specific hardware and software in the context of the 
provision of a communications service; and (c) to examine whether the 
problems associated with the State in which the manufacturer is established 
are projected onto the manufacturer? 
ELISA EESTI 
 
3 
6. Where the use of hardware or software that was already present and actively 
used in the communications network prior to the introduction of the 
authorisation requirement is authorised for a period shorter than the useful 
life of that hardware or software and the hardware or software in question 
was lawfully acquired, does that constitute a deprivation of property for the 
purposes of the second sentence of Article 17(1) of the Charter of 
Fundamental Rights of the European Union? 
Provisions of EU law relied on 
Treaty on European Union (TEU), Article 4(2); 
Treaty on the Functioning of the European Union, Article 36 
Charter of Fundamental Rights of the European Union (‘the Charter’), 
Article 17(1) sentence 2 
Directive (EU) 2018/1972 of the European Parliament and of the Council of 
11 December 2018 establishing the European Electronic Communications Code, 
Article 1(3)(c) and Article 12(1) 
Directive (EU) 2015/1535 of the European Parliament and of the Council of 
9 September 2015 laying down a procedure for the provision of information in the 
field of technical regulations and of rules on Information Society services, 
Article 5(1) 
Provisions of national law relied on 
Elektroonilise side seadus (ESS) (Electronic Communications Act), 
Paragraph 873(2), (3), (6), (7) and (8), Paragraph 874(1) to (4) and 
Paragraph 1965(1) to (4) 
According to Paragraph 873(2) of the ESS, the hardware or software used in a 
communications network may jeopardise national security due to the high risk 
posed by the manufacturer or provider of maintenance or support services 
(point 1) or due to the risk posed by the technical characteristics or configuration 
of the hardware or software (point 2). 
Paragraph 873(3), points 1 to 12, of the ESS lists the circumstances associated 
with the country of domicile of the manufacturer or provider of maintenance or 
support services that are considered to be high risk in the assessment of hardware 
or software with regard to national security. 
Pursuant to Paragraph 873(6) of the ESS, a communications company is obliged to 
obtain authorisation from the Tarbijakaitse ja Tehnilise Järelevalve Amet (Office 
for Consumer Protection and Technical Supervision) (‘the TTJA’) for the use of 
the hardware or software of a communications network. Paragraph 873(7) 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
4  
stipulates that the Government of the Republic of Estonia shall regulate by 
ordinance the scope of the obligation to obtain a usage permit, the more detailed 
requirements, the deadline and the modalities of the procedure as well as the 
specifics of the duration of the usage permit. According to paragraph 8, the 
Government of the Republic of Estonia shall take into account, when issuing 
ordinances, the importance of the communications network, its hardware or 
software and the communications service provided via that network, as well as the 
potential threats to national security arising therefrom. 
Paragraph 874 of the ESS defines the procedure for granting authorisation for the 
use of the hardware or software. 
Paragraph 1965 of the ESS specifies the details of the application of 
Paragraphs 873 and 874 of that Act. 
Vabariigi Valitsuse 22.06.2006 määrus nr 140 ‘Nõuded sideteenuse osutamisele ja 
sidevõrkude tehnilised nõuded’ (Ordinance of the Government of the Republic of 
Estonia No 140 of 22 June 2006 concerning requirements for the provision of 
communication services and technical requirements for communication networks) 
Succinct presentation of the facts and procedure in the main proceedings 
1 Elisa Eesti AS (‘Elisa’), the parent company of which is the Finnish company 
Elisa Oyj, is one of the three owners of the nationwide mobile communications 
network established in Estonia. Those three communications companies are 
providers of critical services and the hardware and software used in their mobile 
networks have been subject to authorisation since 1 February 2022 in accordance 
with Ordinance of the Government of the Republic of Estonia No 140 of 22 June 
2006. 
2 Elisa’s mobile network, which consists of more than a thousand base stations, is 
based on hardware and software from Huawei. The mobile phone generations 
(2G, 3G, 4G, 5G) are technically linked with each other. 
3 On 23 March 2022, Elisa submitted an application to the TTJA for approval to use 
Huawei’s existing 2G to 4G hardware and software in its communications 
network and Huawei’s 5G hardware and software, which was to be used in Elisa’s 
communications network from 1 June 2022. 
4 By decision of 27 October 2022, the Vabariigi Valitsuse julgeolekukomisjoni 
küberjulgeoleku nõukogu (Cybersecurity Council of the Security Committee of 
the Government of the Republic of Estonia) (‘the KJN’) determined on the basis 
of Paragraph 874(2) of the ESS that all of the hardware and software mentioned in 
Elisa’s application posed a threat to national security and proposed that the TTJA 
grant a usage permit for the 5G functionality until 31 December 2025 and for the 
2G to 4G functionality until 31 December 2029. 
ELISA EESTI 
 
