CJEU on Dawn Raids: Business Email Seizure and the Corporate/personal Divide

The Court of Justice of the European Union (CJEU) has clarified the extent to which competition authorities may access and seize business emails found on company premises during unannounced inspections without prior judicial authorisation. The distinction the Court draws is between corporate communications, which enforcement agencies may in principle seize and examine on-site, and devices or accounts belonging to individuals, which attract stronger procedural protection. For in-house counsel, compliance officers and corporate security teams across the European Union, this line of case law demands a review of dawn-raid protocols, bring-your-own-device (BYOD) policies and staff training. This article summarises the legal position, explains the reasoning under the Charter of Fundamental Rights, and sets out a practical playbook for readiness.

Who this is for: competition lawyers, in-house counsel, compliance officers and corporate security teams across EU Member States. Purpose: a concise, authoritative summary of the evolving CJEU case law on email seizure during dawn raids and an actionable protocol to update policies and training.

Executive Summary, The Corporate/Personal Distinction

The essential position that emerges from the CJEU’s case law can be stated in two lines. First, national competition authorities may, in principle, seize and examine business emails discovered on company premises during unannounced inspections without obtaining separate prior judicial authorisation for each such measure, provided the inspection is itself lawfully mandated and the measure remains proportionate. Second, where authorities seek to access devices or email accounts owned by individuals, an employee’s personal phone or private webmail account, for instance, a higher standard applies, with the CJEU indicating that prior authorisation by a court or an independent authority is required before the content of such personal devices is examined.

This distinction is the operational fulcrum of dawn-raid preparedness. The seizure of corporate communications sits within the ordinary inspection powers of competition authorities, subject to the safeguards of proportionality and the framework of the EU Charter of Fundamental Rights. The practical effect is that companies should not assume the seizure of any electronic material triggers an identical judicial gatekeeping step; the intensity of protection depends on whether the material engages the personal sphere of an individual or the corporate estate.

For businesses, the case law is both a warning and an opportunity. It raises the stakes on unannounced inspections involving business emails, but it also gives compliance teams a clear framework around which to organise their response. The critical task is to establish, before any inspection begins, which devices and accounts are corporate and which are personal, because that classification helps determine the applicable legal threshold.

The Underlying Litigation and Procedural Context

The relevant references arose from unannounced inspections carried out in the context of national competition investigations. During those inspections, the authority accessed and seized electronic communications, including business emails, held on corporate systems and devices located at the premises of the undertakings concerned. The undertakings challenged the seizure, arguing that accessing and copying email content without prior authorisation from a judicial body infringed their fundamental rights to respect for private life and communications and to the protection of personal data.

The dispute turned on a recurring tension in competition enforcement: the breadth of inspection powers granted to authorities to detect and prove infringements, set against the procedural protections that constrain intrusions into private and personal spheres. Referring national courts sought guidance from the Court of Justice on whether the seizure of business emails during an unannounced inspection required prior judicial authorisation, and on how the Charter of Fundamental Rights conditions the exercise of those powers.

The references gave the Court the opportunity to clarify the point across related matters, ensuring a consistent answer. The issue became a reference point precisely because the underlying practice, on-site seizure of electronic correspondence during dawn raids, is common across the European Competition Network and directly affects how undertakings and their advisers respond when investigators arrive unannounced.

How the Cases Reached the CJEU

Following contested inspections and domestic challenges to the seizure of electronic material, national courts referred questions to the Court of Justice under the preliminary reference procedure. Advocate General Medina delivered an opinion analysing the compatibility of on-site email seizure with the Charter, and the Court then issued its ruling. Practitioners should consult the official text on Curia for the precise paragraph reasoning and the exact case references, as the operative distinctions the Court draws are best understood by reference to the judgment’s own wording.

Legal Analysis, Articles 7 and 8 of the EU Charter

The heart of the analysis is the interplay between the powers of competition authorities and two provisions of the Charter of Fundamental Rights of the European Union: Article 7, which guarantees respect for private and family life, home and communications, and Article 8, which protects personal data. The power to seize business emails is not a licence to disregard those rights; rather, the Court situates any seizure within a proportionality framework in which the character of the material and the setting of the inspection are decisive.

