CJEU case C-162/22 Lietuvos Respublikos generalinė prokuratūra – CJEU Judgment (European Union, 2023)

The Lithuanian Prosecutor General´s Office investigated one of its public prosecutors, who was found responsible of misconduct in its office. The research into the public prosecutor´s misconduct was authorised by a court order, allowing for the interception and recording of data transmitted over electronic communication. Following these findings, the Prosecutor General´s Office dismissed the public prosecutor from office. The public prosecutor contested the decision before the [https://administracinis.teismas.lt/ Regional Administrative Court (Vilniaus apygardos administracinis teisma)], which dismissed the claim due to the lawfulness of the criminal intelligence operations and process behind the data gathered. The controller then appealed the case to the [https://www.lvat.lt/ Supreme Administrative Court (Lietuvos vyriausiasis administracinis teisma)], as he alleged that the access by intelligence bodies to traffic data and actual content of electronic communications was such a serious interference with fundamental rights that access could only be granted to combat serious crime. The Supreme Administrative Court considered it apparent that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], together with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 3]ePrivacy Directive 2002/58/EC thereof, extends the scope of that directive only to legislative measures requiring providers of electronic communications services to grant the competent national authorities access to data (as found in C-623/17 Privacy International). Moreover, it follows from [https://curia.europa.eu/juris/document/document.jsf?text=&docid=238381&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=22564108 C-746/18 Prokuratuur], that only actions to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR] (hereinafter: the Charter). However, the CJEU did not yet rule on the impact of the subsequent use of the data concerned on the interference with fundamental rights. The Supreme Administrative Court doubted whether such subsequent use constituted a serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR], and whether such use is justifiable only for the purposes of combating serious crime and preventing serious threats to public security. Thus, the Supreme Administrative Court of Lithuania referred to the CJEU the following preliminary question: - Whether [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC] precludes the use, in connection with investigations into corruption-related misconduct in office, of personal data relating to electronic communications retained, pursuant to an authorised order, by providers of electronic communications services and subsequently made available to the competent authorities to combat serious crime? The CJEU pointed out that the referring court only questions the subsequent use of personal data retained by electronic communication providers on the basis of [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) Directive 2002/58]. Thus, the data to be considered in this preliminary ruling decision is the data retained on the basis of [https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/05cd4e020f0a11e7b6c9f69dc4ecf19f?jfwid=32wf58e9 Article 65(2) of Lithuanian Law on Electronic Communications], which, together with [https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/05cd4e020f0a11e7b6c9f69dc4ecf19f?jfwid=32wf58e9 Annex I], requires electronic service providers to retain, generally and indiscriminately, traffic and location data relating to such communications for the purpose of combating serious crime. The CJEU considered that the subsequent use of traffic and location data relating to electronic communications, to combat serious crime, is only possible on two conditions: - retention of those data by providers of electronic communications services must be consistent with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC]; and - access to those data granted to the competent authorities must be itself consistent with that provision. In C-793/19 SpaceNet and Telekom Deutschland, legislation allowing the pre-emptive retention of traffic and location data was considered not in line with EU law. However, legislation allowing for data retention under strict requirements to combat serous crime and prevent serious threats to public security was allowed under [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng ePrivacy Directive 2002/58/EC]. In light of these preliminary remarks, the CJEU started its analysis by stating that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC] allows Member States to introduce exceptions to the obligations laid out in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5(1) ePrivacy Directive 2002/58/EC] for the safeguard of national security, defence and public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. However, the CJEU considered that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC] cannot expand excessively the exception to the principle of confidentiality and data storage present in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5 Directive 2002/58]. Thus, the CJEU reiterated that the objectives listed in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC] is exhaustive. Once having established that no other objectives can be added to the ones laid out in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC], the CJEU considered that there is a hierarchy behind the objectives according to their importance, which in turn needs to be balanced against the seriousness of the interference to an individual´s life it entails (C-140/20 Commissioner of An Garda Síochána and Others). The objective of safeguarding national security exceeds in importance the other objectives of [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 Directive 2002/58] and, thus, can justify more serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and 8 CFR]. Differently, with regards to the objective of preventing, investigating, detecting and prosecuting criminal offenses, only actions to combat serious crime and serious threats to public security can justify a serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR]. Thus, deciding whether there is a justification to the limitations to [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5 ePrivacy Directive 2002/58/EC, Article 6 ePrivacy Directive 2002/58/EC and Article 9 ePrivacy Directive 2002/58/EC] depends on the seriousness of the interference stemming from this limitation and on the importance of public interest objective pursued by that limitation in relation to its seriousness ([https://gdprhub.eu/index.php?title=CJEU_-_C-511/18_-_La_Quadrature_du_Net_and_Others C-511/18 La Quadrature du Net and Others]). This reasoning applies mutatis mutandis to the subsequent use of traffic of location data retained by providers of electronic communications services ex [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC]. In the case at hand, for the CJEU, the fact that the referring Supreme Administrative Court did not indicate any threat to public security in its documents, and that investigating a misconduct in office does not correspond to the objective of prosecuting and punishing criminal offenses, ex [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], proves that investigations of misconduct in office does not fall within the category of combating serious crime. Therefore, the CJEU found that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], read in the light of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR, Article 8 CFR, Article 11 CFR and Article 52(1) CFR], does not allow the use, in connection with investigations into corruption-related misconduct in office, of personal data relating to electronic communications which have been retained by providers of electronic communications services and which have subsequently been made available to the competent authorities for the purpose of combating serious crime.