Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 51 - Field of application
Key facts of the case:
Reference for a preliminary ruling — Electronic communications — Processing of personal data — Directive 2002/58/EC — Articles 1 and 3 — Scope — Confidentiality of electronic communications — Protection — Article 5 and Article 15(1) — Charter of Fundamental Rights of the European Union — Articles 7 and 8 — Data processed in connection with the provision of electronic communications services — Access of national authorities to the data for the purposes of an investigation — Threshold of seriousness of an offence capable of justifying access to the data.
Outcome of the case:
On those grounds, the Court (Grand Chamber) hereby rules:
Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that the access of public authorities to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as the surnames, forenames and, if need be, addresses of the owners, entails interference with their fundamental rights, enshrined in those articles of the Charter of Fundamental Rights, which is not sufficiently serious to entail that access being limited, in the area of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime.
1) This request for a preliminary ruling concerns, in essence, the interpretation of Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11) (‘Directive 2002/58’), read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
...
5) Recitals 2, 11, 15 and 21 of Directive 2002/58 state:
‘(2) This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the [Charter]. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.
…
23) The referring court explains that, subsequent to that order, the Spanish legislature amended the Code of Criminal Procedure by adopting Organic Law 13/2015. That legislation, which is relevant to the resolution of the case in the main proceedings, introduced two new alternative criteria for determining the degree of seriousness of an offence. The first is a substantive criterion, relating to conduct which corresponds to criminal classifications the criminal nature of which is specific and serious, and which is particularly harmful to individual and collective legal interests. Moreover, the national legislature relied on a formal normative criterion, based on the penalty prescribed for the offence in question. The threshold of three years’ imprisonment envisaged by that criterion does, however, cover the great majority of offences. In addition, the referring court considers that the State’s interest in punishing criminal conduct cannot justify disproportionate interferences with the fundamental rights enshrined in the Charter.
24) In that regard, the referring court considers that, in the main proceedings, Directives 95/46 and 2002/58 establish a link with the Charter. The national legislation at issue in the main proceedings therefore comes within its scope, in accordance with Article 51(1) of the Charter, despite the fact that Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58 (OJ 2006 L 105, p. 54) was annulled by the judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238). 25 In that judgment, the Court recognised that the retention and communication of traffic data constitute particularly serious interferences with the rights guaranteed in Articles 7 and 8 of the Charter and established criteria for the assessment of whether the principle of proportionality has been observed, including the seriousness of the offences warranting the retention of data and access thereto for the purposes of an investigation.
26 In those circumstances, the Audiencia Provincial de Tarragona (Provincial Court, Tarragona, Spain) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Can the sufficient seriousness of offences, as a criterion which justifies interference with the fundamental rights recognised by Articles 7 and 8 of the [Charter], be determined taking into account only the sentence which may be imposed in respect of the offence investigated, or is it also necessary to identify in the criminal conduct particular levels of harm to individual and/or collective legally protected interests?
(2) If it were in accordance with the constitutional principles of the European Union, used by the Court of Justice in its judgment [of 8 April 2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238] as standards for the strict review of [Directive 2002/58], to determine the seriousness of the offence solely on the basis of the sentence which may be imposed, what should the minimum threshold be? Would it be compatible with a general provision setting a minimum of three years’ imprisonment?’
29) In its written observations submitted to the Court, the Spanish Government expressed the view, endorsed by the United Kingdom Government during the hearing, that the Court does not have jurisdiction to answer the question referred for a preliminary ruling, on the ground that, in accordance with the first indent of Article 3(2) of Directive 95/46 and Article 1(3) of Directive 2002/58, the case in the main proceedings is excluded from the scope of those two directives. Therefore, the case does not fall within the scope of EU law, with the result that the Charter, in accordance with Article 51(1) thereof, is not applicable.
