1) This reference for a preliminary ruling concerns, in essence, the interpretation of the concept of ‘serious crime’ ( 2 ) within the meaning of the case-law of the Court resulting from the judgment in Digital Rights Ireland and Others ( 3 ) (‘the judgment in Digital Rights’) and then from the judgment in Tele2 Sverige and Watson and Others ( 4 ) (‘the judgment in Tele2’), where that concept was used as a criterion for the assessment of the lawfulness and proportionality of an interference with the rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), namely, respectively, the right to respect for private and family life and the right to protection of personal data.

...

3) The referring court asks the Court, in essence, about the way in which the threshold of seriousness of infringements must be fixed beyond which there may be justification, in the light of the case-law referred to above, for interfering with the fundamental rights protected by Articles 7 and 8 of the Charter when the competent national authorities have access to personal data retained by electronic communications service providers.

...

6) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), ( 5 ) as amended by Directive 2009/136/EC, ( 6 ) (‘Directive 2002/58’) states in its preamble:

‘(2) This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the [Charter]. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of [the Charter].

…

25) In that context, by decision of 6 April 2016, received at the Court on 14 April 2016, the Audiencia Provincial de Tarragona (Provincial Court, Tarragona) decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:

‘(1) Can the sufficient seriousness of offences, as a criterion which justifies interference with the fundamental rights recognised by Articles 7 and 8 of the [Charter], be determined taking into account only the sentence which may be imposed in respect of the offence investigated, or is it also necessary to identify in the criminal conduct particular levels of harm to individual and/or collective legally-protected interests?

(2) If it were in accordance with the constitutional principles of the European Union, used by the Court of Justice in its judgment [in Digital Rights] as standards for the strict review of the directive [declared invalid in that judgment], to determine the seriousness of the offence solely on the basis of the sentence which may be imposed, what should the minimum threshold be? Would it be compatible with a general provision setting a minimum of three years’ imprisonment?’

...

37) Having regard to all of those factors, I would emphasise at the outset that the main proceedings concern personal data the transmission of which is sought not in a general and indiscriminate manner, but in a targeted manner as regards the persons concerned and one that is limited in duration. In addition, the requested data seem at first sight not to be of a particularly sensitive nature, although the fundamental rights enshrined in Articles 7 and 8 of the Charter are nonetheless capable of being affected by access to data of that type. ( 30 )

...

43) First of all, I recall that it has consistently been held that the fundamental rights guaranteed in the legal order of the European Union, and in particular those enshrined in Articles 7 and 8 of the Charter, are applicable only if the situation in question is governed by EU law. ( 36 ) Furthermore, Article 51(1) of the Charter provides that the provisions of the Charter are addressed to the Member States only ‘when they are implementing Union law, within the meaning of the case-law of the Court relating to that concept. ( 37 ) Accordingly, where a legal situation is not covered by the scope of EU law, the Court does not have jurisdiction to rule on it and any provisions of the Charter relied on cannot, of themselves, form the basis for such jurisdiction. ( 38 )

44) In the present case, the questions submitted by the referring court refer only to Articles 7 and 8 of the Charter and to ‘the fundamental principles of EU law applied by the Court in [the judgment in Digital Rights’]. However, the referring court considers that the directives applicable in personal data protection matters, such as Directive 95/46 and Directive 2002/58, establish the link required, under Article 51(1) of the Charter, between the main proceedings and EU law.

...

54) In fact, having regard to Article 1(1) and Article 3 of Directive 2002/58, ( 56 ) I share the opinion expressed, in particular, by the Commission, that that directive is intended to govern, in a comprehensive manner, the processing of personal data carried out in the context of the provision of electronic communications services, so that its scope includes data relating to the identity of users of such services, like those involved here, and not only the data associated with a specific communication. Having regard, also, to the objectives of protection referred to in that directive, which consist mainly in safeguarding fundamental rights guaranteed by the Charter, ( 57 ) I therefore consider that the concept of ‘communication’, within the meaning of that measure, must be understood broadly and that the principle of confidentiality of communications laid down in that measure ( 58 ) is indeed at stake in the present case.

...

