Summaries of judgments made in collaboration with the Portuguese judge and référendaire of the CJEU (Nuno Piçarra and Sophie Perez)

 ▪

Judgments of the Court (Grand Chamber) of 6 October 2020 Privacy International (C‑623/17, EU:C:2020:790) and La Quadrature du Net and Others (C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791)

Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Providers of electronic communications services – Hosting service providers and Internet access providers – General and indiscriminate retention of traffic and location data – Automated analysis of data – Real-time access to data – Safeguarding national security and combating terrorism – Combating crime – Directive 2002/58/EC – Scope – Article 1(3) and Article 3 – Confidentiality of electronic communications – Protection – Article 5 and Article 15(1) – Directive 2000/31/EC – Scope – Charter of Fundamental Rights of the European Union – Articles 4, 6, 7, 8 and 11 and Article 52(1) – Article 4(2) TEU

Facts

Following its judgments of 8 April 2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, of 21 December 2016, Tele2 Sverige and Watson and Others (C‑203/15 and C‑698/15, EU:C:2016:970), and of 2 October 2018, Ministerio Fiscal (C‑207/16, EU:C:2018:788), the ECJ ruled on four requests for a preliminary ruling from jurisdictions in three Member States in proceedings concerning the lawfulness of legislation adopted by those Member States in the field of processing of personal data in the electronic communications sector, laying down in particular an obligation for providers of electronic communications services to retain traffic and location data for the purposes of protecting national security and combating crime.

Decision

In both judgments, the ECJ clarified that national legislation such as the legislations at issue in the main proceedings falls within the scope of Directive 2002/58/CE of the European Parliament and of the Council, of 12 July 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37). In addition, while confirming its previous case-law concerning the disproportionate nature of general and indiscriminate retention of traffic data and location data, the ECJ provided clarifications, inter alia, as to the scope of the powers conferred on the Member States by that directive in the field of the retention of such data for the purposes of protecting national security and combating crime.

The ECJ recalled that the directive 2002/58, in particular its Article 15(1) and (3), does not permit the exception to the obligation of principle to ensure the confidentiality of electronic communications and the related data and, in particular, the prohibition on storage of that data, explicitly laid down in Article 5 of that directive, to become the rule. This means that the directive does not authorise the Member States to adopt, inter alia for the purposes of national security, legislative measures intended to restrict the scope of rights and obligations provided for in that directive, in particular the obligation to ensure the confidentiality of communications and traffic data, unless such measures comply with the general principles of EU law, including the principle of proportionality and the fundamental rights guaranteed by the CFREU, in particular those guaranteed by its Articles 7, 8 and 11.

In that context, in the Privacy International case, the ECJ interpreted Article 15(1) of Directive 2002/58, in the light of the CFREU, as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security.

In the La Quadrature du Net and Others judgment, the ECJ held that the above mentioned directive precludes legislative measures which, for the purposes laid down in Article 15(1), provide, as a preventive measure, for the general and indiscriminate retention of traffic and location data.

However, in this judgment, the ECJ considered that, in situations where the Member State concerned is facing a serious threat to national security that proves to be genuine and present or foreseeable, the Directive 2002/58, read in the light of the CFREU, does not preclude recourse to an order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data. In that context, the ECJ specified that the decision imposing such an order, for a period that is limited in time to what is strictly necessary, must be subject to effective review either by a court or by an independent administrative body whose decision is binding, in order to verify that one of those situations exists and that the conditions and safeguards laid down are observed. In those circumstances, that directive also does not preclude the automated analysis of the data, inter alia traffic and location data, of all users of means of electronic communication.

The ECJ added, inter alia, that Directive 2002/58 does not preclude, under certain conditions and for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security: i) the targeted retention of traffic and location data which is limited, on the basis of objective and non-discriminatory factors, according to the categories of persons concerned or using a geographical criterion, for a period that is limited in time to what is strictly necessary, but which may be extended; ii) the general and indiscriminate retention of IP addresses assigned to the source of an Internet connection for a period that is limited in time to what is strictly necessary; iii) the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems; nor iv) recourse to an instruction requiring providers of electronic communications services, by means of a decision of the competent authority that is subject to effective judicial review, to undertake, for a specified period of time, the expedited retention of traffic and location data in the possession of those service providers.

However, the ECJ also interpreted Article 15(1) of Directive 2002/58, in the light of the principle of effectiveness as requiring national criminal courts, in the context of criminal proceedings against persons suspected of having committed criminal offences, to disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law, where those persons are not in a position to comment effectively on that information and that evidence.

Judgment of the Court (Grand Chamber) of 24 November 2020, R.N.N.S. and K.A. v Minister van Buitenlandse Zaken Joined Cases C-225/19 and C-226/19 , EU:C:2020:951

References for a preliminary ruling – Area of freedom, security and justice – Community Code on Visas – Regulation (EC) No 810/2009 – Article 32(1) to (3) – Decision to refuse a visa – Annex VI – Standard form – Statement of reasons – Threat to public policy, internal security or public health, or to the international relations of any of the Member States – Article 22 – Procedure of prior consultation of central authorities of other Member States – Objection to the issuing of a visa – Appeal against a decision to refuse a visa – Scope of judicial review – Article 47 of the Charter of Fundamental Rights of the European Union – Right to an effective remedy

Facts

An Egyptian national, living in Egypt (Case C-225/19), and a Syrian national, living in Saudi Arabia (Case C-226/19), applied to the Minister van Buitenlandse Zaken (Minister for Foreign Affairs, Netherlands) for ‘Schengen’ visas in order to visit members of their respective families living in the Netherlands. Their applications were refused and, in accordance with the Visa Code[1], that refusal was notified to them by means of a standard form (Annex VI to the Visa Code). In both cases, the box on that form was marked by which it is indicated that one or more Member States had considered that the persons concerned had been considered to be a threat to public order, internal security, public health or the international relations of one of those Member States, which reflects the reason for refusal provided for in Article 32(1)(a)(vi) of the Visa Code. The refusals were the result of objections raised by Hungary (Case C-225/19) and Germany (Case C-226/19), which had been consulted beforehand by the Netherlands authorities in the context of the procedure laid down by Article 22 of the Visa Code. However, the forms sent to the persons concerned did not give any indication of the identity of those Member States, the specific ground for refusal out of the four possibilities or the reasons they had been considered to be such a threat.

The persons concerned lodged complaints with the Minister van Buitenlandse Zaken, which were rejected. They then brought actions before the Rechtbank Den Haag, zittingsplaats Haarlem (District Court, The Hague, sitting in Haarlem, Netherlands), arguing that they were deprived of effective judicial protection, since they were not able to challenge those decisions as to their substance. That court decided to ask the ECJ, first, about the statement of reasons that must accompany a decision refusing a visa, where that refusal is justified by an objection raised by another Member State, and, secondly, about the possibility of reviewing that ground for refusal, in the context of an appeal against a decision refusing a visa on the basis of Article 32(3) of the Visa Code.

Decision

The ECJ interpreted Article 32(2) and (3) of the Visa Code, in the light of Article 47 CFREU, as meaning, first, that a Member State which has adopted a final decision refusing to issue a visa on the basis of Article 32(1)(a)(vi) of that Code, because another Member State objected to the issuing of that visa, is required to indicate, in that decision, the identity of the Member State which raised that objection, the specific ground for refusal based on that objection, accompanied, where appropriate, by the essence of the reasons for that objection.

In that regard, the ECJ recalled its case-law according to which, if the judicial review guaranteed by Article 47 CFREU is to be effective, the person concerned must be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by requesting and obtaining notification of those reasons. Therefore, even though the statement of reasons corresponding to the standard form is predefined, if the competent national authority applies the ground for refusal referred to in Article 32(1)(a)(vi) of the Visa Code, it must indicate, in the section of the standard form entitled ‘Remarks’, the identity of the Member State or Member States that objected to the issuing of a visa and the specific ground for refusal based on that objection accompanied, where appropriate, by the essence of the reasons for that objection.

Secondly, the competent national authority concerned is also required to indicate the authority which the visa applicant may contact in order to ascertain the remedies available in that other Member State. Indeed, the courts of a Member State which has adopted a decision refusing a visa because of an objection raised by another Member State cannot examine the substantive legality of that objection.

In reaching that conclusion, the ECJ notes that the purpose of the judicial review carried out, on the basis of Article 32(3) of the Visa Code, by the courts of the Member State which has adopted the decision refusing a visa is indeed to examine the legality of that decision. However, the competent national authorities enjoy a wide discretion in the examination of visa applications, as regards the conditions for applying the grounds for refusal laid down in the Visa Code and the evaluation of the relevant facts. The judicial review of that discretion is therefore limited to ascertaining whether the contested decision rests on a sufficiently solid factual basis and verifying that it is not vitiated by a manifest error. In that regard, where the refusal of a visa is justified by the fact that another Member State objected to the issuing of that visa, those courts must be able to verify that the procedure for prior consultation of the other Member States described in Article 22 of the Visa Code has been applied correctly and, in particular, to check whether the applicant was correctly identified as the subject of the objection concerned. Moreover, those courts must be able to verify that the procedural guarantees, such as the obligation to state reasons, have been respected. However, the review of the merits of the objection raised by another Member State is a matter for the national courts of that other Member State.

[1] Regulation (EC) No 810/2009 of the European Parliament and of the Council of 13 July 2009 establishing a Community Code on Visas (OJ 2009 L 243, p. 1), as amended by Regulation (EU) No 610/2013 of the European Parliament and of the Council of 26 June 2013 (OJ 2013 L 182, p. 1).