5 
5 The TTJA forwarded the decision to Elisa on 25 November 2022 and granted the 
aforementioned usage permits for the periods specified by the KJN. Referring to 
the grounds of the KJN’s decision, the TTJA found that all of the hardware and 
software referred to in Elisa’s permit application jeopardised national security. 
6 On 1 December 2022, Elisa brought an action before the Tallinna Halduskohus 
(Administrative Court, Tallinn, Estonia), requesting that the decision of the KJN 
of 27 October 2022 be annulled in its entirety and the decision of the TTJA of 
25 November 2022 be annulled in part and that the defendants be required to 
comply accordingly. 
Essential arguments of the parties in the main proceedings 
7 Elisa claims that the contested decisions are unlawful, contain errors of 
assessment, are contrary to applicable law and disproportionately affect its 
fundamental rights. If a company is retroactively prohibited from using certain 
hardware and software in the interests of national security, i.e. in the public 
interest, that is essentially tantamount to expropriation, for which compensation 
must be paid immediately and appropriately. The KJN and the TTJA wrongly 
assumed that limiting the period of validity of the usage permit would have no 
significant impact on the communications market and on competition. 
8 The KJN and the TTJA misinterpreted Paragraph 873(2) and (3) of the ESS. They 
failed to examine the probability of the allegedly imminent danger and the 
proximity in time of the occurrence of the associated damage and its extent. 
Furthermore, the KJN’s decision was not based on the notion of ‘danger’, but on a 
‘suspicion of danger’. 
9 The defendants had not proven a threat to national security (Paragraph 874(4) of 
the ESS). According to the Communication of the European Commission of 
15 June 2023, only 10 out of 27 Member States had applied restrictions to high-
risk providers or excluded them from their 5G networks. 
10 In the KJN’s decision, the severity of the potential interference with Elisa’s 
fundamental rights was not taken into account when determining the risk 
threshold. Today, the only possible way to deploy the 5G generation is to build it 
on top of the existing 2G/3G/4G network using existing interfaces as a 5G NSA 
solution. When building the 5G network, it is necessary for the 5G hardware and 
software and the 4G hardware and software to come from the same manufacturer. 
11 The expansion of mobile networks is planned years in advance. For Elisa, one of 
the key prerequisites for selecting a provider in 2014 was that the next-generation 
network, 5G, could be built on the 4G hardware and software ordered from the 
chosen provider (Huawei). 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
6  
12 In order to install 5G hardware and software from an alternative provider, Elisa 
would have to replace Huawei’s existing 4G hardware and software. The cost of 
replacing all the 4G hardware and software meant a loss for Elisa. 
13 The contested administrative acts are measures having equivalent effect to 
quantitative restrictions on imports, which are in breach of Article 34 TFEU. The 
contested administrative acts do not fulfil the standard of proof required by the 
case-law of the European Court of Justice for a restriction on the free movement 
of goods: The existence of an actual, direct and sufficiently serious danger that has 
been proven in a specific and individual case. 1 The KJN and the TTJA had not 
shown that the prohibition on the use of Huawei hardware and software in Elisa’s 
communications network was an appropriate, necessary and proportionate 
measure to avert the alleged danger. The contested administrative acts prevented 
Elisa from continuing to purchase hardware and software from Huawei in Finland, 
as Huawei’s hardware and software could not be used for the intended purpose in 
Estonia on the basis of those administrative acts. 
14 In the defendants’ view, the contested administrative acts do not explain which of 
the objectives set out in Article 36 TFEU justify a restriction on the free 
movement of goods and why the restriction constitutes a proportionate measure to 
achieve the objective pursued. 2 
15 Under Article 5(1) of Directive 2015/1535, the Estonian State was obliged to 
submit to the European Commission the draft amendments to the ESS and to the 
usage authorisation scheme that entered into force on 1 February 2022 pursuant to 
Ordinance No 140. 3 Estonia did not send the Commission the draft law 
introduced on 27 September 2021, which added Paragraphs 873 to 875 and 
Paragraph 1965 to the ESS to regulate the usage permit. The legal basis for the 
amendments to the provisions of Ordinance No 140 relating to the usage permit 
was Paragraph 873(5) and (6) and Paragraph 875(5) of the ESS. Due to the breach 
of the notification obligation, the legal provisions relating to the usage permit in 
both the ESS and Ordinance No 140 should be disapplied, as they were adopted 
without a legal basis. 
 
