Provisional text
OPINION OF ADVOCATE GENERAL
COLLINS
delivered on 8 June 2023(1)
Case C‑178/22
Unknown individuals
joined party:
Procura della Repubblica presso il Tribunale di Bolzano
(Request for a preliminary ruling from the Tribunale di Bolzano (District Court, Bolzano, Italy))
(Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Confidentiality of communications – Providers of electronic communications services – Directive 2002/58/EC – Article 1(3) and Article 15(1) – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 11 and Article 52(1) – Request by a public prosecutor for access to data for the investigation and prosecution of aggravated theft of a mobile telephone – Definition of ‘serious crime’ capable of justifying serious interference with fundamental rights – Scope of prior review to ensure compliance with the requirement of the commission of a serious crime – Principle of proportionality)
I. Introduction
1. The Procura della Repubblica presso il Tribunale di Bolzano (Public Prosecutor’s Office at the District Court, Bolzano, Italy) (‘the Public Prosecutor (Bolzano)’) requests the Tribunale di Bolzano (District Court, Bolzano, Italy) to authorise access to data retained by providers of electronic communications services pursuant to national law that make it possible, inter alia, to trace and identify the source and destination of communications from mobile telephones.
2. In the context of that request the Tribunale di Bolzano (District Court, Bolzano) asks the Court of Justice to interpret Article 15(1) of Directive 2002/58/EC. (2) That provision enables the Member States to introduce legislative exceptions to the obligation, laid down in that directive, (3) to ensure the confidentiality of electronic communications. In the judgment in Prokuratuur, (4) the Court held that access to data that enables precise conclusions to be drawn concerning a user’s private life, pursuant to measures adopted under Article 15(1) of Directive 2002/58, constitutes a serious interference with the fundamental rights and principles enshrined in Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’). (5) Such access may not be authorised for the purposes of the prevention, investigation, detection and prosecution of ‘criminal offences in general’. It may be granted only in procedures and proceedings to combat ‘serious crime’ (6) and must be the subject of a prior review by a court or independent administrative body in order to ensure compliance with that requirement. (7) The Tribunale di Bolzano (District Court, Bolzano) asks the Court to clarify two aspects of the judgment in Prokuratuur: the concept of ‘serious crime’ and the scope of the prior review that a court must carry out under a provision of national law that requires it to authorise access to data retained by providers of electronic communications services.
II. Legal framework
A. European Union law
3. Article 5 of Directive 2002/58, entitled ‘Confidentiality of the communications’, provides:
‘1. Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so in accordance with Article 15(1). …
…’
4. Article 6 of Directive 2002/58, entitled ‘Traffic data’, states:
‘1. Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).
…
5. Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiries, fraud detection, marketing electronic communications services or providing a value added service, and must be restricted to what is necessary for the purposes of such activities.
…’
5. Article 9 of Directive 2002/58, entitled ‘Location data other than traffic data’, provides:
‘1. Where location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communications services, can be processed, such data may only be processed when they are made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service. The service provider must inform the users or subscribers, prior to obtaining their consent, of the type of location data other than traffic data which will be processed, of the purposes and duration of the processing and whether the data will be transmitted to a third party for the purpose of providing the value added service. Users or subscribers shall be given the possibility to withdraw their consent for the processing of location data other than traffic data at any time.
…’
6. Article 15(1) of Directive 2002/58 is in the terms following:
‘Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC (8). To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.’
