The ruling of the European Court of Justice on September 7, 2023 in Case C-162/22 examines the issue, proposed by the Supreme Administrative Court of Lithuania, of balancing the opposing interests represented by the right to confidentiality of communications, protected by the Charter of Fundamental Rights of the European Union, and the legitimacy of the limitation of this right in the event of serious offenses, as governed by Directive 2002/58 on privacy and electronic communications.

The importance of the decision.

The intervention is relevant as it is the first ruling of the Court on the impact of the use of traffic and location data of mobile communication equipment on the interference in fundamental rights.

The issue discussed by the Court.

The issue analyzed by the Court concerned, in particular, the legitimacy of the secondary use of such personal data – properly stored by providers of electronic communications and originally made available to the competent authorities for the purpose of combating serious crime – in an administrative investigation into corruption-related misconduct in office carried out by a public prosecutor, who was therefore removed from office.

Which personal data relating to electronic communications may be preserved and made available to judicial authorities.

The data relating to electronic communications expressly considered by European law and jurisprudence are traffic data, i.e., those necessary to find and identify the origin of a communication, to determine the destination of a communication, to determine the date, time, and duration of a communication, and those relating to the location of mobile communication equipment.

Now, not all data relating to electronic communications can be retained. In fact, the Court made it clear that legislative measures that provide for the general and indiscriminate retention of traffic and location data as a preventive measure for purposes of combating serious crime and preventing serious threats to public security are prohibited.

The cases that legitimize the retention and use of data for purposes of combating serious crime and preventing serious threats to public security were specified by the Court, which clarified that are legitimate: – legislative measures that provide for targeted retention of such data for a period that is limited in time to what is strictly necessary; – the general retention of IP addresses assigned to the source of an internet connection for a period that is limited in time to what is strictly necessary; –  the general retention of data relating to the civil identity of users of electronic communications systems.

The reason for the exception to the obligation to guarantee the confidentiality of personal data.

Member states are allowed to introduce exceptions to the obligation to guarantee the confidentiality of personal data because of objectives that are suitable to justify a limitation of rights: these objectives are peremptory; there is a hierarchy among them according to their respective importance; the importance of them must be related to the seriousness of the resulting interference, according to the principle of proportionality.

In particular, the objective of safeguarding national security is apt to justify measures involving interference in fundamental rights; on the other hand, with regard to the objective of preventing, investigating, detecting and prosecuting crimes, only the fight against serious crime and the prevention of serious threats to public security are capable of justifying serious interference with fundamental rights.

The Court’s decision.

In the case under consideration, the Luxembourg Court decided that traffic and location data on mobile communication equipment, retained by providers of electronic communication services and made available to the competent authorities for the purpose of combating serious crime, cannot be earmarked and used for subsequent use in order to achieve objectives – such as in the present case the administrative investigation into corruption-related misconduct in office – that are of lesser importance in the hierarchy of general interest objectives.

Thus, electronic communications data cannot be used in administrative proceedings concerning disciplinary offenses or unlawful misconduct in office e.g. corruption-related ones.