1 See judgments of the European Court of Justice of 18 November 1979, Denkavit Futtermittel, 
251/78, EU:C:1979:252, paragraph 24; of 8 May 2003, ATRAL, C-14/02, EU:C:2003:265, 
paragraphs 66 to 69, and of 23 December 2015, Scotch Whisky Association and Others, 
C-333/14, EU:C:2015:845, paragraph 53. 
2 Judgment of the European Court of Justice of 10 July 1984, Campus Oil and Others, 72/83, 
EU:C:1984:256. 
3 See judgment of the European Court of Justice of 30 April 1996, CIA Security International, 
C-194/94, EU:C:1996:172, paragraph 55. 
ELISA EESTI 
 
7 
16 The contested administrative acts violate Article 12(1) of Directive 2018/1972. 
The restrictions are not necessary to protect public order or public safety and are 
not sufficiently justified. 4 
17 The contested administrative acts are contrary to general principles of EU law: the 
principle of the protection of legitimate expectations, the principle of equal 
treatment, the fundamental right to property, the freedom to conduct a business 
and the right to good administration, which includes the right to be heard, the right 
to an impartial and fair trial and the principle of investigation in administrative 
proceedings. In its decision, the TTJA relied wholly on the proposals and 
reasoning of the KJN as a political body. 
18 The administrative act of the TTJA results in a de facto expropriation of Huawei’s 
4G hardware and software, since it renders that technology unusable (violation of 
the Charter), it results in the unequal treatment of Elisa compared with 
communications companies that do not have Huawei hardware and software in 
their network (violation of Article 20 of the Charter), and it severely impairs 
Elisa’s legitimate expectations. 
19 The defendants are in flagrant breach of the prohibition of venire contra factum 
proprium. The administrative acts are formally unlawful. 
20 The defendants contest the action and request that it be dismissed. 
21 The decisions are lawful in substance. The defendants had correctly applied 
Paragraph 873(2) and (3) of the ESS. The KJN’s assessment of the threat to 
national security posed by the producing State is a risk assessment, not a finding 
of fact. In the present case, the risk to national security was established pursuant to 
Paragraph 873(2)(1) of the ESS on the basis of the high risk posed by the 
manufacturer and not pursuant to Paragraph 873(2)(2) of the ESS, i.e. on the basis 
of the risk posed by the technology itself. 
22 In the context of EU law, national security is the exclusive competence of the 
individual Member States. Moreover, the concept of national security does not 
distinguish between different levels of danger; rather, the danger must at least be 
foreseeable or predictable. 
23 The defendants had not breached their discretion and had taken all relevant 
circumstances into account. The KJN identified a risk in relation to all 12 criteria 
listed in Paragraph 873(3) of the ESS, took other relevant circumstances into 
account and, following an overall assessment, came to the conclusion that Elisa 
was applying for authorisation to use hardware and software that endangered 
national security. Therefore, no usage permit could be granted after 31 December 
 
