JOINT DISSENTING OPINION OF JUDGES GROZEV, PAVLI AND KTISTAKIS

1. The present case involves the transfer and use of data obtained through secret surveillance, initially authorised by a judge for the purposes of a criminal investigation, to an administrative authority for the purposes of a separate and unrelated investigation into the applicant company. We regret that we are unable to follow the majority in finding that there has been no violation of Article 8 of the Convention in this case. In our view, the applicant company’s right to respect for its correspondence was violated as a result of certain structural flaws in the national legal framework, combined with a lack of sufficient safeguards and adequate reasoning provided by the national authorities in the specific circumstances of the present case.

I. A need for further jurisprudential development

2. We consider that the present case raises a number of serious and novel questions of Article 8 interpretation. We find ourselves in agreement with the principled objections put forward by Judge Koskelo in her partially dissenting opinion in the judgment in Adomaitis v. Lithuania (no. 14833/18, 18 January 2022), decided by the Second Section of the Court in January 2022. Beyond that, we note that the approach followed by the respective majorities in these two cases differed in significant respects, including as to the lines of case-law applied to similar matters.

3. Among other aspects calling for a more consistent interpretation, the present case also raises a methodological question: should the same or at least similar standards apply in this context to physical persons (such as the applicant in Adomaitis ) versus legal persons (such as the applicant company in the present case)? In our view, the confidentiality interests protected by Article 8 in a secret surveillance context require similar safeguards in both scenarios. While our case-law may permit a somewhat “wider margin of appreciation” when it comes to interferences with the Article 8 rights of legal persons (see paragraph 51 of the present judgment, and the cases cited therein), this is a matter of balancing in the final proportionality analysis, rather than a paradigmatic difference of approach.

4. The response to this preliminary question is also relevant for determining the legal standards and lines of case-law that may be invoked, under both the Convention and European comparative law more generally. While personal data protection regimes typically apply to physical persons alone, they can provide helpful guidance in determining the general standards that ought to apply to the confidentiality interests of legal persons in a secret surveillance context in respect of secondary processing or transfers of such data to additional public authorities, also because such information could contain the personal data of individuals, including of a sensitive nature. It is for this reason that we refer in our analysis to certain European Union data protection standards that we consider to be of relevance. Conversely, today’s judgment relies exclusively on the secret surveillance line of case-law and includes no references to general data protection principles, even on a mutatis mutandis basis.

II. The nature of the interference and the applicable test

5. The first challenge posed by this case relates to the proper characterisation of the interference with the applicant company’s confidentiality interests in a context where lawfully obtained surveillance data, authorised for a given purpose, were transferred to a different authority for the purposes of a separate and unrelated investigation of the same company concerning alleged infractions of a less serious gravity. The majority placed a good deal of emphasis on the fact that the original surveillance had been lawfully authorised (see paragraph 54 of the judgment), as did the majority in Adomaitis (cited above). In our view, this is neither sufficient, nor entirely pertinent. The original judicial authorisation was granted for the purposes of an unrelated criminal investigation on the basis of reasonable suspicion of a certain criminal activity (bribery of government officials); the authorising judge could not have been aware that “by-catch” from that surveillance would subsequently reveal indications of a different kind of violation of the law (namely, anti-competitive behaviour). As such, the original authorisation cannot be considered to have justified further use and transfer of any by-catch data for possible administrative investigations that might come in many different forms and levels of gravity. The power to authorise transfers of criminal data belongs in the Dutch system to a public prosecutor, a matter to which we come back below. Secondly, it is also relevant that the secondary investigation was not of a criminal nature or such that would have been capable of justifying secret surveillance measures on its own.