The reasoning proceeds from the recognition that business correspondence generated and held within an undertaking forms part of the professional activity of that undertaking. When such correspondence is located on company premises and on corporate systems, its examination during a lawfully mandated inspection can be a proportionate exercise of enforcement powers, without necessarily requiring a further, separate prior judicial authorisation step for each item. The safeguards that constrain the measure are the requirements of proportionality, necessity and the availability of effective ex-post judicial review.

By contrast, where the material sought engages the personal sphere of an individual, their own device or their private account, the intensity of the interference with private life is greater, and the CJEU treats prior authorisation by a court or an independent authority as the appropriate safeguard. This is the pivotal doctrinal move that companies must translate into practice.

Role of Article 7 (Respect for Private Life)

Article 7 protects the confidentiality of communications and private life. Seizing emails interferes with this right, but the degree of interference is distinguished according to whether the communications belong to the professional or the personal sphere. For corporate correspondence held on company systems, the interference is justified by the objective of effective competition enforcement and constrained by proportionality. For communications tied to an individual’s private life on a personal device, the higher level of protection under Article 7 supports the requirement of prior authorisation for searches of that content.

Role of Article 8 (Protection of Personal Data)

Article 8 guarantees the protection of personal data and requires that processing be carried out fairly, for specified purposes, and on a legitimate basis. Seized emails frequently contain personal data of employees and third parties. The case law does not neutralise Article 8; authorities must handle seized material consistently with data-protection principles, in particular by limiting the scope of what is examined to what is relevant to the investigation. This reinforces the practical importance of proportionality when authorities examine corporate mailboxes that inevitably contain personal information.

Advocate General Medina, The Opinion

Advocate General Medina’s opinion analysed the tension between enforcement powers and Charter protections. In broad terms, the opinion supported the view that the corporate character of material and the on-premises context can justify on-site seizure without a separate prior judicial authorisation, while the personal sphere warrants stronger procedural safeguards. In the Portuguese context, the opinion also considered whether authorisation by the Public Prosecutor could suffice for seizing and searching emails during a dawn raid. Practitioners should read the AG opinion alongside the judgment, as opinions often develop the underlying legal architecture and proportionality analysis in more detail than the Court’s operative reasoning. The exact paragraphs should be verified against the text on Curia.

Corporate vs Personal Devices, The Line the Court Drew

The most consequential practical output of the case law is the distinction between corporate and personal devices and accounts. Because authorities may seize corporate emails within the ordinary scope of a lawful inspection while facing a higher authorisation threshold for personal devices, the classification exercise is now central to how a company manages an inspection in real time. Getting this right, and being able to demonstrate it quickly, can determine whether particular material is examined immediately or held pending appropriate authorisation.

The classification is fact-sensitive and turns on objective indicators of ownership, control and use. In practice, the cleaner and more documented the separation between corporate and personal, the easier it is to assert the correct threshold when investigators are on-site.

Indicators a Device or Email is Corporate

• Ownership. The device is owned or leased by the company and recorded on the asset register.
• Domain and account. The email account uses the corporate domain and is provisioned and administered by the company.
• IT and MDM control. The device is enrolled in the company’s mobile device management (MDM) system and subject to corporate security policy.
• Employer-funded connectivity. The SIM or data plan is paid for by the employer.
• Contractual allocation. The employment contract or IT policy assigns the device and account to the employee for work use.

Indicators a Device or Email is Personal

• Individual ownership. The device belongs to the employee and is not on the company asset register.
• Personal accounts. The email is a private webmail account on a non-corporate domain.
• Absence of admin control. The company has no administrative rights, MDM enrolment or remote-management capability over the device.
• Private apps and content. The device is dominated by personal applications, messaging and content unrelated to work.

Mixed-Use Devices, Evidential Approach

The most difficult category is the mixed-use device: an employee-owned phone used to access a corporate email account, or a company laptop containing significant personal material. Here the classification is not binary, and companies should be cautious. Where a device is genuinely owned by the individual, the safer position is to assert personal ownership and request prior authorisation before content is accessed, while offering to make the corporate account or corporate data available through the managed corporate environment. Segregation architecture, containerisation of corporate data on personal devices, makes this far easier to argue in the heat of an inspection.

Until the classification is resolved, the objective should be to limit access to the minimum consistent with the authority’s lawful powers and to document every step.