B. National law
7. Article 132(3) of decreto legislativo 30 giugno 2003, n. 196 – Codice in materia di protezione dei dati personali (Legislative Decree No 196, establishing the Personal Data Protection Code) of 30 June 2003, (9) as recently amended by Article 1 of decreto-legge 30 settembre 2021 n. 132 – Misure urgenti in materia di giustizia e di difesa, nonché proroghe in tema di referendum, assegno temporaneo e IRAP, convertito con modificazioni nella legge 23 novembre 2021 n. 178 (Decree-Law No 132 of 30 September 2021, (10) converted, with amendments, into Law No 178 of 23 November 2021) (11) (‘Article 132(3) of Legislative Decree No 196/2003’) provides:
‘3. Within the retention period laid down by law [that is, 24 months from the date of the communication], if there is sufficient evidence of the commission of an offence for which the law prescribes the penalty of life imprisonment or a maximum term of imprisonment of at least 3 years, determined in accordance with Article 4 of the Codice di procedura penale [(Code of Criminal Procedure)], or of an offence of threatening and harassing or disturbing persons by means of the telephone, where the threat or disturbance is serious, the data are, if relevant to establishing the facts, acquired with the prior authorisation of the court, by way of reasoned order, at the request of the Public Prosecutor or upon an application by the legal representative of the accused, of the person under investigation, of the injured party or of any other private party;
…
3c. No use may be made of data acquired in breach of the provisions of paragraph 3 or paragraph 3a.’
8. Under Article 4 of the Code of Criminal Procedure, entitled ‘Rules for determining competence’:
‘The court’s competence shall be determined by considering the penalty imposed by the law for each completed or attempted offence. Continuing offences, recidivism and the circumstances in which the offence is committed shall not be considered, except for aggravating circumstances for which the law sets a type of penalty other than the ordinary penalty for the offence and those having special effect.’
9. According to the referring court, the Public Prosecutor may prosecute the offence of aggravated theft ex officio. (12) Under Article 625 of the Codice penale (Criminal Code), a person guilty of aggravated theft is liable to a special penalty of a term of imprisonment of two to six years and a fine of between EUR 927 and EUR 1 500. Article 624 of the Criminal Code provides that a person guilty of simple theft, which may be prosecuted on foot of a complaint by the injured party, is liable to a term of imprisonment of between six months and three years and a fine of between EUR 154 and EUR 516.
III. The disputes in the main proceedings and the question referred for a preliminary ruling
10. The Public Prosecutor (Bolzano) brought two sets of criminal proceedings against unknown perpetrators for the aggravated theft of a mobile phone pursuant to Articles 624 and 625 of the Criminal Code. (13) In order to trace the perpetrators, he applied to the referring court pursuant to Article 132(3) of Legislative Decree No 196/2003 for ‘… authorisation to obtain from all telephone companies all the data in their possession, with tracking and localisation methods (in particular, users and possible IMEI codes called/callers, sites visited/reached, times and durations of calls/connections and details of the cells and/or towers concerned, users and IMEIs of senders/receivers of SMS and MMS and, where possible, details of the holders concerned) of incoming and outgoing telephone conversations/communications and connections made, including under roaming and including those not billed (unanswered calls) from the date of the theft to the date the request is processed’.
11. The referring court doubts whether Article 132(3) of Legislative Decree No 196/2003 is compatible with Article 15(1) of Directive 2002/58 as interpreted in the judgment in Prokuratuur. It observes that, on 7 September 2021, the Corte suprema di cassazione (Supreme Court of Cassation, Italy) (14) held that since national courts enjoy a margin of discretion in determining what offences constitute ‘serious threats to national security and serious crime’, the judgment in Prokuratuur was not directly applicable by national courts. In the wake of the judgment of the Corte suprema di cassazione (Supreme Court of Cassation), the Italian legislature adopted Decree-Law No 132 of 30 September 2021, Article 132(3) of which classifies serious criminal offences for the purposes of obtaining telephone records as, inter alia, offences punishable by law for ‘a maximum term of imprisonment of at least three years …’.
