Privacy and prosecution of serious offences: Judgment of the EU Court in Case C-178/22

Privacy and prosecution of serious offences: the court responsible for authorising access to telephone records in order to identify the perpetrators of an offence, and for the prosecution of which offence national law envisages such access, must be entitled to refuse or restrict that access

Under Italian law, the offence of aggravated theft is one of the offences that may justify obtaining telephone records from a provider of electronic communications services on the basis of prior authorisation from a court. The Court of Justice considers that access to such records can be granted only to the data of individuals suspected of being implicated in a serious offence, and it specifies that it is for the Member States to define ‘serious offences’.

However, the court responsible for authorising that access must be entitled to refuse or restrict that access where it finds that the interference with the fundamental rights to private life and to the protection of personal data which such access would constitute is serious, while it is clear that the offence at issue is not a serious offence in the light of the societal conditions prevailing in the Member State concerned.

In the context of a criminal investigation concerning the aggravated theft of two mobile telephones, the Public Prosecutor’s Office of Bolzano (Italy) requests from the Italian court authorisation to obtain from all the telephone companies the telephone records of the stolen telephones in order to be able to identify the perpetrators of the theft. The Italian court is uncertain whether the Italian law, on which that request is based, is compatible with the EU ‘Privacy and Electronic Communications’ Directive 1, on the grounds that that national law covers the prosecution of offences, causing a limited social disturbance, not justifying serious interference with the fundamental rights to private life and to the protection of personal data, and that the Italian courts have no margin of discretion as to the actual seriousness of the offence concerned.

In its judgment, the Court holds that the interference with those fundamental rights caused by access to telephone records is likely to be classified as serious, and it confirms that such access can be granted only to the data of individuals suspected of being implicated in a serious offence. The Court clarifies that it is for the Member States to define ‘serious offences’ for the purposes of applying the directive in question. Indeed, criminal legislation falls within the competence of the Member States in so far as the European Union has not legislated in that field.

However, the Member States cannot distort that concept of ‘serious offences’ and, by extension, the concept of ‘serious crime’, by including within it offences which are manifestly not serious offences, in the light of the societal conditions prevailing in the Member State concerned, even though the legislature of that Member State has provided for such offences to be punishable by a maximum term of imprisonment of at least three years. The Court states, in that connection, that a minimum period fixed by reference to such a term of imprisonment does not appear, in that regard, to be excessively low. Moreover, setting a minimum period above which the term of imprisonment for an offence justifies the classification of that offence as a serious offence is not necessarily contrary to the principle of proportionality.

In order to ascertain, in particular, that there is no distortion of the concept of ‘serious crime’, it is nonetheless essential that, where access to retained data carries the risk of a serious interference with the fundamental rights of the person concerned, that access be subject to a prior review carried out either by a court or by an independent administrative body.

Furthermore, the court or independent administrative body which carries out that prior review must be entitled to refuse or restrict that access where it finds that the interference with fundamental rights is serious, while it is clear that the offence at issue does not actually constitute serious crime in the light of the societal conditions prevailing in the Member State concerned. Indeed, it must be able to strike a fair balance between the needs of the investigation and the fundamental rights to privacy and protection of personal data.

NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of EU law or the validity of an EU act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.

Unofficial document for media use, not binding on the Court of Justice.

The full text and, as the case may be, an abstract of the judgment is published on the CURIA website on the day of delivery.

1 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).