CJEU Case C-548/21 / Judgment

C.G. v Bezirkshauptmannschaft Landeck
Deciding body type
Court of Justice of the European Union
Type
Decision
Decision date
04/10/2024
ECLI (European case law identifier)
ECLI:EU:C:2024:830
  • CJEU Case C-548/21 / Judgment

    Key facts of the case: 

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences – Directive (EU) 2016/680 – Article 3(2) – Concept of ‘processing’ – Article 4 – Principles relating to processing of personal data – Article 4(1)(c) – Principle of ‘data minimisation’ – Articles 7, 8, 47 and Article 52(1) of the Charter of Fundamental Rights of the European Union – Requirement that a limitation on the exercise of a fundamental right must be ‘provided for by law’ – Proportionality – Assessment of proportionality in the light of all the relevant factors – Prior review by a court or independent administrative authority – Article 13 – Information to be made available or given to the data subject – Limits – Article 54 – Right to an effective judicial remedy against a controller or processor – Police investigation in relation to narcotics trafficking – Attempt, by the police, to unlock a mobile telephone in order to gain access, for the purposes of that investigation, to the personal data stored in that telephone

    Outcome of the case: 

    On those grounds, the Court (Grand Chamber) hereby rules:

    1. Articles 4(1)(c) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in the light of Articles 7, 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as not precluding national legal rules which afford the competent authorities the possibility to access data contained in a mobile telephone for the purposes of the prevention, investigation, detection and prosecution of criminal offences in general, provided those rules:

      –        define with sufficient precision the nature or categories of offences concerned,

      –        ensure respect for the principle of proportionality, and

      –        make reliance on that possibility, except in duly justified cases of urgency, subject to prior review by a judge or an independent administrative body.

    2. Articles 13 and 54 of Directive 2016/680, read in the light of Article 47 and Article 52(1) of the Charter of Fundamental Rights, must be interpreted as precluding national legal rules which authorise the competent authorities to attempt to access data contained in a mobile telephone without informing the data subject, within the framework of the applicable national procedural rules, of the grounds on which the authorisation to access such data, issued by a court or an independent administrative body, is based, once the communication of that information is no longer liable to jeopardise the tasks of those authorities under that directive.
  • Paragraphs referring to EU Charter

    78. The referring court expressly referred, in its first and second questions, first, to Article 15(1) of Directive 2002/58, which requires, inter alia, that the legislative measures which it allows the Member States to adopt to restrict the scope of the rights and obligations laid down in several provisions of that directive, constitute a necessary, appropriate and proportionate measure within a democratic society to safeguard national security – that is to say, State security – defence and public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communications system, and, second, to Article 52(1) of the Charter, which enshrines the principle of proportionality in the context of limitations on the exercise of the rights and freedoms recognised by the Charter.

    81. Thus, it must be held that, by its first and second questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 4(1)(c) of Directive 2016/680, read in the light of Articles 7 and 8 of the Charter and Article 52(1) thereof, precludes national legal rules which afford the competent authorities the possibility of accessing data contained in a mobile telephone, for the purposes of preventing, investigating, detecting and prosecuting criminal offences in general, and which do not make reliance on that possibility subject to prior review by a court or an independent administrative body.

    82. As a preliminary point, it should be noted that, as is apparent from recitals 2 and 4 of Directive 2016/680, while establishing a strong and coherent framework for the protection of personal data in order to ensure respect for the fundamental right of protection of natural persons with regard to the processing of their personal data, recognised in Article 8(1) of the Charter and Article 16(1) TFEU, that directive is intended to contribute to the accomplishment of an area of freedom, security and justice within the European Union.

    84. In that regard, it should be recalled that, as recital 104 of Directive 2016/680 highlights, the limitations which, under that directive, can be placed on the right to the protection of personal data, provided for in Article 8 of the Charter, and on the right to respect for private and family life, protected by Article 7 of the Charter, must be interpreted in accordance with the requirements of Article 52(1) thereof, which include respect for the principle of proportionality.

    85. Those fundamental rights are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Any limitation on the exercise of those fundamental rights must, in accordance with Article 52(1) of the Charter, be provided for by law, respect the essence of those fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the limitations in question must lay down clear and precise rules governing the scope and application of those limitations.