12. According to the referring court, the threshold for the classification of serious criminal offences under Article 132(3) of Legislative Decree No 196/2003 brings within its ambit offences that cause limited social disturbance and which may be prosecuted only pursuant to a complaint by an individual. (15) Access to telephone records may thus be obtained pursuant to that provision for the theft of an item of minimal value, such as a mobile telephone or a bicycle. The threshold laid down in Article 132(3) of Legislative Decree No 196/2003 accordingly fails to respect the principle of proportionality in accordance with Article 52(1) of the Charter, which requires that, in every case, the seriousness of the offence under investigation must be weighed against a limitation of the enjoyment of a fundamental right. The prosecution of such minor offences does not justify placing limits on the enjoyment of the fundamental rights to respect for private life, the protection of personal data and freedom of expression and information. (16)
13. The referring court explains that Italian courts have a very limited margin of discretion to refuse to authorise access to telephone records, since authorisation must be granted where there is ‘sufficient evidence of the commission of an offence’ and such authorisation is ‘relevant to establishing [the facts]’. The courts have, in particular, no jurisdiction to evaluate the seriousness of the offence under investigation. The legislature carried out that assessment when it provided, in general terms and without differentiating between various types of offences, that access to telephone records must be granted in respect, inter alia, of the investigation of all offences punishable by a maximum term of imprisonment of at least three years.
14. In those circumstances, the Tribunale di Bolzano (District Court, Bolzano) decided to stay the proceedings and to refer the following question to the Court for a preliminary ruling:
‘Does Article 15(1) of [Directive 2002/58] preclude a provision of national law such as that contained in [Article 132(3) of Legislative Decree No 196/2003] which provides:
“Within the retention period laid down by law, if there is sufficient evidence of the commission of an offence for which the law prescribes the penalty of life imprisonment or a maximum term of imprisonment of at least three years, determined in accordance with Article 4 of the [Code of Criminal Procedure], or of an offence of threatening and harassing or disturbing persons by means of the telephone, where the threat or disturbance is serious, the data may, if relevant to establishing the facts, be acquired with the prior authorisation of the court, by way of reasoned order, at the request of the Public Prosecutor or upon an application by the legal representative of the accused, of the person under investigation, of the injured party or of any other private party”?’
IV. The procedure before the Court
15. The Czech and Estonian Governments, Ireland, the French, Italian, Cypriot, Hungarian, Netherlands, Austrian and Polish Governments and the European Commission submitted written observations.
16. Those interested parties and the Public Prosecutor (Bolzano) presented oral argument and replied to questions put by the Court at the hearing on 21 March 2023.
V. Assessment
A. Admissibility
17. The Italian Government and Ireland submit that part of the request for a preliminary ruling is inadmissible. According to the facts in the order for reference, the request for access was made in the context of investigations into aggravated thefts of mobile telephones. Ireland emphasises that the Public Prosecutor may prosecute that offence ex officio. That power reflects the view that the nature and effects of the offence affect society generally. The request for a preliminary ruling is thus hypothetical to the extent that it also refers to criminal offences that may be prosecuted only on foot of a complaint by an individual. The Italian Government observes that the referring court refers to a series of offences that are irrelevant to the cases pending before it. The Italian Government and the Commission submit that, contrary to the reference in the request to ‘a maximum term of imprisonment of at least three years’, pursuant to Article 625 of the Criminal Code, the offence of aggravated theft is punishable by a term of imprisonment of two to six years. The Commission therefore proposes that the Court reformulate the question. The French Government also requests the Court to reformulate the question. It considers that while the Court may interpret provisions of EU law, it is not competent to assess the compatibility of provisions of national law with EU law.
18. The referring court’s question literally asks the Court to rule on the compatibility of a provision of national law with EU law. That is, in itself, no obstacle to providing the referring court with an interpretation of EU law, in this instance, Article 15(1) of Directive 2002/58, that will enable it to rule on the compatibility with that provision of any national rule at issue in the proceedings before it. (17)
19. It is clear from the request for a preliminary ruling that the Public Prosecutor (Bolzano) sought access to data, inter alia, to investigate and to prosecute two incidents of the offence of aggravated theft of a mobile telephone pursuant to Article 625 of the Criminal Code. In those circumstances, the references that the request makes to other offences, including Article 624 of the Criminal Code (simple theft), (18) are irrelevant to the determination of the applications pending before the referring court. (19) In so far as the question referred addresses the request from the Public Prosecutor (Bolzano) to access data in order to investigate the commission of offences of aggravated theft, it is not hypothetical. I shall accordingly confine my assessment of the application of Article 132(3) of Legislative Decree No 196/2003 to such facts as the referring court describes that pertain to the aggravated thefts of mobile telephones.