Comparison: Corporate Device vs Personal Device, Seizure and Authorisation Consequences

The table is a working guide, not a substitute for legal advice. Mixed-use scenarios in particular demand a cautious, documented approach, because the classification may be contested and the consequences of getting it wrong, either obstructing a lawful inspection or permitting an unlawful intrusion, are significant. Procedural detail varies considerably between Member States.

Practical Checklist for Dawn-Raid Readiness, A Playbook for In-House Teams

Given the scope for on-site seizure of corporate correspondence, the value of a rehearsed protocol has increased. The following playbook sets out what should happen from the moment investigators arrive. It should be adapted to the company’s structure and to local procedural rules in each Member State where the business operates.

First 30 Minutes: Who Does What

• Reception protocol. Front-desk and security staff should have written instructions to welcome inspectors courteously, verify their identity and inspection mandate, and immediately alert the designated response team.
• Notify legal counsel. Contact in-house legal and external competition counsel at once. Sample internal notification: “Competition authority inspection in progress at [site]. Response team activated. Do not delete, move or alter any documents or data. External counsel notified and en route.”
• Staff instructions. Issue a short, calm all-staff message: “Investigators are conducting a lawful inspection. Do not obstruct them. Do not delete, forward or discuss any documents or emails. Direct all questions to the response team. Continue normal duties unless instructed otherwise.”
• Record everything. Assign a note-taker to log times, names, rooms entered, devices examined and material copied.
• Shadowing. Ensure a company representative accompanies each inspector throughout.

IT and E-Discovery Steps

• Suspend automatic deletion. Immediately halt routine document destruction and email auto-purge across relevant systems.
• Support corporate systems. Provide IT assistance for access to corporate mailboxes and servers, which generally fall within the scope of a lawful on-site inspection.
• Device classification on-site. Rapidly identify which devices are corporate and which are personal, using the asset register and MDM records. Sample confirmation wording for corporate devices: “The company confirms that device [ID] and account [address] are company-owned and provisioned for work use, and will assist with access to the corporate environment.”
• Hold personal devices apart. Where a device is employee-owned, do not volunteer access; assert personal ownership and request prior authorisation. Sample wording to the authority: “We consider device [ID] to be the personal property of an individual. We respectfully request confirmation of the applicable prior authorisation before its content is accessed, and reserve all rights.”

Handling Privileged Material

Legal professional privilege must be actively protected during any seizure. The response team should identify potentially privileged communications, flag them to inspectors, and object to their examination or copying. Where privileged and non-privileged material is intermingled, for example in a mailbox, the company should request that disputed items be sealed pending resolution rather than examined on the spot. Every privilege assertion should be documented contemporaneously. Guidance from recognised bar associations, such as the Law Society of England and Wales, provides useful templates for asserting and preserving privilege during inspections.

Post-Raid Actions and Follow-Up

• Reconcile the inventory. Obtain and check the authority’s record of everything seized or copied against the company’s own log.
• Preserve the audit trail. Retain all contemporaneous notes, correspondence and consent or refusal records.
• Assess challenge options. Review with counsel whether any aspect of the seizure, scope, proportionality, privilege or personal-device access, provides grounds for review.
• Debrief and update. Conduct a lessons-learned session and revise the protocol accordingly.

BYOD Policies, Risk Mitigation and Sample Clauses

BYOD arrangements are among the highest-risk areas for undertakings. When employees use personal devices for work, the boundary between corporate and personal blurs precisely at the point where classification is decisive. Because corporate emails may be seized on-site while personal devices attract a higher authorisation threshold, ambiguous mixed-use devices create uncertainty and dispute at the worst possible moment. Reducing that ambiguity in advance is the single most effective mitigation.

Sample BYOD Policy Clauses

• Corporate account requirement. “All work-related email and messaging must be conducted through company-provided accounts and applications. Use of personal accounts for company business is prohibited.”
• Containerisation. “Company data on personal devices must be held within the approved managed container. The company reserves the right to manage, audit and remotely wipe the corporate container.”
• Consent and audit. “By enrolling a personal device, the employee consents to MDM controls over the corporate container and to audit of corporate data, while retaining ownership of the device and of personal content outside the container.”
• Inspection cooperation. “In the event of a regulatory inspection, employees must cooperate with the company’s response team and must not delete or alter any company data.”