63) However, I consider that in this instance the Spanish Government’s complaint is not well founded. In the light of the information provided by the referring court, I consider that that court has sufficiently identified the provisions of EU law which in its view are relevant. I recall that the questions submitted refer in particular to Articles 7 and 8 of the Charter and that the referring court explains that Directives 95/46 and 2002/58 constitute the necessary link between the national legislation applicable in the main proceedings and EU law ( 68 ) and, last, that Directive 2002/58 seeks, as stated in recital 2, to ensure, in particular, full respect for the rights set out in Articles 7 and 8 of the Charter. ( 69 )

...

65) It may also be observed that by far the majority of the parties who submitted observations to the Court proceed from the principle that the present request for a preliminary ruling must be examined in the light of Article 15(1) of Directive 2002/58, read in the light of Articles 7 and 8 of the Charter, and on the basis of the lessons learned from the judgments in Digital Rights and Tele2. That is also my view, it being noted that the expression ‘criminal offences’, and not ‘serious offences’ appears in 2002/58, only in Article 15(1). ( 72 )

66) In the second place, the Spanish Government maintains that Article 7 of the Charter, which is the central element of the present request for a preliminary ruling, is not relevant, on the ground that the measure of investigation sought in the main proceedings does not concern the interception of communications and cannot therefore affect the confidentiality of the communications, so that the questions submitted are hypothetical.

67) For my part, I consider that Article 7 of the Charter is indeed relevant in the present case and that the request for a preliminary ruling is therefore not hypothetical in nature. While it is true that, in this case, there is no risk of a breach of the right to the secrecy of communications, having regard to the object of the measure at issue in the main proceedings, ( 73 ) the fact nonetheless remains that a measure of that type is apt to constitute an interference with the right to respect for private life guaranteed by that provision, albeit in my view a minor interference. ( 74 )

68) In fact, as the Court has already consistently held, the communication of personal data to a third party, such a public authority, constitutes an interference with the fundamental right enshrined in Article 7 of the Charter, irrespective of the use to which the information communicated is subsequently put. The same applies to the retention of personal data, in particular by electronic communications service providers, and to access to those data with a view to their being used by the public authorities. ( 75 )

...

70) By its first question, the referring court asks the Court, in essence, about the factors that must be taken into account for the purpose of establishing that the criminal offences are of sufficient seriousness to justify an interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter, in the context of the retention of and access to personal data, in accordance with the case-law resulting from the judgment in Digital Rights, followed by the judgment in Tele2.

...

72) More specifically, the first question asks the Court to rule on whether, for the purposes of assessing the existence of a ‘serious offence’ capable of justifying an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter with regard to personal data, only the penalty incurred for the offence at issue must be taken into consideration or whether, in addition, the particularly harmful nature of the criminal conduct with regard to the individual or collective legal interests involved, must also be taken into consideration.

...

74) First of all, it is appropriate to establish that operations such as those at issue in the main proceedings are indeed capable of constituting a breach of the fundamental rights guaranteed by Articles 7 and 8 of the Charter, and therefore of constituting an interference with those rights, within the meaning of the case-law deriving from the judgments in Digital Rights and Tele2.

...

76) However, I consider that for the purpose of determining whether personal data must be covered by the protection provided for in EU law, and in particular by Directive 2002/58, ( 87 ) it is immaterial whether the information referred to by the request for retention or communication is particularly sensitive or not. In fact, as was observed in the context of the first legislative work dealing with the matter, ‘depending on the use to which it is put, any item of data relating to an individual, harmless though it may seem, may be sensitive (e.g. a mere postal address)’. ( 88 ) In addition, the Court has already held that, for the purposes of characterising the existence of an interference with the fundamental right enshrined in Article 7 of the Charter, ‘it does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced in any way’. ( 89 )

77) Furthermore, I recall that the communication of personal data to a third party, even a public authority such as the police, constitutes an interference with the fundamental right guaranteed in Article 7 of the Charter, ( 90 ) including where that information is conveyed for the purposes of a criminal investigation, a situation, moreover, which is expressly referred to in Article 15(1) of Directive 2002/58. ( 91 ) I would add that an operation of that type may also constitute a breach of the fundamental right to the protection of personal data guaranteed in Article 8 of the Charter, since it involves the processing of personal data. ( 92 )

78) Therefore, I consider that it must be held that a measure such as that at issue in the main proceedings constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter.