B. Substance
1. Preliminary observations
20. The present reference derives from a request from the Public Prosecutor (Bolzano) to access data retained by providers of electronic communications services. It does not concern the retention of those data or the lawfulness thereof pursuant, inter alia, to Article 15(1) of Directive 2002/58. (20) The data consists of details of incoming and outgoing communications (21) carried out with the stolen mobile telephones and location data. (22) Although the data do not include the contents of communications, they enable precise conclusions to be drawn as to the private lives of the persons whose data are concerned, access to which appears to amount to a ‘serious’ interference with their fundamental rights. (23) The interference that access to such data entails may be justified by the objective, (24) to which the first sentence of Article 15(1) of Directive 2002/58 refers, of preventing, investigating, detecting and prosecuting ‘serious criminal offences’, but not criminal offences in general. In interpreting Article 15(1) of Directive 2002/58, the Court links the seriousness of the interference with a person’s fundamental rights to the seriousness of the criminal offence under investigation. (25)
2. Member States’ competence to define ‘serious criminal offences’
21. Directive 2002/58 regulates the activities of providers of electronic communications services in relation to the processing of personal data. (26) Article 1(3) expressly excludes from the scope of Directive 2002/58 activities of the State in specified fields such as public security, defence, State security and criminal law. The activities to which Article 15(1) of Directive 2002/58 refers overlap substantially with those described in Article 1(3) thereof and include State activities in the field of criminal law that are expressly excluded from the scope of Directive 2002/58. (27) There is thus a clear link between the State activities that Article 1(3) of Directive 2002/58 excludes from the scope of that directive and the legislative measures Member States may adopt pursuant to Article 15(1) thereof. (28)
22. Notwithstanding that clear link, the Court has consistently held that since Article 15(1) of Directive 2002/58 expressly authorises Member States to adopt the national legislative measures described therein, such measures fall within the scope of that directive. It follows from that case-law that the concept of ‘activities’, including the ‘activities of the State in areas of criminal law’ in Article 1(3) of Directive 2002/58, does not include the legislative measures to which Article 15(1) thereof refers. (29)
23. Neither Article 2 of Directive 2002/58, which contains a number of definitions for the purposes of the application of that directive, nor any other provision of Directive 2002/58, including Article 15(1), defines the term ‘criminal offences’. Directive 2002/58 does not contain a list of ‘criminal offences’. (30) Moreover, the case-law interpreting Article 15(1) of Directive 2002/58 does not define that term. (31)
24. Despite the absence of any such definitions, Directive 2002/58 does not provide that each Member State defines ‘criminal offences’ in accordance with its national law. (32) According to the Court’s settled case-law, the need for a uniform application of EU law and the principle of equality require that a provision of EU law that does not refer expressly to the law of the Member States in order to determine its meaning and scope is normally given an independent and uniform interpretation throughout the European Union. In the context of interpreting Article 15(1) of Directive 2002/58, the term ‘criminal offences’ may, at least in principle, be regarded as an autonomous concept of EU law which falls to be interpreted in a uniform manner throughout the Member States. (33)
25. The 10 Member States that submitted observations to the Court and the Commission are, however, of the unanimous view that it is for each Member State to define ‘criminal offences’, including serious offences, to which Article 15(1) of Directive 2002/58 refers by reference to their national laws.
