Key facts of the case:

In 2018 the police applied to the Court for an order against the telecommunication company Cablenet Communication Systems Ltd instructing it to deliver to the Office for combating Electronic Crime the telephone data of a certain IP address belonging to Cablenet of a specific date and time. The application relied on the national data retention legislation and sought to investigate a child pornography case, following information received through Europol. The Court issued the order requested by the police, which was executed a few days later with the disclosure of data to the police and the arrest of the suspect, who is the applicant in this case. The applicant brought this action claiming that the court order of 2018 permitting access to his data was unlawful for infringing article 15(1) of Directive 2002/58, since it is contrary to articles 7, 8, 11 and 52 of the Charter of Fundamental Rights. Citing Tele2 Sverige AB the applicant claimed that telecommunication providers cannot retain data arbitrarily without a particular purpose and without the consent or knowledge of the data subjects and that their retention is unlawful even if intended to combat serious crime. He further argued that the law relied upon by the Court permitted the retention of data arbitrarily and indiscriminately for six months without justification and as such it infringes the Charter of Fundamental Rights and Directive 2002/58. He argued that since the testimony against him was unlawfully obtained, the search and access warrant must be invalidated.

Key legal question:

The Court found that the police application to the Court for an order to access the applicant’s data had a specified purpose, which was the investigation of a crime for which a prison sentence of over five years was foreseen. The data which the police had asked to access was strictly specified, which was a particular I.P. address on a specific day and time. The six months ceiling in retaining data was not exceeded and the application was supported by a specific permission from the Attorney General. The CJEU had ruled that it is up to the national law to implement the Directive in a manner compliant with the Charter of Fundamental Rights. The Tele2 Sverige AB case had established that the protection of telecommunications data is not absolute and that the investigation and prosecution of crime is one of the reasons for which deviation from the principle of confidentiality of communications is allowed. In Ministerio Fiscal (C-207/16) the CJEU ruled that deviation from protection must be severely restricted, concluding that in the case at hand which concerned the investigation of a criminal case, the order would be justified. Given the limited scope of the access requested, the principle of proportionality was not infringed.

Outcome of the case:

The Court rejected this application, ruling that the principle of data protection is not absolute and that the investigation and prosecution of serious crime is one of the reasons recognized by the CJEU as legitimate so as to justify a deviation. The proportionality principle was not infringed since the data to which access was requested was specific to a certain date and time.