ECJ: Police may access personal cell phone data with permission

Contents

The European Court of Justice (ECJ) has issued a landmark ruling on the handling of personal data on cell phones. It ruled that police access to this data in the context of criminal investigations does not have to be limited exclusively to serious crime. "However, it requires prior authorization by a court or an independent authority and must be proportionate," explains the ECJ.

Preservation of evidence after drug checks

In the 2021 case brought before the Court, the Austrian police (the Landeck district authority) is the defendant. The police had seized a cell phone during a narcotics check and after finding 85 grams of herbal cannabis. The owner of the cell phone then lodged a complaint "with an Austrian court against the seizure of his cell phone", according to the ECJ (PDF).

Without authorization, the officers attempted to unlock the device to access the personal data. These attempts were neither documented, nor was the person concerned informed. It was only during court proceedings that the person concerned found out about this procedure and lodged a complaint.

Significant interference with fundamental rights

The Court made it clear that access to all data stored on a cell phone can constitute a significant interference with the fundamental rights of the person concerned. This data could contain sensitive information such as messages, photos and internet history, allowing detailed insights into the person's private life.

Countries must define conditions for access

The ruling is groundbreaking for investigative work and data protection throughout the European Union. The Court's decision obliges Member States to adapt their national regulations to ensure a balance between law enforcement possibilities and citizens' fundamental rights.

This includes defining the type or categories of offenses that justify access. The Court emphasized that access must always be secured by a judicial or administrative authorization to ensure proportionality. Only in urgent cases can this authorization be waived.

The ruling in case C-548/21 has far-reaching consequences for law enforcement and data protection in the EU. It is intended to ensure that the fundamental rights to privacy and data protection are also safeguarded in the digital age. At the same time, it enables the authorities to access digital evidence in numerous investigative cases, provided this is proportionate and legally secure.

(mack)