...

81) Likewise, in the judgment in Tele2, the Court ruled that ‘Article 15(1) of Directive 2002/58 … preclude[es] national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication’. ( 94 ) A link was also made in that judgment between, on the one hand, the particular ‘seriousness of the interference’ and, on the other, the need to justify a breach of such magnitude vis-à-vis the fundamental rights guaranteed by Articles 7 and 8 of the Charter, in reliance on a ground of general interest as basic as the ‘fight against serous crime’. ( 95 )

...

91) Consequently, I recommend that the Court’s answer to the question for a preliminary ruling, as reformulated, should be that Article 15(1) of Directive 2002/58, read in the light of Articles 7 and 8 and of Article 52(1) of the Charter, must be interpreted as meaning that a measure allowing the competent national authorities to have access, for purposes associated with combating criminal offences, to the identification data of users of telephone numbers activated from a specific mobile telephone during a limited period, in circumstances such as those at issue in the main proceedings, entails an interference with the fundamental rights guaranteed by that directive and by the Charter which does not attain a sufficient level of seriousness for such access to be confined to cases in which the offence concerned is of a serious nature.

...

96) It seems to me that the power to determine what constitutes ‘serious crime’ belongs, in principle, to the competent authorities of the Member States. Nonetheless, because of the references for a preliminary ruling which the Member States may submit to it, the Court is responsible for ensuring compliance with all the requirements resulting from EU law, and in particular for ensuring the consistent application of the protection afforded by the provisions of the Charter.

...

100) Consequently, I am of the view, in the alternative, that the concept of ‘serious crime’ within the meaning of the case-law of the Court resulting from the judgments in Digital Rights and Tele2 is not an autonomous concept of EU law the content of which must be defined by the Court, although the fact nonetheless remains that the derogation provided for in Article 15(1) of Directive 2002/58 must be implemented by the Member States in accordance with the fundamental rights guaranteed by the Charter, and that such implementation must be subject to review by the Court.

...

102) In the second place, and very much in the alternative, if the Court should consider that that concept is autonomous, it would then have to answer the question as formulated by the referring court and therefore have to rule on the determination of the criteria on which it may be assessed, at EU level, whether a criminal offence is sufficiently serious to justify an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter.

...

115) In addition, it is common ground that the interferences with the rights guaranteed by Articles 7 and 8 of the Charter that might be authorised by the Member States pursuant to Article 15(1) always continue to be subject to compliance with the general requirements flowing from the principle of proportionality, as set out in Article 52(1) of the Charter. ( 129 )

...

118) In the latter regard, I observe that, in the present case, the referring court mentions a risk of inversion of the general rule and the derogations provided for in Directive 2002/58, a risk referred to above, ( 132 ) where it states that ‘the threshold of three years’ imprisonment [introduced by the Spanish legislature in 2015 ( 133 )] covers a significant majority of criminal offences’. In other words, according to the referring court, the current list of offences capable of justifying, in Spain, restrictions of the rights protected under Articles 7 and 8 of the Charter, which was established by the reform of the Code of Criminal Procedure, would lead in practice to the majority of offences provided for in the Criminal Code being included in that list.

...

121) In conclusion, I consider that, if the Court should hold — contrary to my recommendation — that only the penalty incurred should be taken into account for the purpose of classifying a criminal offence as ‘serious’ within the meaning of the case-law resulting from the judgment in Digital Rights, the answer to the second question should therefore be that the Member States are free to set the minimum level of the penalty relevant for that purpose, provided that they comply with the requirements resulting from EU law, and in particular the requirements that interferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter must remain exceptional and respect the principle of proportionality.

...

122) In the light of the foregoing considerations, I propose that the Court answer the questions for a preliminary ruling submitted by the Audiencia Provincial de Tarragona (Provincial Court, Tarragona, Spain) as follows:

Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7 and 8 and also of Article 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a measure allowing the competent national authorities to have access, for purposes associated with combating criminal offences, to the identification data of users of telephone numbers activated from a specific mobile telephone during a limited period, in circumstances such as those at issue in the main proceedings, entails an interference with the fundamental rights guaranteed by that directive and by the Charter which does not attain a sufficient level of seriousness for such access to be confined to cases in which the offence concerned is of a serious nature.