4 If a provision of national law is contrary to EU law, it must also be disapplied by an 
administrative body (see judgment of 22 June 1989, Costanzo, C-103/88, EU:C:1989:256, 
paragraph 31). 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
8  
2029 for 2G to 4G and after 31 December 2025 for 5G (Paragraph 1965 of the 
ESS). That was the maximum possible transitional period under the Act and the 
defendants had no discretion to grant the application for a longer period. The 
transitional period was granted taking into account the circumstances attributable 
to Elisa. 
24 Judicial review of the assessment decision is limited to the so-called review of 
appropriateness and expediency, which primarily examines whether the 
administrative authority has taken into account the objectives of the law, the 
general principles of law and the relevant facts and whether the assessment has 
been made in compliance with the criteria and limits of the assessment 
(Paragraph 873(2) and (3), Paragraph 874(2) to (4) and Paragraph 1965(2) and (4) 
of the ESS). Although the interpretation of the undefined legal concept of national 
security is subject to judicial review, it should be borne in mind that it is also an 
area requiring particular expertise relating to national security and technical 
knowledge and that the right and duty to interpret undefined legal concepts 
contained in the rules lies with the administrative body responsible for the 
procedure. 
25 The decisions are formally lawful. The TTJA had not violated the duty to state 
reasons. The authority to decide whether hardware or software jeopardises 
national security lies solely with the KJN. In that context, the consultation with 
the KJN is to be regarded as a preparatory administrative act, since the KJN 
establishes a circumstance relevant to the final decision of the case – whether it is 
a high-risk hardware or software that jeopardises national security. The KJN’s 
assessment is based on the safety risk of which it has become aware and which 
cannot be reassessed by the TTJA. If the KJN has made a proposal on the 
conditions, that proposal is binding on the TTJA when granting the usage permit. 
26 The national legislation is in line with EU law. The measures are justified by the 
need to protect national security. It does not follow from the case-law cited by 
Elisa that the functioning of critical services is invariably covered by public 
security within the meaning of Article 36 TFEU. It is the exclusive responsibility 
of the State to determine essential national security interests. In one particular 
ruling, a Swedish administrative court held that a national regulation making it 
possible to ban the use of Huawei equipment in a communications network was 
necessary to ensure Sweden’s national security. According to Recommendation 
(EU) 2019/534 of the European Commission, Member States are authorised to 
exclude providers or suppliers from their markets for reasons of national security. 
The KJN had correctly identified a threat to national security. 
27 The standard of proof laid down in the ESS is in line with EU law, even if the 
measures (legislation) serve the public security interest claimed by Elisa. The 
case-law of the European Court of Justice does not give rise to the burden of proof 
claimed by Elisa, but rather it must be examined whether the threat to national 
ELISA EESTI 
 
