62021CJ0548_RES
Case C‑548/21
CG
v
Bezirkshauptmannschaft Landeck
(Request for a preliminary ruling from the Landesverwaltungsgericht Tirol)
Judgment of the Court (Grand Chamber) of 4 October 2024
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences – Directive (EU) 2016/680– Article 3(2) – Concept of ‘processing’ – Article 4 – Principles relating to processing of personal data – Article 4(1)(c) – Principle of ‘data minimisation’ – Articles 7, 8 and 47 and Article 52(1) of the Charter of Fundamental Rights of the European Union – Requirement that a limitation on the exercise of a fundamental right must be ‘provided for by law’ – Proportionality – Assessment of proportionality in the light of all the relevant factors – Prior review by a court or independent administrative authority – Article 13 – Information to be made available or given to the data subject – Limits – Article 54 – Right to an effective judicial remedy against a controller or processor – Police investigation in relation to narcotics trafficking – Attempt, by the police, to unlock a mobile telephone in order to gain access, for the purposes of that investigation, to the personal data stored in that telephone)
Approximation of laws – Telecommunications sector – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58 – Scope – Attempt by the police to access the personal data contained in a mobile telephone for the purposes of a criminal investigation – No intervention on the part of providers of electronic communications services – Not included
(European Parliament and Council Directive 2002/58, as amended by Directive 2009/136, Arts 1(1) and (3), and 3)
(see paragraphs 57-59)
Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Scope – Attempt by the police to access the personal data contained in a mobile telephone for the purposes of a criminal investigation – Included
(European Parliament and Council Directive 2016/680, Arts 2(1) and 3(2))
(see paragraphs 71-77)
Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Principles relating to processing of personal data – Principles of data minimisation and of proportionality – Police investigation in relation to narcotics trafficking – National legal rules affording the competent authorities the possibility to access data contained in a mobile telephone for the purposes of the prevention, investigation, detection and prosecution of criminal offences in general – Whether permissible – Conditions
(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1); European Parliament and Council Directive 2016/680, Art. 4(1)(c))
(see paragraphs 84-86, 89-93, 95-106, 109, 110, operative part 1)
Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Information for the data subject – Right to an effective judicial remedy – Police investigation in relation to narcotics trafficking – National legal rules authorising the competent authorities to attempt to access the data contained in a mobile telephone without informing the data subject of the grounds for such an authorisation – Not permissible – Obligation of the competent national authorities to inform the data subject of those grounds – Scope
(Charter of Fundamental Rights of the European Union, Arts 47 and 52(1); European Parliament and Council Directive 2016/680, Arts 13 and 54)
(see paragraphs 115-123, operative part 2)
Résumé
In a reference for a preliminary ruling from the Landesverwaltungsgericht Tirol (Regional Administrative Court, Tyrol, Austria), the Grand Chamber of the Court of Justice clarifies, first, the conditions under which the competent national authorities can access the data contained in a mobile telephone for the purposes of preventing, investigating, detecting and prosecuting criminal offences in general, in the light of Directive 2016/680. (
1
) Second, it recognises the right of the data subject to be informed of the grounds on which the authorisation to access such data is based, once the communication of that information is no longer liable to jeopardise the tasks of those authorities.
On 23 February 2021, while carrying out a narcotics check, Austrian customs officers seized a package addressed to CG containing 85 grams of cannabis. That package was sent for examination to the Austrian police. On 6 March 2021, in a police investigation relating to narcotics trafficking, two police officers conducted a search of CG’s residence and questioned him regarding the consignor of the package. Following CG’s refusal to give access to the police officers to the connection data on his mobile telephone, those officers seized the telephone.
Subsequently, several attempt to unlock CG’s mobile telephone were made by various police officers. In the present case, both the seizure of the telephone and the subsequent attempts to make use of it by the police officers were made without the authorisation of the Public Prosecutor’s Office or a court.