26. I agree with those submissions for the following reasons.
27. First, the Court has previously stated that, in the context of Article 15(1) of Directive 2002/58, it is for the Member States to define their essential security interests and to adopt appropriate measures to ensure their internal and external security. (34) While it did not expressly so hold, the Court thus appears to have taken the view that the term ‘national security’ in Article 15(1) of Directive 2002/58 is not an autonomous concept of EU law despite the absence of a definition of that term or any express reference to the law of the Member States. (35) I see no reason why that same approach ought not to apply to Member States’ powers to define ‘criminal offences’ or ‘serious criminal offences’ for the purposes of Article 15(1) of Directive 2002/58. The terms ‘criminal offences’, ‘public security’ and ‘national security’ in that provision may be considered noscitur a sociis as it appears that the EU legislature intended that each of them be treated in a similar manner, including as regards the manner of their definition.(36)
28. Second, Article 4(2) TEU requires the European Union to respect the national identities of the Member States inherent in their fundamental political and constitutional structures. The preamble to the Charter also acknowledges that, while the Union contributes to the preservation and to the development of common values, it respects, inter alia, the diversity of the cultures and traditions of the peoples of Europe. The definition of criminal offences and penalties (37) reflects national sensitivities and traditions that vary considerably not only as between Member States but also over time in tandem with societal change. (38)
29. It may be observed in that context that, when defining criminal offences and penalties, Member States take a variety of different factors into account to varying degrees. A Member State’s assessment of the ‘seriousness’ of a particular offence is often, if not invariably, reflected in the gravity of the penalty imposed. The length of a custodial sentence may reflect an analysis of a number of factors, including the perceived intrinsic ‘seriousness’ of an offence and its relative ‘seriousness’ as compared to other offences. No reasons have been advanced as to why Member States ought not to exercise that power or, indeed, why a different approach ought to apply to the definition of ‘criminal offences’, ‘serious criminal offences’ or ‘criminal offences in general’ in the particular context under consideration.
30. Member States’ competence in the field of criminal law is without prejudice to that which the European Union enjoys, in certain instances, to establish, for example, minimum rules defining criminal offences and sanctions as regards particularly serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis. (39) The EU legislature did not, however, establish rules governing the definition of criminal offences in Article 15(1) of Directive 2002/58. (40) Indeed, as previously indicated, (41) it is evident from the text of Article 1(3) of Directive 2002/58 that, by enacting that directive, the EU legislature did not intend to exercise any competence in the field of criminal law.
31. Those two reasons suffice to explain why, notwithstanding that national legislative measures adopted pursuant to Article 15(1) of Directive 2002/58 for the investigation and prosecution of criminal offences fall within the scope of that measure, Member States retain the power to define ‘criminal offences’, including ‘serious criminal offences’, and to set penalties for engaging in such conduct. (42)
3. The standard of review of the exercise of the option in Article 15(1) of Directive 2002/58 to derogate from the principle of confidentiality
32. The Court has emphasised that the option to derogate (43) from, inter alia, the principle of confidentiality prescribed in Article 5(1) of Directive 2002/58, must be interpreted strictly in order for it not to become the general rule, thereby rendering the principle meaningless. (44) The exercise of that option must thus respect, inter alia, the principles of equivalence (45) and effectiveness. (46) It must also comply with the general principles of EU law, including the principle of proportionality, (47) and Articles 7, 8 and 11 (48) and Article 52(1) of the Charter. (49) The objective of combating serious crime must always be reconciled with the enjoyment of the fundamental rights thus affected. The rights enshrined in Articles 7, 8 and 11 of the Charter are not absolute and their exercise must be considered in relation to their function in society. (50) Article 52(1) of the Charter thus provides that limitations on the exercise of those rights, as are provided for by law, must respect the essence of those rights and, in compliance with the principle of proportionality, must be necessary and must genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. National legislative measures adopted pursuant to Article 15(1) of Directive 2002/58 must thus correspond genuinely and strictly to one of the objectives outlined in that provision. They must be based on objective criteria, be legally binding and lay down clear and precise rules that indicate the substantive and procedural conditions under which providers of electronic communications services must grant competent national authorities access to data. (51)
33. In order to ensure full respect for those conditions in practice, access by competent national authorities to retained data must, in principle, (52) be subject to prior review by a court or by an independent administrative body (53) following a reasoned request by those authorities and the notification of the persons concerned. (54) It is settled case-law that, in conducting that prior review, a court or independent administrative body must reconcile the various interests and rights at issue in order to strike a fair balance between the requirements of the investigation and the need to safeguard the fundamental rights to privacy and protection of personal data of the persons concerned. (55)
34. In the present case, Article 132(3) of Legislative Decree No 196/2003 establishes the conditions pursuant to which a national court must order providers of electronic communications services to grant the Public Prosecutor access to data at the latter’s request. It is not disputed (56) that Article 132(3) of Legislative Decree No 196/2003 sets out in clear and precise terms the circumstances and the conditions under which a national court can order the providers of electronic communications services to grant such access. The referring court is, however, of the view that the penalty of ‘a maximum term of imprisonment of at least three years’ is excessively broad as it brings within its scope offences such as simple theft that cause little social disturbance.