6. In these circumstances, the further transfer and processing of by-catch data for unrelated purposes constitutes an additional and serious interference with the privacy and confidentiality interests protected by Article 8. As such, it must be accompanied by robust safeguards, which must also ensure that such an arrangement cannot be abused to circumvent the rather stringent conditions for authorising secret surveillance in the first place. This position is consistent with that adopted by the Grand Chamber of the Court in Big Brother Watch and Others v. the United Kingdom ([GC], nos. 58170/13 and 2 others, 25 May 2021) in which it held that the transmission of bulk interception data to foreign States and international organisations “should be limited to such material as has been collected and stored in a Convention ‑ compliant manner and should be subject to certain additional specific safeguards pertaining to the transfer itself ” (ibid., § 362, emphasis added; see also Centrum för Rättvisa v. Sweden [GC], no. 35252/08, §§ 317 ‑ 30, 25 May 2021).

7. The next question in the analysis relates to the precise nature of those additional transfer-specific safeguards. The Court’s long-standing case-law holds that, in the context of secret surveillance, the minimum safeguards that must be set out in domestic law should include “precautions to be taken when communicating the data ... to other parties” (see paragraph 49 of the present judgment). However, the case-law is relatively scarce on the precise nature of these guarantees, depending also on the identity of those third-party recipients (for example, domestic versus foreign recipients). It was only relatively recently, in the Big Brother Watch and Others and Centrum för Rättvisa cases (both cited above), that the Court provided some additional guidance, in the context of transfers of data obtained through bulk surveillance to foreign States or international organisations. Of the four safeguards identified in those judgments, two appear to be most pertinent to the present case and more generally to a context of domestic transfers between two or more national authorities: that the circumstances in which such a transfer may take place must be set out clearly in domestic law; and that the transfer should also be subject to independent control (see Big Brother Watch and Others , cited above, § 362, and paragraph 49 of the present judgment). No further guidance has been provided on the nature of such “independent control” – in particular whether it should be ex ante , ex post facto or a combination of both.

8. With respect to the first criterion – the circumstances that can justify further sharing, for unrelated secondary purposes, of criminal investigation data obtained through secret surveillance – we believe that the Court’s case ‑ law needs to be developed beyond the mere legality requirement by addressing also the quality of those secondary purposes. In particular, national law should set a certain minimum level of gravity of potential breaches of the law the investigation of which can justify the further transfer of criminal investigation data, especially if such non-criminal infringements are not capable of triggering the use of secret surveillance measures on their own. Such an approach is necessary to avoid circumvention of the strict safeguards around secret surveillance and “fishing expeditions” by law ‑ enforcement authorities more generally. To put it plainly, data obtained for the investigation of serious crime should not be used to enforce traffic regulations. Furthermore, the principle of data minimisation should apply, requiring the transferring authority to share no more than is necessary for the secondary investigative purpose. [1] Finally, the proportionality of the further transmission of intercepted information should be assessed, weighing the character of the personal (or otherwise protected) data contained therein and its sensitivity against the gravity of the suspected illegal conduct.

9. Secondly, while some form of ex post facto judicial protection is essential, robust safeguards should also be provided prior to the transfer of secret surveillance data to another public authority, especially if such a transfer is made for a purpose other than the legitimate aim that justified the original collection and if the subject matters, or the identified suspects or investigation targets, in the two sets of proceedings are not linked or closely related. This follows from two sets of considerations: the highly intrusive nature of secret surveillance and the fact that any further unlawful sharing of such data within the government is likely to produce some degree of irreparable harm; and, secondly, general principles of data protection law requiring that protected data should only be processed for purposes other than those for which the data were collected subject to stringent conditions (known as the principle of purpose limitation). [2]

10. We turn now to the structural safeguards contained in the national legal system, as relevant and applied by the national authorities in the present case. It is worth recalling that the case involved the transfer of criminal investigation data, obtained through judicially authorised secret surveillance, for the purposes of an administrative investigation that was (a) entirely unrelated to the subject matter of the original criminal investigation (“by ‑ catch” data), and (b) of a nature that would not be capable of authorising secret surveillance measures on its own. In fact, the Competition Authority enjoys no powers under national law to request surveillance measures in the exercise of its administrative law enforcement functions. It is, therefore, a context that requires that any sharing of criminal investigation data be subject to particularly stringent safeguards.