On 31 March 2021, CG brought an action before the referring court challenging the lawfulness of the seizure of his mobile telephone, which was returned to him on 20 April 2021. CG was not immediately informed of the attempts to make use of his telephone and became aware of them in the proceedings pending before the referring court.
In that context, the referring court seeks to ascertain whether, in the light of the Directive on privacy and electronic communications, (
2
) full and uncontrolled access to all the data contained in a mobile telephone constitutes so serious an interference with fundamental rights (
3
) that that access must be limited to fighting serious offences. It also asks whether, first, that directive (
4
) precludes national legal rules pursuant to which, in the course of a criminal investigation, the criminal investigation police can gain, without the authorisation of a court or independent administrative body, full and uncontrolled access to all data contained in a mobile telephone and, second, whether those national legal rules are compatible with the right to an effective judicial remedy, in so far as they does not require the police authorities to inform the owner of a mobile telephone of the measures for the digital exploitation of that telephone.
Findings of the Court
As a preliminary point, the Court notes that an attempt, by the police, directly to access personal data contained in a mobile telephone without any intervention on the part of a provider of electronic communications services, such as that concerning CG, does not fall within the scope of the Directive on privacy and electronic communications.
In the first place, the Court finds that such an access attempt falls within the scope of Directive 2016/680. In that regard, it states that, in view of the broad scope which the EU legislature intended to give to the concept of ‘processing’, (
5
) where the police authorities seize a telephone and handle it for the purpose of extracting and consulting the personal data contained in that telephone, they commence ‘processing’, even if they did not, for technical reasons, succeed in accessing those data. The effectiveness of the principle of purpose limitation (
6
) necessarily requires that the purpose of the collection be determined as from when the competent authorities attempt to access personal data since such an attempt, if successful, is such as to enable them, inter alia, to collect, extract or consult the data in question immediately. Should it not be possible to classify such an attempt as ‘processing’ of data, the high level of protection of personal data of natural persons would be called into question. Similarly, if the applicability of Directive 2016/680 were to depend on the success of the attempt to access personal data contained in a mobile telephone, that would create uncertainty incompatible with the principle of legal certainty for both the competent national authorities and individuals.
In the second place, the Court analyses whether the principle of ‘data minimisation’, (
7
) as an expression of the principle of proportionality, precludes national legal rules which afford the competent authorities the possibility of accessing data contained in a mobile telephone, for the purposes of the prevention, investigation, detection and prosecution of criminal offences in general, without making reliance on that possibility subject to prior review by a court or an independent administrative body. Thus, the Court recalls that the limitations on the fundamental rights to private and family life and the protection of personal data (
8
) must comply with the principle of proportionality and may be introduced only if they are necessary and genuinely meet objectives of general interest recognised by the European Union. To that effect, first, the Court finds that the processing of personal data in the context of a police investigation aimed at the prosecution of a criminal offence – such as an attempt to access the data contained in a mobile telephone – must be regarded, in principle, as genuinely meeting an objective of general interest recognised by the European Union. Second, it notes that the proportionate nature of the limitations on the exercise of the fundamental rights to privacy and the protection of personal data, resulting from such processing, involves balancing all the relevant factors in the individual case.
Thus, first, as regards the seriousness of a limitation of those fundamental rights resulting from legal rules allowing the competent police authorities to access, without prior authorisation, the data contained in a mobile telephone, the Court states that such access is liable to relate, depending on the content of the mobile telephone in question and the choices made by those authorities, to a very wide range of data, and could thus allow very precise conclusions to be drawn concerning the private life of the data subject. Therefore, such an interference with the fundamental rights to privacy and the protection of personal data must be regarded as serious, or even particularly serious.
