FOURTH SECTION

DECISION

Application no. 31702/18 G.L. and L.G.P. against Austria

The European Court of Human Rights (Fourth Section), sitting on 7 November 2023 as a Committee composed of:

Tim Eicke, President , Branko Lubarda, Ana Maria Guerra Martins , judges , and Ilse Freiwirth, Deputy Section Registrar ,

Having regard to:

the application (no. 31702/18) against the Republic of Austria lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) on 4 July 2018 by an Austrian national, Mr G.L., who was born in 1955 and lives in Vienna (“the first applicant”) and L.G.P., an Austrian limited liability company (“the second applicant”), both represented by Ms T.A. Urdaneta Wittek, a lawyer practising in Vienna;

the decision not to have the applicants’ names disclosed;

Having deliberated, decides as follows:

SUBJECT MATTER OF THE CASE

1. The first applicant is a lawyer and runs a law firm, the second applicant. From 2012 the Public Prosecutor’s Office (hereinafter “the public prosecutor”) conducted investigation proceedings against, inter alia , the first applicant on suspicion of having supported a foreign intelligence service to the detriment of Austria.

2. In 2014 and 2015 several data carriers were anonymously transmitted to the Federal Office for the Protection of the Constitution and Counterterrorism ( Bundesamt für Verfassungsschutz und Terrorismusbekämpfung ) and other authorities, allegedly containing data relevant for the investigation. The applicants allege that the data, which included documents and correspondence taken from the files of the second applicant, were largely protected by legal professional secrecy. The data carriers were transmitted to the public prosecutor who took them to the file.

3 . On 4 April 2017, the investigation proceedings against the first applicant were eventually discontinued on all counts.

4 . On 17 March and 10 August 2015, the applicants requested the handover of specific data carriers and the deletion of all copies thereof. In eventu , they lodged objections under Article 112 of the Code of Criminal Procedure (hereinafter “CCP”) against the seizure of the data, arguing that the data were protected by the professional secrecy of the first applicant and other lawyers working with the second applicant and that their privilege to refuse to give evidence could not be circumvented by means of seizure of documents (Article 157 § 2 of the CCP). As Article 144 § 2 of the CCP prohibited investigation measures circumventing professional secrecy, the seizure and inspection of the data had been unlawful.

5 . On 15 October 2015 the Linz Regional Court partly granted the applicants’ requests and decided that specific data carriers, including copies thereof, should not be kept in the file but returned to the applicants as the data had been subject to the lawyer’s duty of confidentiality, making their seizure contrary to Articles 144 § 2 and 157 § 2 of the CCP. The public prosecutor appealed.

6 . On 13 January 2016 the Linz Appeal Court granted the appeal and overturned the Regional Court’s decision. It did not find it necessary to address whether the informal and unsolicited receipt of data carriers by a third party constituted a seizure or to what extent the protection from circumvention of the lawyer’s privilege applied, as in the instant case the data had already been viewed and the inspection could no longer be prevented retrospectively by an objection. The guarantees of Articles 144 § 2 and 157 § 2 of the CCP (see paragraph 4 above) would be safeguarded by the fact that the prohibition of circumvention had to be respected ex officio . The data thus remained part of the file. The decision was served on 27 January 2016.

7 . The applicants did not lodge a request for renewal of criminal proceedings ( Antrag auf Erneuerung des Strafverfahrens) under Article 363a of the CCP (see ATV Privatfernseh-GmbH v. Austria (dec.), no. 58842/09, § 18, 6 October 2015) with the Supreme Court against the Appeal Court’s decision. Such a request for renewal would have had to be filed within six months of the service of the Appeal Court’s decision (see ATV Privatfernseh ‑ GmbH , cited above, § 20).

8 . On 5 July and on 4 August 2017, respectively, the applicants requested the deletion of the data under the Data Protection Act (hereinafter “DPA”).

9 . Section 27 of the DPA – as in force at the time – stipulated that unlawfully collected or stored data, including data no longer required for the purpose for which they had been collected, had to be deleted at the reasoned request of an affected person. Pursuant to Article 74 of the CCP, the provisions of the DPA apply to criminal proceedings unless provided otherwise and authorities must, in processing personal data, respect the principles of lawfulness and proportionality and prioritise confidential treatment of personal data. Article 75 CCP provides that personal data collected contrary to the provisions of the CCP must be deleted and that personal data may be kept for a maximum period of 60 years after investigation proceedings are discontinued.

