Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 11 - Freedom of expression and information
Article 52 - Scope and interpretation
Key facts of the case:
Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Confidentiality of communications – Providers of electronic communications services – Directive 2002/58/EC – Article 15(1) – Articles 7, 8, 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union – Access to those data requested by a national authority having competence to prosecute offences of aggravated theft – Definition of the concept of ‘serious offence’ the prosecution of which is capable of justifying serious interference with fundamental rights – Competence of the Member States – Principle of proportionality – Scope of prior review by a court of the requests to access the data retained by providers of electronic communications services
Outcome of the case:
On those grounds, the Court (Grand Chamber) hereby rules:
Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8, 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union,
must be interpreted as not precluding a national provision which requires a national court, acting in the context of a prior review carried out following a reasoned request for access to a set of traffic or location data – which are liable to allow precise conclusions to be drawn concerning the private life of a user of a means of electronic communication and retained by providers of electronic communications services – submitted by a competent national authority in the context of a criminal investigation, to authorise such access if it is requested for the purposes of investigating criminal offences punishable under national law by a maximum term of imprisonment of at least three years, provided that there is sufficient evidence of the commission of such offences and that those data are relevant to establishing the facts, on condition, however, that that court is entitled to refuse such access if it is requested in the context of an investigation into an offence which is manifestly not a serious offence, in the light of the societal conditions prevailing in the Member State concerned.
34 In the light of the foregoing, it must be held that by its question the referring court asks, in essence, whether Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8, 11 and Article 52(1) of the Charter, must be interpreted as precluding a national provision which requires a national court, acting in the context of a prior review carried out following a reasoned request for access to a set of traffic or location data – which are liable to allow precise conclusions to be drawn concerning the private life of a user of a means of electronic communication and are retained by providers of electronic communications services – submitted by a competent national authority in the context of a criminal investigation, to authorise that access if it is requested for the purposes of investigating criminal offences punishable under national law by a maximum term of imprisonment of at least three years, provided that there is sufficient evidence of the commission of such offences and that those data are relevant to establishing the facts.
35 As a preliminary point, it should be borne in mind that, as regards the circumstances in which access to traffic and location data retained by providers of electronic communications services may, for the purposes of the prevention, investigation, detection and prosecution of criminal offences, be granted to public authorities, pursuant to a legislative measure adopted under Article 15(1) of Directive 2002/58, the Court has held that such access may be granted only in so far as those data have been retained by those providers in a manner consistent with that directive (see, to that effect, judgment of today’s date, La Quadrature du Net and Others (Personal data and action to combat counterfeiting), C‑470/21, paragraph 65 and the case-law cited). The Court has also held that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, precludes legislative measures which, for such purposes, provide, as a preventive measure, for the general and indiscriminate retention of traffic and location data (judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications), C‑746/18, EU:C:2021:152, paragraph 30 and the case-law cited).
36 It is also appropriate to recall the case-law of the Court according to which only the objectives of combating serious crime or preventing serious threats to public security are capable of justifying serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, arising from public authorities’ access to a set of traffic or location data, which are liable to provide information regarding the communications made by a user of a means of electronic communication or regarding the location of the terminal equipment which he or she uses and which allow precise conclusions to be drawn concerning the private lives of the persons concerned; other factors relating to the proportionality of a request for access, such as the length of the period in respect of which access to such data is sought, cannot have the effect that the objective of preventing, investigating, detecting and prosecuting criminal offences in general is capable of justifying such access (see, to that effect, judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications), C‑746/18, EU:C:2021:152, paragraph 35 and the case-law cited).......38 As regards, first of all, the question of whether access such as that at issue in the main proceedings may be classified as serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, it should be noted that, in order to identify the perpetrators of the alleged thefts which gave rise to those proceedings, the Public Prosecutor’s Office requested, for each of the mobile telephones concerned, authorisation from the referring court – on the basis of Article 132(3) of Legislative Decree No 196/2003 – to collect all the data in the possession of the telephone companies, obtained by means of tracking or localisation methods, concerning the telephone conversations and communications and the connections made with those telephones. More specifically, those requests concerned the users and IMEI codes of the devices called or making the calls, the sites visited and reached, the times and durations of calls and connections, the details of the cells and/or towers concerned, as well as the users and IMEI codes of senders/receivers of SMS and MMS.
39 Access to such a set of traffic or location data appears liable to allow precise conclusions to be drawn concerning the private lives of the persons whose data have been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them (see, to that effect, judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications), C‑746/18, EU:C:2021:152 paragraph 36 and the case-law cited). The interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter caused by access to such data therefore appears likely to be classified as serious.......41 Similarly, for the purposes of assessing the existence of a serious interference with the rights guaranteed in Articles 7 and 8 of the Charter, the fact that the data to which the Public Prosecutor’s Office requested access may not be the data of the owners of the mobile telephones at issue, but the data of the persons who communicated with each other by using those telephones after their alleged theft, is irrelevant. Indeed, it is apparent from Article 5(1) of Directive 2002/58 that the obligation of principle to ensure the confidentiality of the electronic communications and the related traffic data effected by means of a public communications network and publicly available electronic communications services covers communications made by the users of that network. Article 2(a) of that directive defines the concept of ‘user’ as meaning any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to that service.......47 However, the definition of ‘serious offences’, adopted by the Member States, must comply with the requirements arising from Article 15(1) of that directive, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter.......49 Furthermore, it is clear from the third sentence in Article 15(1) of Directive 2002/58 that measures taken by the Member States under that provision must comply with the general principles of EU law, which include the principle of proportionality, and ensure respect for the fundamental rights guaranteed by Articles 7, 8 and 11 of the Charter (see, to that effect, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C‑140/20, EU:C:2022:258, paragraph 42).......63 It follows from the foregoing that the answer to the question referred for a preliminary ruling is that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as not precluding a national provision which requires a national court, acting in the context of a prior review carried out following a reasoned request for access to a set of traffic or location data – which are liable to allow precise conclusions to be drawn concerning the private life of a user of a means of electronic communication and retained by providers of electronic communications services – submitted by a competent national authority in the context of a criminal investigation, to authorise such access if it is requested for the purposes of investigating criminal offences punishable under national law by a maximum term of imprisonment of at least three years, provided that there is sufficient evidence of the commission of such offences and that those data are relevant to establishing the facts, on condition, however, that that court is entitled to refuse such access if it is requested in the context of an investigation into an offence which is manifestly not a serious offence, in the light of the societal conditions prevailing in the Member State concerned.