Second, the Court states that the seriousness of the offence under investigation is an essential parameter when examining the proportionality of the serious interference which access to the personal data contained in a mobile telephone constitutes. However, to consider that only combating serious crime may justify access to such data would limit the investigative powers of the competent authorities in relation to criminal offences in general would disregard the specific nature of the tasks performed by those authorities and would undermine the objective of achieving an area of freedom, security and justice within the European Union. That being so, in order to meet the requirement that any limitation on the exercise of a fundamental right must be ‘provided for by law’, (
9
) it is for the national legislature to define with sufficient precision the factors, in particular the nature or categories of the offences concerned, which must be taken into account.
Third, the Court notes that, in order to ensure compliance with the principle of proportionality, where access to personal data by the competent national authorities carries the risk of serious, or even particularly serious, interference with the fundamental rights of the data subject, that access must be subject to a prior review carried out by a court or by an independent administrative body. That review must take place prior to any attempt to access the data concerned, except in cases of duly justified urgency, in which case that review must take place within a short time. In the context of that review, the court or independent administrative body must be entitled to refuse or restrict an access request falling within the scope of Directive 2016/680 where it finds that the interference with fundamental rights which that access would constitute would be disproportionate. In the present case, a refusal to authorise the competent police authorities to access the data contained in a mobile telephone, or a restriction on that access, is therefore necessary if, taking into account the seriousness of the offence and the needs of the investigation, access to the content of the communications or to sensitive data does not appear to be justified.
In the light of the foregoing, the Court concludes that the principle of data minimisation, read in the light of the rights to the protection of personal data and to respect for private life, does not preclude national legal rules which afford the competent authorities the possibility of accessing data contained in a mobile telephone, for the purposes of preventing, investigating, detecting and prosecuting criminal offences in general. Such permissibility is, however, subject to compliance with the principles of legality and proportionality and to the existence of a prior review by a court or by an independent administrative body of the exercise of the right of access to such data.
In the third place, the Court rules on whether CG should have been informed of the attempts to access the data contained in his mobile telephone. (
10
) It notes in that regard that the competent national authorities which have been authorised by a court or an independent administrative body to access stored data must inform the data subjects of the grounds on which that authorisation is based, as soon as such information is no longer liable to jeopardise the investigations carried out by those authorities. Those authorities must make available to the data subjects all the information provided for by Directive 2016/680 (
11
) in order for those data subjects to be able to exercise, inter alia, their right to an effective remedy. (
12
) Accordingly, national legal rules which exclude as a general rule any right to obtain such information are not consistent with EU law. In the present case, the Court finds that CG should have been informed beforehand of the attempts to access the data contained in his mobile telephone. Since CG’s mobile telephone had already been seized at the time the police attempted to unlock it, it does not appear that informing him of those access attempts was liable to harm the investigation. Consequently, the Court concludes that the provisions of Directive 2016/680, read in the light of the Charter, (
13
) preclude national legal rules which authorise the competent authorities to access data contained in a mobile telephone without informing the data subject of the grounds on which the authorisation by a judge or an independent administrative body to access such data is based, once the communication of that information is no longer liable to jeopardise the tasks for which those authorities are responsible.
(
1
)	Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).
(
2
)	And more specifically Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11) (‘the Directive on privacy and electronic communications’).
(
3
)	Provided for in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
(
4
)	And more specifically Article 15(1) of the Directive on privacy and electronic communications.
(
5
)	Under Article 3(2) of Directive 2016/680, the concept of ‘processing’ is defined as ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means …’.
(
6
)	Article 4(1)(b) of Directive 2016/680.
(
7
)	As provided for by Article 4(1)(c) of Directive 2016/680, under which Member States must provide for personal data to be adequate, relevant and not excessive in relation to the purposes for which they are processed.
(
8
)	Articles 7 and 8 of the Charter.
(
9
)	Article 52(1) of the Charter.
(
10
)	Article 47 of the Charter.
(
11
)	Set out in Article 13(1) of Directive 2016/680.
(
12
)	Article 54 of Directive 2016/680.
(
13
)	More specifically, Articles 13 and 54 of Directive 2016/680, read in the light of Article 47 and Article 52(1) of the Charter.