Any BYOD monitoring and processing of employee data must itself comply with the GDPR and applicable national employment and data-protection law; clauses should be reviewed by local counsel before deployment.

Training and Audit Steps

Policy alone is insufficient. Companies should train staff on the corporate-only rule for work communications, run periodic audits of BYOD enrolment and container usage, and rehearse the dawn-raid protocol so that classification decisions can be made confidently under pressure. HR and IT should coordinate to ensure leavers’ devices are de-provisioned and that the asset register is accurate at all times.

Cross-Border Investigations and Cooperation Implications

Many competition investigations are coordinated across borders through the European Competition Network, and this case law has practical consequences for that cooperation. Where corporate correspondence is seized in one Member State, the results may feed into coordinated action or be shared with counterpart authorities, subject to the applicable procedural and data-protection safeguards. The European Commission’s guidance on inspections sets out the framework for cooperation and mutual assistance among enforcers.

Data Location and Cross-Border Seizure Considerations

A recurring complication is that corporate email is frequently stored in cloud infrastructure located outside the Member State conducting the inspection. Companies should map where their corporate data resides, understand which entity controls access, and be ready to explain the architecture to inspectors. The location of data does not necessarily remove it from the reach of an on-site inspection where it is accessible from the premises, but it can raise cross-border and data-transfer questions that counsel should be prepared to address quickly. The OECD’s work on competition enforcement provides broader context on international cooperation and best practice.

Litigation Risk and Judicial Review, Likely Avenues and Remedies

This case law does not eliminate the scope for challenge; it reshapes it. Where a separate prior judicial authorisation is not the gateway for corporate email seizure, the focus of any challenge shifts to the exercise of the power itself and to the protection of the personal and privileged spheres.

Remedies and Interim Measures

Undertakings may seek review of an inspection on grounds including disproportionality, procedural irregularity, breach of legal professional privilege, and unlawful access to personal devices or accounts without the required authorisation. Depending on national procedure, remedies may include the exclusion of improperly obtained evidence, the return or destruction of unlawfully seized material, and, where available, interim measures to preserve the position pending determination. The availability and mechanics of these remedies vary by Member State, so local procedural advice is essential.

Best Defence Arguments

The strongest defensive positions are typically built on proportionality, arguing that the scope of examination exceeded what was necessary, and on the corporate/personal boundary, arguing that personal material was accessed without the required authorisation. Contemporaneous documentation of classification, privilege assertions and objections made during the inspection is what gives these arguments traction. This is why the in-raid discipline described above matters so much: the record created on the day frequently determines the strength of any subsequent challenge.

Practical Templates and Next Steps

To operationalise this guidance, companies should assemble a ready-to-use toolkit: a dawn-raid response checklist, a device-classification flowchart, sample BYOD policy clauses, a staff notice template, and a sample letter to the authority regarding personal devices. Undertakings that operate across several Member States should also commission a bespoke audit to reflect national procedural differences.

Conclusion and Recommended Immediate Actions

The CJEU’s treatment of business email seizure marks a significant clarification in dawn-raid law, tempered by the continuing protection of personal devices through a higher authorisation threshold. The companies that fare best will be those that have classified their devices, tightened their BYOD arrangements and rehearsed their response before investigators ever arrive. Legal and compliance teams should consider taking the following steps promptly:

1. Circulate an updated dawn-raid protocol reflecting the corporate/personal distinction.
2. Audit and document which devices and accounts are corporate and which are personal.
3. Review and strengthen BYOD policies, mandating corporate accounts for all work communications.
4. Deploy or verify MDM and containerisation on personal devices used for work.
5. Prepare template notices and letters for use during an inspection.
6. Train the response team and key staff on privilege protection and personal-device handling.
7. Map corporate data locations, including cloud storage outside the Member State.

Sources

1. Court of Justice of the European Union, Curia case-law database (verify current case references and judgment text)
2. Court of Justice of the European Union, Advocate General opinion (Medina)
3. EUR-Lex, Charter of Fundamental Rights of the European Union (Articles 7 and 8)
4. European Commission, Competition: Inspections (dawn raids)
5. Autoridade da Concorrência (Portugal)
6. Law Society of England and Wales
7. OECD, Competition policy and enforcement resources