9 
security is real (probability) and sufficiently serious (severity of the harmful 
consequence). 5 
28 The duty to provide information has been satisfied. Estonia had notified the 
European Commission of the usage permit scheme 6 and no longer needed to 
notify the Commission of the subsequent amendments, since those amendments 
were either not substantial or merely provided for more lenient rules compared 
with the original draft. The obligation laid down in the third subparagraph of 
Article 5(1) of Directive 2015/1535 must be assessed in the light of the directive’s 
objective of protecting the free movement of goods by means of preventive 
control, which is ensured by the procedure for the examination of the draft 
technical regulation by the Commission and the Member States. 7 A Member State 
is not obliged to notify the draft administrative act. 8 
29 The defendants disagree with Elisa’s view on Estonia’s breach of the duty to 
provide information. The Information Directive does not apply to the provisions at 
issue (Directive 2015/1535, Article 1(3)). The provisions of the ESS, which set 
out requirements for communications networks and services to ensure national 
security and authorised the competent national regulatory authorities to issue 
binding guidelines in the authorisation procedure (Paragraphs 873 to 875 and 1965 
of the ESS) fell within the scope of Directive 2002/21/EC (Article 13(a)(1) and 
(2) of Directive 2002/21/EC [recast by Directive 2018/1972]9 [Article 40(1) of 
Directive 2018/1972] and Article 13(b)(1) and 2 of Directive 2002/21/EC 
[Article 41 of Directive 2018/1972]). Even if the Information Directive were 
applicable, the exceptions to the duty to provide information set out in the 
Directive would still apply. 10 
30 Article 12(1) of Directive 2018/1972 is not relevant in so far as it regulates the 
general authorisation of electronic communications networks and services, which 
is based on the repealed Directive 2002/20/EC, not on Directive 2002/21/EC. 
Article 12(1) of Directive 2018/1972 had been transposed by Paragraphs 3 and 4 
of the ESS. In the defendants’ understanding, Elisa also took the view that the 
 
5 Judgment of the Administrative Panel of the Riigikohus (Supreme Court) of 19 February 2019 
No 3-17-1545, paragraph 19. Available electronically: 
https://www.riigikohus.ee/et/lahendid?asjaNr= 3-17-1545/81. 
6 https://technical-regulation-information-system.ec.europa.eu/et/notification/15441. 
7 See judgments of the European Court of Justice of 10 July 2014, Ivansson and Others, 
C-307/13, EU:C:2014:2058, paragraphs 41 to 43, and of 15 April 2010, Sandström, C-433/05, 
EU:C:2010:184, paragraphs 46 to 49. 
8 See judgment in Ivansson and Others, C-307/13, paragraphs 44 to 46. 
9 Directive 2002/21/EC was transposed into Estonian law by the ESS in the version applicable 
from 1 January 2005 and Directive 2018/1972 was transposed into Estonian law by the ESS in 
the version applicable from 1 February 2022. 
10 See Commission Recommendation (EU) 2019/534, Article 26; Directive 2015/1535, Article 7. 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
10  
introduction of the usage permit scheme to ensure national security was not 
related to the transposition of Directive 2018/1972. 
31 The contested administrative act does not infringe the general principles of the 
European Union. The decisions of the European Court of Justice 11 do not give 
rise to the discrepancy alleged by Elisa in relation to national law or national case-
law with regard to the principle of proportionality. According to the case-law of 
the European Court of Justice, 12 national security is also a legitimate and very 
important objective of the restriction of fundamental rights. The lack of a 
compensation mechanism does not make the administrative act unlawful. It does 
not constitute expropriation. The requirement for a usage permit is proportionate 
to the legitimate objective. It does not violate the communications company’s 
fundamental right to equal treatment within the meaning of Article 20 of the 
Charter, as it applies equally to all. 
32 The defendant had not violated the principle of good administration. The 
communications company could have no justified confidence in maintaining the 
status quo. 13 
Succinct presentation of the reasoning in the request for a preliminary ruling 
33 The parties are in dispute as to whether the contested administrative acts are 
compatible with, inter alia, EU law, namely Article 5(1) of Directive 2015/1535, 
Article 12(1) of Directive 2018/1972, Articles 34 and 36 TFEU and the second 
sentence of Article 17(1) of the Charter. 
34 The present dispute does not concern a purely national measure, 14 since Elisa’s 
parent company is Elisa Oyj, which is established in another Member State. 
Directive 2015/1535 
35 The parties dispute whether the contested national provisions qualify as technical 
regulations within the meaning of Article 1(1)(f) of Directive 2015/1535 and 
 