11. The transfer of “criminal data” to other public authorities is possible under Dutch law for the purposes of “enforcement of legislation” and to the extent that those data are “necessary in view of a compelling general interest or the determination, exercise or defence of a right in law” (see section 39f of the Judicial and Criminal Data Act, as reproduced in paragraph 22 of the present judgment). The decision to transfer the criminal data to another public authority is made by a public prosecutor, without any further checks at that stage. The Board of Prosecutors General provided further instructions on the transmission of criminal data “for purposes other than criminal law enforcement” through a 2008 Order (see paragraph 28 of the judgment).

12. In our view, the necessity requirement tied to “a compelling general interest”, at least as construed in the present case, is generally adequate as a statutory threshold that limits the further transmission of criminal data obtained through secret surveillance. [3] We agree with the Chamber majority that the investigation and sanctioning of anti-competitive practices is, in principle, a sufficiently compelling public interest, which corresponds to protection of “the economic well-being of the country” under the second paragraph of Article 8 of the Convention.

13. At the same time, it would have been preferable for the prosecutorial instructions to have provided more detailed and specific guidance as to the level of gravity of non-criminal infractions capable of meeting the threshold for transmission. The same can be said about the apparent lack of guidance on procedures and criteria for further data minimisation. Such criteria could refer, in addition to the gravity of the suspected non-criminal infraction, to the reliability of the evidence supporting those suspicions and the sensitivity of the data at stake, among others.

14. More importantly, we disagree with the majority that the public prosecutor’s decision-making process in transferring the criminal data to the Competition Authority met the “independent control” requirement or was otherwise compliant with Article 8 standards. To begin with, it is rather questionable whether a public prosecutor, as the only authority to provide any ex ante control in the Dutch system, can be deemed capable of ensuring “independent control” prior to the actual transfer. [4] We do not, however, need to take a firm position on this aspect, as the decision-making process suffers, in our view, from a more serious flaw. While prosecutors are required, in principle, to undertake a balancing of interests and to assess the necessity and proportionality of the transfer, they are not required to record the outcome of that process in a properly reasoned decision. Such a transfer is treated under national law merely as a “physical act”, rather than as a legal measure constituting a serious and additional interference with the fundamental privacy interests of natural and legal persons. Providing a properly reasoned decision for such an interference would appear to be the minimum required by Article 8 by way of ex ante independent control; on this point, we are in agreement with the view of the Rotterdam Regional Court that the case file did not contain “a knowable, reviewable weighing of interests” (see paragraph 18 of the present judgment).

15. We consider this to be a significant structural flaw in the national legal framework, which weighed heavily in our conclusion in favour of finding a violation of Article 8. For the reasons we have already posited above as to the importance of robust ex ante controls, we consider that the various forms of ex post facto judicial review that were available and used by the applicant company were not sufficient to remedy the shortcomings of the initial prosecutorial decision-making. We are of the view that the applicant company was correct in relying on the Court’s established position that the absence or insufficiency of reasons at the original stage of authorisation of secret surveillance measures cannot be remedied retroactively, for example, on appeal (see Dragojević v. Croatia , no. 68955/11, 15 January 2015, and Liblik and Others v. Estonia , nos. 173/15 and 5 others, 28 May 2019). The same rationale is applicable in the present context as the further sharing of criminal data, which had not, as such, been authorised by the investigating judge, should be treated as an additional and potentially equally serious interference with the applicant company’s Article 8 rights.

16. In addition to the foreseeability of the legal framework and the quality of the general safeguards contained therein (as addressed above) – and even though the two branches of the analysis are closely interlinked in this context – it is necessary to also assess the reasons provided by the national authorities as to the necessity and proportionality of the interference in the concrete circumstances of the case.