35. While Article 132(3) of Legislative Decree No 196/2003 potentially covers a wide range of criminal offences, there is nothing before the Court by way of evidence in the present proceedings that it encompasses such a large number of offences as to render access to data thereunder the rule rather than the exception. (57) The threshold of a maximum term of imprisonment of at least three years in that provision does not appear to be excessively low. (58) By way of analogy, Article 3(9) of Directive 2016/681 (59) defines ‘serious crime’ as ‘the offences listed in Annex II that are punishable by a custodial sentence or a detention order for a maximum period of at least three years under the national law of a Member State.’ (60) The Court, however, stated that since Article 3(9) of Directive 2016/681 refers to the maximum penalty applicable rather than the minimum, it cannot be ruled out that the relevant ‘data may be processed for the purposes of combating offences which, although meeting the criterion laid down by that provision relating to the threshold of severity, amount to ordinary crime rather than serious crime, having regard to the particular features of the domestic criminal justice system’. (61)
36. The three-year penalty in Article 132(3) of Legislative Decree No 196/2003 refers to the maximum penalty applicable and could thus apply to offences such as simple theft. (62) It is therefore necessary to examine how Article 132(3) of Legislative Decree No 196/2003 is applied in practice. Subject to verification by the referring court, Article 132(3) of Legislative Decree No 196/2003 appears to establish two different standards of prior review by a national court depending on the nature of the offences under investigation.
37. The first of these standards of review requires (63) national courts to authorise the Public Prosecutor to access data retained by providers of electronic communications services if such data are relevant for the purpose of establishing the facts and there is sufficient evidence of the commission of an offence of threatening and harassing or disturbing persons by means of the telephone, where the threat or disturbance is serious. The national court must therefore carry out an individual assessment of the seriousness of the offence in question and verify whether the investigation and prosecution of that offence merits a limitation of the general rights enshrined in Articles 7, 8 and 11 of the Charter and the specific rights contained in Articles 5, 6 and 9 of Directive 2002/58. That standard requires an individual assessment, in a given case, as to whether the interference with those rights is proportionate, as compared with the public interest objective of combating crime.
38. By contrast, the second standard of review, which is relevant in the context of the present proceedings, requires (64) national courts to authorise the Public Prosecutor to access data retained by providers of electronic communications services if such data are relevant for the purpose of establishing the facts and there is sufficient evidence of the commission of an offence liable to punishment by, inter alia, a maximum term of imprisonment of at least three years. In that case, the role of the national court is limited to verifying whether those objective requirements are met without having any possibility to carry out an individual assessment of the interests in the case at hand. (65) The review the national court carries out pursuant to Article 132(3) of Legislative Decree No 196/2003 is thus detached from any real connection with the specific circumstances of the case before it.