11 Judgments of the European Court of Justice of 6 October 2020, Commission v Hungary (Higher 
education), C-66/18, EU:C:2020:792, paragraph 179; of 18 June 2020, Commission v Hungary 
(Transparency of associations), C-78/18, EU:C:2020:476, paragraph 77, and of 10 February 
2009, Commission v Italy, C-110/05, EU:C:2009:66, paragraph 62. 
12 See judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C-140/20, 
EU:C:2022:258, paragraphs 57 to 58. 
13 See judgment of 11 June 2015, Berlington Hungary and Others (C-98/14, EU:C:2015:386, 
paragraph 87); Judgment of the Administrative Panel of the Riigikohus (Supreme Court) of 
27 January 2010 No 3-3-1, paragraph 15. Available through: 
https://www.riigikohus.ee/et/lahendid?asjaNr= 3-3-1-79-09 
14 See judgment of the European Court of Justice of 15 November 2016, Ullens de Schooten, 
C-268/15, EU:C:2016:874, paragraph 53. 
ELISA EESTI 
 
11 
whether they had to be notified to the Commission in advance. According to the 
case-law of the European Court of Justice, 15 those could be provisions of the 
fourth category of Article 1(1)(f) (‘laws, regulations or administrative provisions 
of Member States […] prohibiting the manufacture, importation, marketing or use 
of a product’) of Directive 2015/1535. 
36 However, the [referring] court considers that that directive is not applicable in the 
present case. Pursuant to Article 1(3) of Directive 2015/1535, that directive is not 
to apply to rules relating to matters which are covered by Union legislation in the 
field of telecommunications services, as covered by Directive 2002/21. It is 
undisputed that Article 125 of Directive 2018/1972 repealed Directive 2002/21 
with effect from 21 December 2020 and that Directive 2018/1972 includes, inter 
alia, Directive 2002/21. 16 The national legislation at issue entered into force on 
1 February 2022, transposing Directive 2018/1972. 
Directive 2018/1972 
37 According to Article 1(3)(c) of Directive 2018/1972, that directive is without 
prejudice to actions taken by Member States for public order and public security 
purposes and for defence. In view of the fact that the national legislation at issue 
provides for restrictions on hardware and software in the electronic 
communications network and an obligation for the undertaking to apply for a 
usage permit in order to ensure national security, it is unclear whether 
Article 1(3)(c) of Directive 2018/1972 in conjunction with Article 4(2) TEU must 
be interpreted as meaning that the imposition of such restrictions falls within the 
exclusive competence of the Member State and constitutes a purely national 
measure to which the provisions of Directive 2018/1972 do not apply. However, 
such an interpretation is called into question by the case-law of the Court of 
Justice, according to which the mere fact that a national measure has been taken to 
protect national security cannot render EU law inapplicable and exempt Member 
States from the necessary compliance with that law. 17 In the event that 
Article 1(3)(c) of Directive 2018/1972 does not exclude the application of that 
directive, the question arises as to whether the contested legislation is compatible 
with Article 12(1) of Directive 2018/1972. 
38 Under Article 12(1) of Directive 2018/1972, Member States must ensure the 
freedom to provide electronic communications networks and services, subject to 
the conditions set out in that directive. To that end, Member States shall not 
prevent an undertaking from providing electronic communications networks or 
 