10. In their requests for deletion (see paragraph 8 above), the applicants argued that the use of their data had violated the prohibition of circumvention of their professional secrecy under Article 157 § 2 of the CCP (see paragraph 4 above) and thus had to be deleted pursuant to Article 75 of the CCP and section 27 of the DPA (see paragraph 9 above). In eventu , they argued that even if the use of the data had been permissible initially, the purpose for which they were used had ceased to exist when the investigation proceedings had been discontinued (see paragraph 3 above), after which they should have been deleted immediately pursuant to section 27 of the DPA (see paragraph 9 above).

11 . On 19 July, 16 August and 25 August 2017 the public prosecutor rejected the requests for deletion. It referred to final decisions of 3 February and 25 November 2016 by the Appeal Court in parallel sets of proceedings, not challenged by the applicants, which held that the prohibition of circumvention under Article 144 § 2 of the CCP (see paragraph 4 above) had not been violated and that the evidence had not been obtained unlawfully. Also, the public prosecutor had complied with the obligation to protect the applicants’ professional secrecy ex officio .

12 . On 8 August, 30 August and 5 September 2017, respectively, the applicants lodged objections against those decisions on grounds of a breach of rights ( Einspruch wegen Rechtsverletzung ) during investigations under Article 106 of the CCP (see Aigner and Hoppel v. Austria (dec.), nos. 50715/18 and 1649/18, § 33, 18 October 2022).

13. On 2 October 2017 the Regional Court rejected the applicants’ objections as the alleged breaches had taken place after the investigation proceedings had been discontinued and could therefore no longer be challenged. The applicants appealed.

14 . On 27 December 2017 the Appeal Court dismissed the appeal. Although, contrary to the Regional Court’s view, the allegedly unlawful use of data during the investigation proceedings could still be objected to after their discontinuance, the data had – as affirmed in earlier decisions by the Appeal Court and not challenged by the applicants (see paragraph 11 above) – not been obtained unlawfully and consequently there had not been an obligation to delete them.

15 . The Appeal Court further found that the discontinuance of the investigations did not deprive the continued storage of the data of its purpose, as the investigations could be reopened at a later stage and would require documentation. Article 75 of the CCP allowed archiving data for a certain time even after discontinued investigation proceedings (see paragraph 9 above). The continued storage of the data was also proportionate. When balancing the applicants’ interests in deleting the data against the public interest in saving them, the significance of the offences underlying the investigation proceedings and the possibility of their continuation had to be taken into account. The applicants’ professional secrecy was sufficiently safeguarded by the public prosecutor’s obligation to protect the data ex officio which had been meticulously discharged so far, for instance, by rejecting third party requests for access to the file in two instances. The case-law of the Court referred to by the applicants ( S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 119, 125, ECHR 2008) was not applicable to the instant case. There had therefore been no breach of an individual right under Article 106 of the CCP (see paragraph 12 above).

16 . On 4 July 2018, the applicants lodged requests for renewal of criminal proceedings under Article 363a of the CCP (see paragraph 7 above), which were not submitted to the Court, alleging violations of Article 8 of the Convention in the first and second sets of proceedings.

17 . On 19 December 2018 the Supreme Court rejected the requests as inadmissible. As regards the complaints about the first set of proceedings, it found that the applicants had not exhausted domestic remedies. The applicants could have challenged the decision of the Linz Appeal Court of 13 January 2016 (see paragraph 6 above) through a renewal request before the Supreme Court but failed to do so (see paragraph 7 above). As for the complaints concerning the second set of proceedings (see paragraph 14 above), they were not lodged within the six-month time limit for renewal requests before the Supreme Court (see paragraph 7 above). The question at the centre of the complaint, namely whether the data had been obtained lawfully, had not been the subject of the Appeal Court’s decision of 27 December 2017 and could therefore not be raised in the renewal requests against that decision. That question had been ruled upon by the Appeal Court in earlier decisions (see paragraph 11 above) which had been served on the applicants already on 23 February and 5 December 2016 and had become final. A request for renewal of criminal proceedings should have been lodged within six months from the service of these decisions. The arguments were therefore brought by the applicants belatedly.

18 . As for the archiving of the data after the discontinuance of the investigation proceedings, the Supreme Court did not find a reason to question the result of the balancing exercise conducted by the Appeal Court (see paragraph 15 above). The applicants’ argument that their data had later been transmitted to a parliamentary investigative committee could not have been taken into consideration by the Appeal Court in its decision dated 27 December 2017 as the committee had only been set up later. The Supreme Court’s decision was served on 21 January 2019.

19. Further proceedings initiated by the applicants before the data protection authority ( Datenschutzbehörde ) and before the Appeal Court under data protection provisions of the Court Organisation Act ( Gerichtsorganisationsgesetz ) were unsuccessful.