    86. As regards, in the first place, the objective of general interest capable of justifying a limitation on the exercise of the fundamental rights enshrined in Articles 7 and 8 of the Charter, such as that arising from the legal rule at issue in the main proceedings, it should be noted that the processing of personal data in the context of a police investigation aimed at the prosecution of a criminal offence – such as an attempt to access the data contained in a mobile telephone – must be regarded, in principle, as genuinely meeting an objective of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter.

    88. By contrast, the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter.

    89. As regards, in the third place, the proportionate nature of the limitation on the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter, resulting from such processing, it involves balancing all the relevant factors in the individual case.

    95. The interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter to which the application of a rule such as that at issue in the main proceedings may give rise must therefore be regarded as serious, or even particularly serious.

    98. That being so, those considerations are without prejudice to the requirement, arising from Article 52(1) of the Charter, that any limitation on the exercise of a fundamental right must be ‘provided for by law’, that requirement implying that the legal basis authorising such a limitation must define its scope sufficiently clearly and precisely.

    107. As regards, in particular, the processing of sensitive data, account must be taken of the requirements laid down in Article 10 of Directive 2016/680, the purpose of which is to ensure enhanced protection with regard to that processing which is liable, as is apparent from recital 37 of that directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private and family life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter. To that end, as follows from the very terms of Article 10 of Directive 2016/680, the requirement that the processing of such data be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data, compared with those which follow from Article 4(1)(b) and (c) and Article 8(1) of that directive and refer only to the ‘necessity’ of data processing that falls generally, within the directive’s scope.

    110. It follows from the foregoing that the answer to the first and second questions is that Article 4(1)(c) of Directive 2016/680, read in the light of Articles 7 and 8 and Article 52(1) of the Charter, must be interpreted as not precluding national legal rules which afford the competent authorities the possibility to access data contained in a mobile telephone for the purposes of the prevention, investigation, detection and prosecution of criminal offences in general, provided those rules:

    –        define with sufficient precision the nature or categories of offences concerned,

    –        ensure respect for the principle of proportionality, and

    –        make reliance on that possibility, except in duly justified cases of urgency, subject to prior review by a judge or an independent administrative body.

    111.  It is apparent from the order for reference that, by its third question, the referring court seeks, in essence, to determine whether CG should have been informed of the attempts to access the data contained in his mobile telephone in order to be able to exercise his right to an effective remedy guaranteed in Article 47 of the Charter.

    113.  It must also be borne in mind that, as recital 104 of Directive 2016/680 highlights, the limitations imposed by that directive on the right to an effective remedy and to a fair trial, protected by Article 47 of the Charter, must be interpreted in accordance with the requirements of Article 52(1) thereof, which include respect for the principle of proportionality.

    114. It must therefore be held that, by its third question, the referring court asks, in essence, whether Articles 13 and 54 of Directive 2016/680, read in the light of Article 47 and Article 52(1) of the Charter, must be interpreted as precluding national legal rules which authorise the competent authorities in criminal matters to attempt to access data contained in a mobile telephone without informing the data subject.

    117. Last, it should be noted that Article 54 of Directive 2016/680, which gives expression to Article 47 of the Charter, requires Member States to provide that, where a person considers that his or her rights laid down in the provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in breach of those provisions, that person has the right to an effective judicial remedy.

    118. It is apparent from the case-law that the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned must be able to ascertain the reasons on which the decision taken in relation to him or her is based, so as to make it possible for him or her to defend his or her rights in the best possible conditions and to decide, with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position in which it may carry out the review of the lawfulness of that decision.

    119. Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

    123. It follows from the foregoing that the answer to the third question is that Articles 13 and 54 of Directive 2016/680, read in the light of Article 47 and Article 52(1) of the Charter, must be interpreted as precluding national legal rules which authorise the competent authorities to attempt to access data contained in a mobile telephone without informing the data subject, within the framework of the applicable national procedural rules, of the grounds on which the authorisation to access such data, issued by a court or an independent administrative body, is based, once the communication of that information is no longer liable to jeopardise the tasks of those authorities under that directive.

     

  • Paragraphs referring to EU Charter (original language)