15 See judgment of 28 May 2020, ECO-WIND Construction, C-727/17, EU:C:2020:393, 
paragraphs 45 and 46. 
16 See Recital 4 of Directive 2018/1972. 
17 See judgment of 15 July 2021, Ministrstvo za obrambo, C-742/19, EU:C:2021:597, 
paragraph 40 and the case-law cited therein; of 16 January 2024, Österreichische 
Datenschutzbehörde, C-33/22, C-33/22, EU:C:2024:46, paragraph 50. 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
12  
services, except where that is necessary for the reasons set out in Article 52(1) 
TFEU. Any such limitation to the freedom to provide electronic communications 
networks and services shall be duly reasoned and shall be notified to the 
Commission. 
39 The defendants failed to notify the European Commission of the national 
provisions in question. In light of the above, it is unclear whether Article 12(1) of 
Directive 2018/1972 is to be interpreted as meaning that legislation requiring a 
communications company to apply for authorisation for the use of hardware and 
software in its communications network constitutes provisions imposing a 
restriction on the freedom to provide electronic communications networks and 
services, which must be notified to the Commission. 18 If that is the case, the 
national legislation in question does not apply to Elisa in the event of a breach of 
the notification obligation. It is also unclear whether such a restriction is 
compatible with Article 3(2)(b) of Directive 2018/1972. That is because it is 
apparent that banning the use of Huawei’s technology in communication networks 
could lead to dependence on two manufacturers (Nokia and Ericsson). However, 
if Directive 2018/1972 is not applicable in the present case, the legislation in 
question falls within the scope of Article 36 TFEU. 
Article 36 TFEU and the general principles of EU law 
40 All trading rules enacted by Member States which are capable of hindering, 
directly or indirectly, actually or potentially, intra-Community trade are to be 
considered as measures having an effect equivalent to quantitative restrictions. 19 
According to the Court, there is no doubt that where the contested decision of the 
TTJA Elisa prohibits the use of Huawei 5G hardware and software from 1 January 
2026 and Huawei 2G-4G hardware and software from 1 January 2030 and the 
goods are in free circulation in the European Union, 20 there is a measure having 
equivalent effect to quantitative restrictions on imports (Article 34 TFEU). If 
restrictions are justified on grounds of public policy or public security, there is an 
exception to the prohibition in Article 34 TFEU (see Article 36 TFEU). Within the 
framework of the fundamental freedoms guaranteed by the Treaties, public policy 
considerations can be invoked if there is a real, present and substantial danger 
affecting a fundamental interest of society. 21 In the case of such an exception to 
 
18 See judgment in ECO-WIND Construction, C-727/17. 
19 Judgment of 11 July 1974, Dassonville, C-8/74, EU:C:1974:82, paragraph 5. 
20 The decision of the KJN, which was also contested, stated that Huawei Technologies was one of 
the world’s largest suppliers of networking and telecommunications equipment and held 32% of 
5G patents in 2018. 
21 Judgment of 26 September 2018, Van Gennip and Others, C-137/17, EU:C:2018:771, 
paragraph 58, and judgment in Commission v Hungary, C-66/18, paragraph 181. 
ELISA EESTI 
 
13 
the principle of free movement of goods, the national authorities must demonstrate 
that the legislation in question complies with the principle of proportionality. 22 
41 It is undisputed that the legislator has defined the purpose of the restriction in 
Paragraph 3 of the ESS as ensuring national security. The notion of ‘national 
security’ is defined in the Security Policy Fundamentals 23 adopted by the 
Riigikogu (Parliament) in 2017 and in the National Defence Development Plan 
2017-2026 adopted by the Government of the Republic of Estonia; the Security 
Policy Fundamentals define the objective of Estonian security policy as ensuring 
the independence and sovereignty of the Estonian State, the existence of the 
nation and the State, territorial integrity, constitutional order and the security of 
the population; the National Defence Development Plan defines the functioning of 
the State and society in all circumstances as one of the main aspirations of 
national defence; that includes ensuring the continuity of critical services or other 
services essential to national defence; communication services are among those 
critical services, and the establishment of communication networks is directly 
related to them. In doing so, the legislator also linked the issue of national security 
to ensuring the continuity of critical services, which is categorised as public 
security in the case-law of the Court of Justice. 24 However, irrespective of 
whether measures are adopted to safeguard national or public security, the 
Member State is obliged to comply with EU law, including its general principles 
. 25 One of the general principles of EU law is the principle of proportionality. 26 
That means that both restrictions on the free movement of goods and restrictions 
on the freedom to provide electronic communications networks and services must 
be sufficiently justified and proportionate. 
42 The contested preparatory administrative act 27 examined whether the hardware 
and software of the communication network mentioned in the authorisation 
application poses a threat to national security due to the manufacturer, under what 
conditions the hardware and software of Huawei Technologies Co, Ltd can be 
used in such a way that it does not pose a threat to national security, the impact of 
a conditional authorisation for Elisa (taking into account the useful life of the 
technology used and the possibility of replacing it with another manufacturer’s 
 
