Access for criminal purposes to a set of electronic communications data allowing precise conclusions to be drawn about privacy is allowed only to combat serious crime or prevent serious threats to public security, the Court of Justice of the European Union ruled on Tuesday 2 March (Case C-746/18).
The Estonian national HK has lodged an appeal in cassation against the sentence of two years’ imprisonment imposed on her as a result of criminal proceedings brought against her for theft, use of a third party’s bank card and violence.
The Estonian Supreme Court has doubts as to the compatibility with the ePrivacy Directive (2002/58) of the conditions under which investigative services had access to personal data concerning HK.
Relying on European case law (Cases C-511, 512 & 520/18), the Court recalls that the ePrivacy Directive allows a Member State to legislate to limit the confidentiality of communications and traffic data only through provisions complying with the principle of proportionality and the fundamental rights guaranteed by the European Charter of Fundamental Rights (Articles 7, 8, 11 and 52).
Providers of electronic communications services can therefore not be obliged, as a precautionary measure, to retain traffic and location data in a generalised and undifferentiated manner.
Nevertheless, the Court points out, access by public authorities to data enabling conclusions to be drawn about a person’s private life is possible in the context of procedures aimed at combating serious crime or preventing serious threats to public security. Other factors relating to the proportionality of a request for access (length of the access period, quantity and nature of the data collected) do not affect access being granted.
Furthermore, the Court is of the opinion that it cannot be up to a public prosecutor to authorise access by a public authority to the data in question, as in the present case.
Binding national regulations that determine the conditions of access to data must be clear, precise and conditioned, so that authorised interference is limited to the strict minimum. They must provide for a prior review of the reasoned request of an authority, either by a court or by a genuinely independent administrative body.
Moreover, in the context of a criminal investigation, preliminary checking should strike a fair balance between the interests associated with the needs of the investigation and the fundamental rights to respect for private life and protection of personal data.
See the judgment of the Court: https://bit.ly/2OiO27j (Original version in French by Mathieu Bion)