In a judgement delivered on Tuesday 2 October in the ‘Ministerio Fiscal’ case (C-207/16), the Court of Justice of the European Union (CJEU) held that criminal offences that are not particularly serious may justify access to personal data retained by providers of electronic communications services, provided that that access does not constitute a serious infringement of privacy.
In the case in point and in the context of an investigation into the robbery of a wallet and mobile telephone, Spanish police requested the investigating magistrate to grant them access to data identifying the users of telephone numbers activated with the stolen telephone as from the date of the robbery. The investigating magistrate rejected the request on the grounds that the acts giving rise to the criminal investigation did not constitute a ‘serious’ offence.
The decision by the investigating magistrate complied with the case law of the CJEU which, in two judgements in 2014 and 2016 (see EUROPE 11056, 11694), held that the concept of “a serious offence” was necessary for interpreting the legitimacy and proportionality of an interference with the fundamental rights of respect for private life as enshrined in the European Union's Charter of Fundamental Rights.
The Provincial Court of Tarragona in charge of the case, referred the matter to the CJEU for a preliminary ruling.
In its ruling on 2 October, the latter bases its decision on directive 2002/58/EC on privacy and electronic communications. This provides that member states may restrict citizens’ rights when such a restriction constitutes a necessary, appropriate and proportionate measure for the detection and prosecution of criminal offences but does not limit that objective to the fight against “serious crime” alone.
Although the request of the Spanish police constitutes an interference with the rights of respect for private life, the Court rules that that interference is not “serious” insofar as the data collected - surnames, forenames and addresses - “do not allow precise conclusions to be drawn concerning the private lives of the persons whose data is concerned”. The single interpretation of what can be deemed “serious” appears insufficient and the case law of the Court is expected to be clarified in the near future.
The gathering of personal data by the authorities as part of a criminal investigation is now based on two alternative criteria: the seriousness of the offence and an absence of serious interference into private life.
The Court is therefore following the conclusions made by Advocate General Saugmandsgaard Øe (see EUROPE 12014). (Original version in French by Mathieu Solal)