44) The Spanish Government argues that the request for a preliminary ruling is inadmissible on the ground that it does not clearly identify the provisions of EU law on which the Court is asked to give a preliminary ruling. What is more, the police request at issue in the main proceedings does not concern the interception of communications made by means of the SIM cards activated with the IMEI code of the stolen mobile telephone, but rather the establishment of a link between the cards and their owners, in such a way that the confidentiality of the communications is not affected. Article 7 of the Charter, referred to in the questions referred for a preliminary ruling, is therefore irrelevant to the present case.
46) In the present case, the order for reference contains sufficient factual and legal information required both for the definition of the provisions of EU law referred to in the questions referred for a preliminary ruling and for the understanding of the scope of those questions. More specifically, it is apparent from the order for reference that the questions referred for a preliminary ruling are intended to enable the referring court to assess whether, and to what extent, the national legislation, on which the police request at issue in the main proceedings is based, pursues an objective which is capable of justifying infringement of the fundamental rights enshrined in Articles 7 and 8 of the Charter. According to the statements of the referring court, that national legislation falls within the scope of Directive 2002/58, with the result that the Charter is applicable to the case in the main proceedings. The questions referred for a preliminary ruling are thus directly related to the subject matter of the main proceedings and cannot therefore be regarded as hypothetical.
48) By its two questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 15(1) of Directive 2002/58, read in the light of Articles 7 and 8 of the Charter, must be interpreted as meaning that public authorities’ access to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as the surnames, forenames and, if need be, addresses of the owners of the SIM cards, entails interference with their fundamental rights, enshrined in those articles of the Charter, which is sufficiently serious to entail that access being limited, in the area of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime and, if so, by reference to which criteria the seriousness of the offence at issue must be assessed.
49) In that regard, it is apparent from the order for reference that, as observed in essence by the Advocate General in point 38 of his Opinion, the request for a preliminary ruling does not seek to determine whether the personal data at issue in the main proceedings have been retained by providers of electronic communications services in a manner consistent with the requirements laid down in Article 15(1) of Directive 2002/58, read in the light of Articles 7 and 8 of the Charter. As stated in paragraph 46 of this judgment, the request concerns only whether, and to what extent, the objective pursued by the legislation at issue in the main proceedings is capable of justifying the access of public authorities, such as the police, to such data, without the other conditions for access deriving from Article 15(1) forming part of the subject matter of the request.
50) More specifically, the referring court is uncertain as to the factors that should be taken into consideration in order to assess whether the offences in respect of which the police may be authorised, for the purposes of an investigation, to have access to personal data retained by providers of electronic communications services are sufficiently serious to warrant the interference entailed by such access with the fundamental rights enshrined in Articles 7 and 8 of the Charter, as interpreted by the Court in its judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238), and in Tele2 Sverige and Watson and Others.
51) As to the existence of an interference with those fundamental rights, it should be borne in mind, as observed by the Advocate General in points 76 and 77 of his Opinion, that the access of public authorities to such data constitutes an interference with the fundamental right to respect for private life, enshrined in Article 7 of the Charter, even in the absence of circumstances which would allow that interference to be defined as ‘serious’, without it being relevant that the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way. Such access also constitutes interference with the fundamental right to the protection of personal data guaranteed in Article 8 of the Charter, as it constitutes processing of personal data (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, points 124 and 126 and the case-law cited).
58) It should therefore, first of all, be determined whether, in the present case, in the light of the facts of the case, the interference with fundamental rights enshrined in Articles 7 and 8 of the Charter that police access to the data in question in the main proceedings would entail must be regarded as ‘serious’.
63) In the light of the foregoing considerations, the answer to the questions referred is that Article 15(1) of Directive 2002/58, read in the light of Articles 7 and 8 of the Charter, must be interpreted as meaning that the access of public authorities to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as the surnames, forenames and, if need be, addresses of the owners, entails interference with their fundamental rights, enshrined in those articles of the Charter, which is not sufficiently serious to entail that access being limited, in the area of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime.
64) Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
