The Court of Justice of the European Union ruled (aff. C-548/21,) on Friday 4 October, that the fight against serious crime was not the only reason that could justify police access to data contained in a mobile phone. However, such access must be proportionate to the seriousness of the criminal offence, regulated by law and, except in duly justified emergencies, authorised in advance by a court or an independent administrative authority, say the judges.
The Court was responding to an Austrian court action brought by the recipient of a parcel containing narcotics, whose telephone had been seized by the police, without the authorisation from the Public Prosecutor’s Office or a court, who had tried in vain to unlock it without his knowledge in order to access the data it contained. The Austrian judges asked the Court about the compatibility of the national legislation - which, in their view, allows the police to act in this way even in the case of a relatively minor offence - with Directive (EU) 2016/680 (protection of individuals with regard to the processing of personal data by the competent authorities for the purpose of the prevention, detection, investigation and prosecution of criminal offences and the free movement of such data).
In its judgment, the Court first points out that the directive in question also applies in the event of an unsuccessful attempt to access data contained in a mobile phone and that such access may constitute a serious interference with the private life of the person concerned. It must therefore be justified by the seriousness of the offence and proportionate to it. However, says the Court, limiting this possibility of access to personal data solely to the fight against serious crime would unduly restrict the investigative powers of the competent authorities. The national legislature must, however, define with sufficient precision the factors to be taken into account, in particular the nature or categories of offences concerned. Finally, except in cases of urgency, access to data must be authorised by a court or an independent administrative authority, which must ensure a fair balance between the needs of the investigation and the protection of the data of the data subject, who must be informed of the reasons for access to his or her data, once the investigation is no longer likely to be jeopardised.
Link to the judgment (in French): https://aeur.eu/f/dq7 (Original version in French by Francesco Gariazzo)