39. While national courts may not have jurisdiction to review the definition, by the legislature, of offences or to review the legislature’s decision as to the seriousness of such offences, (66) those courts must nonetheless have jurisdiction to carry out an individual assessment as to whether the grant of access, pursuant to legislative measures adopted under Article 15(1) of Directive 2002/58, to sensitive data enabling precise conclusions to be drawn concerning a user’s private life – which thus constitutes a serious interference with the fundamental rights enshrined in Articles 7, 8 and 11 and Article 52(1) of the Charter – is proportionate.
40. It follows that, pursuant to the measures adopted under Article 15(1) of Directive 2002/58, access to sensitive data may not be granted unless (i) the offence in question attains the threshold of seriousness determined in advance by the national legislature, and (ii) a court or other independent administrative body considers, following an individual assessment or review, that the interference with fundamental rights entailed by the grant of such access is proportionate, in view of the public interest objective of combating crime in a particular case. In certain cases, however, access to such data may not be granted, even where the offence reaches the threshold of seriousness under national law.
41. The offence of aggravated theft in the present case is considered to be ‘serious’ under national law as it is subject to a penalty of, inter alia, a term of imprisonment of two to six years, thereby complying with the threshold of seriousness in Article 132(3) of Legislative Decree No 196/2003. (67) When applying measures adopted pursuant to Article 15(1) of Directive 2002/58, the Italian courts do not appear to have jurisdiction to call into question the classification of aggravated theft as a ‘serious offence’ under national law. Where the threshold set by national law has not been met, the referring court thus may not grant access to the data sought. (68)
42. Where the threshold set by the national legislature is met, the referring court must, pursuant to Article 15(1) of Directive 2002/58, review whether, in the light of all the circumstances pertaining to the specific case at hand, the interference with fundamental rights entailed by facilitating access to sensitive data is proportionate to the public interest objective of combating that offence. The referring court must, in that regard, take into account and weigh all relevant rights and interests including, inter alia, the damage caused to the property rights of victims protected under Article 17 of the Charter and the fact that mobile telephones may contain highly sensitive information relating to their owners’ private, professional and financial lives. (69) Access to the data in question may be the only effective means available to investigate and to prosecute the offences in question and to ensure that their, as yet unknown, perpetrators do not act with impunity. The rights of third parties (70) are also to be taken into account.
43. As regards the rights of third parties, it appears (71) from the referring court’s files that the Public Prosecutor (Bolzano) sought access to data concerning communications from the stolen mobile telephones from 29 October 2021 in respect of the first theft committed on 27 October 2021 (72) and from 20 November 2021 in respect of the second theft committed on that date. (73) These dates show that the requests for access impinge, to a very limited extent, on the rights of the victims guaranteed, inter alia, by Articles 7, 8 and 11 of the Charter. (74) The Italian Government also stated in its written observations that the national proceedings relate solely to data that would help to identify the perpetrator(s) of the thefts in question. In the event of the identification of calls to or from third parties unconnected to the theft, those data would be destroyed, in accordance with Article 269 of the Code of Criminal Procedure. (75) Finally, Article 132(3c) of Legislative Decree No 196/2003 provides that data acquired in breach of paragraph 3 or 3a thereof may not be used. (76)
VI. Conclusion
44. In the light of the above considerations, I propose that the Court answer the question referred for a preliminary ruling by the Tribunale di Bolzano (District Court, Bolzano, Italy) as follows:
Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 and Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union
must be interpreted as not precluding national legislation that requires a court to authorise access, by the Public Prosecutor, to data lawfully retained by the providers of electronic communications services and enabling precise conclusions to be drawn concerning a user’s private life if such data are relevant for the purpose of establishing the facts and there is sufficient evidence of the commission of a serious crime as defined by national law which is liable to a maximum term of imprisonment of at least three years. Prior to granting access, the national court must carry out an individual assessment as to whether the interference with fundamental rights entailed by the grant of such access is proportionate in the light, inter alia, of the seriousness of the specific crime and the facts of the case.