Source: https://eucrim.eu/news/cjeu-backs-police-access-retained-data-minor-offences/
Timestamp: 2019-04-26 09:36:54+00:00

Document:
On 2 October 2018, the CJEU delivered another important judgment on data protection and on access by public authorities to retained provider data. The CJEU ruled on the Case C-207/16 (Ministerio Fiscal), which was presented together with the Opinion of the Advocate General (AG) in eucrim 1/2018, pp. 21-23.
The CJEU followed the AG’s opinion and concluded that law enforcement authorities can also access personal data retained by providers of electronic communications in cases of criminal offences that are not particularly serious. It is a pre-condition, however, that access does not constitute a serous infringement of privacy.
The case at issue concerned a request by Spanish police authorities to obtain information on communication data in order to identify the owners/users of SIM cards that were allegedly activated by means of a stolen mobile phone. As part of their investigations of the robbery of the mobile phone and a wallet, they asked various telephone operators to release names, telephone numbers; and addresses of persons who used the mobile phone to activate SIM cards. The Spanish Public Prosecutor’s Office (Ministerio Fiscal) appealed against the decision of the investigative judge who denied the request for access to said data. The judge believed that the acts giving rise to the criminal investigation in question are not serious enough to justify the collection of data under Spanish law.
The appeal court (Audiencia Provincial de Tarragona) sought guidance from the CJEU on whether EU law fixes a certain threshold for the seriousness of offences, above which interference with the individuals’ fundamental rights of privacy and of protection of personal data through the access of competent authorities to personal data retained by service providers may be justified.
The request for a preliminary ruling particularly concerned the interpretation of Art. 15(1) of Directive 2002/58/EC as amended by Directive 2009/136/EC – in short, the Directive on privacy and electronic communications. It allows Member States to restrict citizens’ rights when such a restriction constitutes a necessary, appropriate, and proportionate measure within a democratic society in order to safeguard national security, defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.
First, the CJEU had to deal with an objection by the Spanish government that questioned the jurisdiction of the Court. The Spanish government argued that access to telecommunication data is part of national authorities’ exercise of jus puniendi. This, however, constitutes activity on the part of the State in areas of criminal law, which makes EC Directives regulating data protection or retention inapplicable in accordance with Art. 1(3) of Directive 2002/58 or Art. 3(2) of Directive 95/46.
The CJEU stated that provisions limiting the scope of said EC Directives only mention activities of the State or of State authorities unrelated to fields in which individuals are active. The Directives also, however, cover legislative measures that govern the activities of providers of electronic communications services. By referring to Tele2 Sverige and Watson and others (see eucrim 4/2016, p. 164), the CJEU set forth that the activities of service providers are also affected if legislative measures relate to access of national authorities to data retained by those providers. As a result, it is irrelevant – in contrast to the remarks of the Spanish Government – that the request for access was made in connection with a criminal investigation. It is also irrelevant that the access at issue “only” relates to data in connection with SIM cards. In sum, the CJEU held the request for a preliminary ruling admissible.
The list of objectives in the directive capable of justifying national legislation governing public authorities’ access to such data and thereby derogating from the principle of confidentiality of electronic communications is exhaustive. This means that access must correspond, genuinely and strictly, to one of these objectives.
Hence, access to data − as in the case at issue − is legal (under the Directive on privacy and electronic communications), even though it concerns a minor offence (here: robbery of mobile phone).
The judgment in the present case (Minsterio Fiscal) is an important clarification in the field of data retention. The CJEU drew the line more precisely between admissible and inadmissible law enforcement access to data retained initially for commercial purposes by private providers of electronic communications services. It set a counterpoint to its landmark decision on national data retention regimes in Tele2 Sverige/Watson.
The CJEU clarified that there is a correlation between the level of seriousness of interference and the seriousness of crimes to be fought against. This is deducted from the principle of proportionality. In other words: if police seek sound revelations of the persons’ communications, the criminal offence involved must be a serious one.
In this way, the CJEU avoided deciding on the Spanish appeal court’s initial question, i.e. how the judges in Luxembourg would concretely define the “seriousness” of a criminal offence. The AG added statements in this regard at the end of his opinion. Nonetheless, the matter may be subject to subsequent references for a preliminary ruling.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 Art. 15
 CJEU 
 Art. 1
 Art. 3
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU