Tiago Sérgio Cabral [Editor of this blog and Project Expert for the Portuguese team in the "European Network on Digitalization and E-governance" (ENDE)]

1. Background

The Court of Justice’s decision in Case C- 548/21 (Bezirkshauptmannschaft Landeck) probably got less attention than it deserved from legal scholars due to being issued at the same time as other high profile data protection cases and connected to Directive 2016/680/EU (the “Law Enforcement Directive”) instead of the GDPR. However, there are good reasons to engage in a deeper analysis of this case. The Bezirkshauptmannschaft Landeck judgment addresses access by law enforcement to mobile phones, which nowadays store large amounts of personal data that most people prefer to maintain private, but that law enforcement considers key for criminal investigation purposes. The Court of Justice’s conclusions regarding this issue are surprising as they seem out of step with previous case-law. Other less controversial but still relevant takeaways from this judgment, such as those regarding the scope of the concept of “personal data” may have relevance beyond data protection in the context of law enforcement.

2. The Court of Justice’s Decision

The case arises from a request for a preliminary ruling from the Regional Administrative Court of Tyrol (Austria). The factual background of the judgment is relatively straightforward: Austrian customs authorities seized a package for a data subject (CG) containing 85 grams of cannabis. Pursuant to this seizure, law enforcement conducted a search of CG’s residence, questioned him, and requested access to connection data on CG’s mobile telephone. CG refused and, as such, law enforcement seized his mobile phone, including SIM and SD cards.

Continue reading “Commentary to the Bezirkshauptmannschaft Landeck judgment: a failure by the CJEU in appropriately balancing privacy, data protection and the interests of law enforcement [1]” →