20. The applicants raised their complaints concerning the transmission of the investigation file, including the data protected by legal professional secrecy, to a parliamentary investigative committee (see paragraph 18 above) in a separate application (see application no. 51235/19).

THE COURT’S ASSESSMENT

21. The applicants complained that the unlawful and disproportionate seizure and use of their data protected by professional secrecy violated their rights under Article 8 of the Convention. Even if their seizure was found legal, the purpose of use ( Verwendungszweck ) of the data had ceased to exist with the discontinuance of the investigation proceedings, after which the data should have been deleted.

22 . The applicants did not challenge the Supreme Court’s finding that they should have raised their arguments concerning the allegedly unlawful seizure and taking the data to the file in a request for renewal of the proceedings against the Appeal Court’s decisions dated 3 February and 25 November 2016 or that their complaints about the lawfulness in obtaining the data were belated (see paragraph 17 above). A request for renewal of the criminal proceedings under Article 363a of the CCP was to be considered an effective remedy ( ATV Privatfernseh-GmbH , cited above, §§ 32-34). Domestic remedies have not been exhausted when an appeal is not accepted for examination because of a procedural mistake by the applicant (see Gäfgen v. Germany [GC], no. 22978/05, § 143, ECHR 2010). In the instant case, the applicants’ have failed to submit their request for renewal of the proceedings within the time-limit provided for by domestic law and have thus failed to exhaust domestic remedies in respect of their complaints concerning the seizure and taking to the file of the data.

23 . By not lodging a request for renewal against the Appeal Court’s decision of 13 January 2016 (see paragraph 6 above) which had overruled the Regional Court’s decision of 15 October 2015 (see paragraph 5 above), the applicants did not avail themselves of existing remedies to bring before the national courts their complaints of allegedly unlawful seizure and taking the data to the file under Article 8. They thus failed to exhaust domestic remedies as required by Article 35 § 1 of the Convention.

24. As to the question of whether the archiving of data, which had not been taken to the file unlawfully, after the discontinuance of investigation proceedings complied with Article 8, the Court finds that this was in accordance with the law (see paragraph 9 above), that the purpose of use of the data had not ceased to exist with the discontinuance of the investigation proceedings and that it served the legitimate aim of preventing disorder and crime.

25. As to whether the archiving of data was necessary in a democratic society, the applicants relied on case-law concerning searches and seizures of data related to the client-lawyer relationship and the existence of sufficient legal safeguards at the seizure ( Robathin v. Austria , no. 30457/06, §§ 46-52, 3 July 2012; Sallinen and Others v. Finland , no. 50882/99, §§ 89-93, 27 September 2005; see also Wieser and Bicos Beteiligungen GmbH v. Austria , no. 74336/01, §§ 63-66, ECHR 2007-IV). This case-law is, however, not applicable here as the part of the complaint which relates to the manner in which the data had been seized and taken to the file is inadmissible for non ‑ exhaustion of domestic remedies (see paragraph 22-23 above). The applicants further argued that a violation may be derived from the case of S. and Marper (cited above, §§ 119, 125), where the Court found that the indefinite and indiscriminate retention of fingerprints, cellular samples and DNA profiles in a national database violated Article 8 (as to the retention of personal data in a police database, see also Catt v. the United Kingdom , no. 43514/15, § 119, 24 January 2019). However, the applicants’ data were not put to a database but merely kept in a confidential criminal file. While the legal professional privilege is specifically protected under Article 8 ( Michaud v. France , no. 12323/11, §§ 117-19, ECHR 2012) nothing indicates that there were no procedural safeguards in place to protect the applicants’ rights when the data were archived (ibid.; Sommer v. Germany , no. 73607/13, § 56, 27 April 2017). The applicants’ requests to delete the data once the investigation proceedings were discontinued had been considered by the courts, which examined the facts and concluded that at the time of their decision the applicants’ rights were safeguarded. The Regional Court took into account the offence on which the investigation proceedings against the first applicant had been based, the fact that the public prosecutor had protected the confidentiality of the data and the maximum time-limit provided for in the law (see paragraph 9 above). The Court finds no reason to depart from the result of the proportionality assessment (see paragraph 15 above) which lies within the State’s margin of appreciation. It follows that this part of the complaint is manifestly ill ‑ founded in accordance with Article 35 §§ 3 (a) of the Convention.

26. The application must therefore be rejected in accordance with Article 35 § 4 of the Convention.

For these reasons, the Court, unanimously,

Declares the application inadmissible.

Done in English and notified in writing on 30 November 2023.

Ilse Freiwirth Tim Eicke Deputy Registrar President