22 See judgments of 23 October 1997, Franzén, C-189/95, EU:C:1997:504, paragraphs 75 and 76, 
and of 5 June 2007, Rosengren and Others, C-170/04, EU:C:2007:313, paragraph 50. 
23 Available electronically: https://riigikantselei.ee/jpa 
24 See judgments in Denkavit Futtermittel, C-251/78, paragraph 24; ATRAL, C-14/02, 
paragraphs 66 to 69, and Scotch Whisky Association and Others, C-333/14, paragraph 53. 
25 See judgments in Ministrstvo za obrambo, C-742/19, paragraph 40 and the case-law cited, and 
Österreichische Datenschutzbehörde, C-33/22, paragraph 50. 
26 See Recital 6 of Directive 2018/1972; judgments in Commissioner of An Garda Síochána and 
Others, C-140/20, paragraphs 56 to 59, and of 6 October 2020, La Quadrature du Net and 
Others, C-511/18, C-512/18 and C-520/18, EU:C:2020:791, paragraphs 130 to 132. 
27 Decision of the KJN of 27 October 2007. 
REQUEST FOR A PRELIMINARY RULING IN CASE C-354/24 
 
14  
technology), the impact of refusing authorisation and/or granting conditional 
authorisation on the continuity of the communications service and 
communications networks and on the communications market and competition. 
The Court therefore asks whether the legislation of a Member State complies with 
Article 36 TFEU and the principle of proportionality when it requires a 
communications company to obtain authorisation for the use of hardware and 
software in its communications network in order to ensure national security, and 
does not require the administrative authority, when assessing the threat posed by 
high-risk hardware and software, (a) to examine whether the risks associated with 
the manufacturer are projected onto the specific hardware and software, (b) to 
assess the functionality, location and importance of the specific hardware and 
software in the context of the provision of a communications service and (c) to 
examine whether the problems associated with the manufacturer’s Member State 
of establishment are projected onto the manufacturer? In the context of 
establishing threat, the Court refers to the European Commission’s 
Communication C(2023) 4049 final of 15 June 2023 ‘Implementing the EU 5G 
Cybersecurity Toolbox’, in which the Commission considered decisions by 
Member States to restrict and exclude Huawei and ZTE to be justified and in line 
with the 5G toolbox. 28 Although the Commission communication is not legally 
binding on the Member States, 29 the Court considers that, in view of the 
competence of the Commission 30 and the purpose of the communication, it is 
nevertheless a document that is useful for assessing the compatibility of the 
contested restriction with EU law. 
The Charter 
43 In view of the second sentence of Article 17(1) of the Charter, it is unclear in the 
present case whether, in the event that an authorisation for the use of hardware or 
software that was already present and actively used in the communications 
network before the introduction of the authorisation requirement is granted for a 
period shorter than the useful life of the hardware or software and the hardware or 
software was lawfully acquired, there is a deprivation of property. 
 
28 Available electronically: https://digital-strategy.ec.europa.eu/de/library/communication-
commission-implementation-5g-cybersecurity-toolbox 
29 See Article 288 TFEU. 
30  See Article 17(1) TEU.