Spetsializirana prokuratura – CJEU Judgment (European Union, 2022)

In the context of criminal proceedings in Bulgaria, the prosecutor requested the Spetsializiran nakazatelen sad (Bulgarian Criminal Court) to give him access to data, including location data, concerning the telephone calls of five persons involved in a serious crime case. The case file showed that the telephone numbers were potentially used to commit the crime. Under Bulgarian national law, the retention of traffic and location data is limited to six months. Access to these data is only allowed for investigative purposes in serious offences, but the national law does not include a provision that restricts access to what is strictly necessary for the purpose. The Criminal Court therefore referred the following question to the CJEU. (1) Is national legislation (Article 251b(1) of the Zakon za elektronnite saobshtenia (Law on electronic communications)) providing for the general and indiscriminate retention of all traffic data (traffic data and location data of users of electronic means of communication) for a period of 6 months in order to fight serious crime compatible with Article 15(1) of Directive 2002/58, read in combination with Article 5(1) and recital 11 thereof, provided that the national legislation contains certain safeguards? (2) Is national legislation (Article 159a of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure)) which does not limit access to traffic data to what is strictly necessary and does not grant the persons whose traffic data are accessed by the law enforcement authorities the right to be notified thereof, provided that that does not impede criminal proceedings, or the right to a legal remedy against unlawful access compatible with Article 15(1) of Directive 2002/58, read in combination with Article 5(1) and recital 11 thereof? (1) The Court considered that Article 15(1) of Directive 2002/58 does not allow Member States to derogate from Articles 4(1) and 4(1)bis, which require providers of electronic communications services to take appropriate technical and organisational measures to ensure effective data protection. It answered the first question by stating that Article 15(1) of the Directive must be interpreted as precluding national legislation which provides for general and undifferentiated data retention as a preventive measure in the context of criminal investigations. (2) As to the second question, concerning the failure of national legislation to provide for access to data to be limited to what is strictly necessary, the Court held that national legislation must satisfy the requirement of proportionality. In particular, the legislation cannot be limited to requiring that the authorities' access to the data be in accordance with the purpose of the legislation, but must also provide for the material and procedural conditions governing that use. The Court therefore considered that national legislation which does not provide that access to stored data is limited to what is strictly necessary to achieve the purpose of that storage does not comply with the mentioned provisions. As regards information and the right of appeal for data subjects, the Court considered that the articles in question preclude national legislation which does not guarantee that data subjects are informed of the processing to the extent provided for by EU law and which does not allow any means of appeal in the event of unlawful access to such data.