17. The 2008 Transmission (Designation) Order included a number of instructions for public prosecutors in making transmission decisions: they should ensure that there is a legal basis for the receiving authority to receive such data; that there is no other way for that authority to obtain the information in a less intrusive way (the ultima ratio rationale); and that the transfer is actually necessary for a lawful purpose, such as enforcement of legislation. At the same time, as already noted, there appears to have been no explicit guidance on the proportionality assessment and on data minimisation criteria and procedures. Be that as it may, the absence of any reasoned decision by the prosecutor in the present case means that neither the national authorities, nor this Court are in a position to carry out a reliable and intelligent assessment as to the quality of the balancing exercise carried out by the public prosecutor. The ex post facto assessment by the national courts is not capable of remedying this omission retroactively.

18. While the preceding analysis would be sufficient for a finding of a violation of Article 8, we would also add that we are not persuaded that the ex post facto judicial review conducted by the Supreme Administrative Court for Trade and Industry was in line with Article 8 standards either. The Chamber majority concludes, within a brief paragraph, that the domestic courts “conducted an adequate balancing exercise under Article 8” – an assertion that is rather striking in its lack of any further substantiation (see paragraph 71 of the present judgment).

19. An important element of the proportionality analysis, under both national and Convention standards, is whether the use of secret surveillance methods can be justified on ultima ratio grounds. In this respect, the national court found, in rather summary fashion, that the condition had been met because price-fixing agreements “[were] not, as a rule, put in writing” (see point 4.9 of the judgment of the Supreme Administrative Court for Trade and Industry, as cited in paragraph 21 of the present judgment). With respect, we do not find such reasoning to be persuasive. To begin with, the absence of a written agreement to commit illegal acts would seem to us to be the norm rather than an exception providing justification for special measures. Secondly, the fact that the Competition Authority has no legal powers to request secret surveillance measures suggests that it is normally considered to be capable of fulfilling its competition law enforcement functions without resorting to surveillance – and that exceptional circumstances would be needed to justify such use. Finally, unlike the alleged instances of criminal bribery that gave rise to the original surveillance authorisation, price-fixing practices tend to have above-the-surface aspects that can serve as a starting ‑ point for administrative investigations.

20. In the light of the above considerations, we conclude that the national courts did not provide sufficient reasons for the necessity in a democratic society of the interference with the applicant company’s Article 8 rights.

APPENDIX

List of applicant companies:

[1] See, mutatis mutandis , the judgment of the Court of Justice of the European Union (CJEU) of 2 March 2023 in Norra Stockholm Bygg AB (C‑268/21, ECLI:EU:C:2023:145), involving a private contractual dispute in which the claimant sought to obtain the staff register data of the defendant company (held for tax-law purposes), which included staff’s personal data.

[2] See, for example, Article 4 § 2 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, which provides as follows:

“Processing by the same or another controller for any of the purposes set out in Article 1(1) [other enumerated law-enforcement purposes] other than that for which the personal data are collected shall be permitted in so far as: (a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and (b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.”

See also the opinion of Advocate-General Campos Sanchez-Bordona delivered on 30 March 2023 in Lietuvos Respublikos generalinė prokuratūra (Case C‑162/22, ECLI:EU:C:2023:266), currently pending before the CJEU (concerning a request for a preliminary ruling as to whether personal data obtained in a criminal investigation may subsequently be used in “linked” disciplinary proceedings of an administrative nature against a public official).

[3] The same cannot be said, however, of the second limb of section 39f(2)(a): “the determination, exercise or defence of a right in law” appears to be an extremely open-ended and loose threshold, capable of justifying transfers in relation to virtually any breach of the law irrespective of its level of gravity. That notwithstanding, this second limb appears to have played no role in the present case.

[4] See, mutatis mutandis , the judgment of the CJEU of 2 March 2021 in H.K . (C‑746/18, ECLI:EU:C:2021:152), addressing, inter alia , the question as to whether the Estonian public prosecutor’s office could be regarded as an independent administrative authority capable of authorising access of the investigating authority to data relating to electronic communications.