Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive

Case C-207/16 | Court of Justice of the European Union | Grand Chamber | 2 October 2018

In Ministerio Fiscal, the CJEU clarified an important limit on the principle developed through Digital Rights Ireland and Tele2: access to retained communications data does not always have to be limited to investigations involving “serious crime.”

The answer depends on something else first: how serious is the interference with privacy and data-protection rights?

Where authorities seek communications data capable of revealing a detailed picture of a person’s private life, the interference is serious and requires correspondingly strong justification. But where the requested information is narrowly limited—for example, to identifying the subscriber associated with a SIM card—and does not reveal communications, location, relationships, or behavioral patterns, the interference may be less serious. In that circumstance, Article 15(1) of the ePrivacy Directive permits access for the investigation of criminal offenses generally, rather than only “serious” crime.

Practice takeaways: (1) Not all communications data create the same privacy risk. The analysis depends on what the requested data can actually reveal. (2) Government access remains an interference even when it is limited. A less serious interference is still subject to Articles 7 and 8 of the Charter. (3) Proportionality works in both directions. Serious interference requires serious justification; more limited interference may be justified by less weighty objectives. (4) “Serious crime” is not a universal threshold under Article 15(1). The Court tied that requirement to serious interference, rather than imposing it on every request for communications data. (5) Look at inferential power, not labels. Subscriber information, traffic data, and location data should be evaluated according to what they permit authorities to learn about a person.

The short version

The case arose from the theft of a wallet and mobile telephone in Spain.

Police investigating the theft wanted to identify the people who had used SIM cards in the stolen telephone. They sought judicial authorization requiring electronic communications providers to provide the telephone numbers corresponding to SIM cards activated with the stolen phone’s IMEI code during a 12-day period, together with identifying information about the subscribers, such as their names and, if necessary, addresses.

The requested information was therefore significantly narrower than the communications metadata at issue in Digital Rights Ireland. Police were not seeking the content of communications, the identities of the people contacted, the time or duration of calls, or location information.

The Spanish proceedings nevertheless raised a difficult question created by the CJEU’s earlier surveillance cases.

In Digital Rights Ireland, the Court had invalidated the Data Retention Directive after concluding that generalized retention of communications metadata constituted a particularly serious interference with Articles 7 and 8 of the Charter. Ministerio Fiscal correctly identifies the resulting question: what exactly counts as “serious crime,” and does EU law establish the threshold?

The Court ultimately avoided defining “serious crime.”

Instead, it asked a different and more fundamental question:

Was the interference in this particular case serious in the first place?

Its answer was no.

Because the requested data could not, without being cross-referenced with additional communications or location data, enable authorities to draw precise conclusions about the private lives of the individuals concerned, the interference was not sufficiently serious to require that the investigation concern serious crime.

Why the case matters

Ministerio Fiscal adds an important proportionality principle to the CJEU's communications-surveillance jurisprudence.

Digital Rights Ireland demonstrated why communications metadata can be extraordinarily revealing. The Court emphasized that seemingly ordinary records—when aggregated across time, location, devices, and relationships—can reconstruct significant aspects of a person's life.

Ministerio Fiscal addresses the other side of that proposition.

If the privacy risk depends in part on what data can reveal, then not every government request for communications-related data produces the same degree of interference.

The Court therefore rejected what could have become a categorical rule that authorities may access retained telecommunications data only when investigating serious crime.

Instead, the proportionality analysis operates on a sliding scale:

greater inferential power → more serious interference → stronger justification required

and conversely:

limited inferential power → less serious interference → a broader range of legitimate criminal-investigation objectives may justify access

That distinction matters well beyond stolen phones. It directs courts, regulators, and privacy professionals to examine the actual informational consequences of access rather than simply asking whether something falls within a broad category called “communications data.”

Key holding

Article 15(1) of the ePrivacy Directive permits Member States, subject to its requirements, to restrict certain confidentiality and privacy protections for specified objectives, including the prevention, investigation, detection, and prosecution of criminal offenses.

The Court held that public-authority access to data retained by electronic communications providers falls within the scope of the Directive. Government access to such data also interferes with the rights to respect for private life and protection of personal data guaranteed by Articles 7 and 8 of the Charter—even where the interference is not sufficiently serious to reveal detailed information about private life.

But the required justification depends on the seriousness of that interference.

Where access constitutes a serious interference, only the objective of fighting serious crime can justify it in the area of crime prevention and investigation.

Where the interference is not serious, Article 15(1)'s broader objective of preventing, investigating, detecting, and prosecuting criminal offences generally may provide sufficient justification.

Because the Spanish request sought only limited subscriber-identification information associated with SIM cards used in the stolen phone, the resulting interference was not serious.

Why the case matters

Digital Rights Ireland demonstrated why communications metadata can be extraordinarily revealing. The Court emphasized that seemingly ordinary records—when aggregated across time, location, devices, and relationships—can reconstruct significant aspects of a person's life.

Ministerio Fiscal addresses the other side of that proposition.

If the privacy risk depends in part on what data can reveal, then not every government request for communications-related data produces the same degree of interference.

The proportionality analysis operates on a sliding scale:

greater inferential power → more serious interference → stronger justification required

and conversely:

limited inferential power → less serious interference → a broader range of legitimate criminal-investigation objectives may justify access

Practice tip: Focus on what the data can reveal. Do not treat all “communications data” alike. Assess the actual informational consequences of access—what the data, alone or when combined with other information, can reveal about an individual’s private life.

Key holding

Government access to data retained by communications providers falls within the ePrivacy Directive and interferes with the privacy and data-protection rights protected by Articles 7 and 8 of the Charter.

The required justification, however, depends on the seriousness of the interference. Serious interference requires the objective of fighting serious crime; less serious interference may be justified by the broader objective of preventing, investigating, detecting, and prosecuting criminal offences generally.

Because the Spanish request sought only limited subscriber-identification data that could not reveal detailed information about private life, the Court found that the interference was not serious.

The Court’s analysis

1. The ePrivacy Directive applied to government access

Spain and the UK argued that EU law did not apply because the request arose from a criminal investigation. The Court disagreed. Following Tele2, it held that the ePrivacy Directive covers both measures requiring communications providers to retain data and rules governing public authorities’ access to that retained data.

Member States therefore could not avoid the Directive merely by characterizing the activity as criminal investigation.

2. Access interfered with Articles 7 and 8

The Court confirmed that government access to personal data held by communications providers interferes with the Charter rights to privacy and data protection.

Importantly, whether an interference exists is separate from how serious it is. Access may interfere with Articles 7 and 8 even when the information is not conventionally “sensitive” and the resulting intrusion is limited.

3. “Serious crime” depends on the seriousness of the interference

Article 15(1) refers to the prevention, investigation, detection, and prosecution of criminal offenses generally—not only serious crime.

The serious-crime threshold in earlier cases arose from proportionality: where access creates a serious interference with privacy, it must be justified by a correspondingly important objective, such as fighting serious crime.

Thus, serious crime is not automatically required whenever authorities seek communications-related data.

4. What could the requested data reveal?

The police sought telephone numbers and identifying information for SIM cards activated with the stolen phone during a 12-day period.

They did not seek communications content, recipients, dates or duration of communications, location information, or communication frequency. Without combining the requested information with communications or location data, authorities could not draw precise conclusions about the individuals’ private lives.

That distinguished the request from the far more revealing data considered in Digital Rights Ireland.

5. The interference was not serious

Because the requested information had limited capacity to reveal private life, the Court found that the interference was not sufficiently serious to trigger a serious-crime requirement.

The Court therefore did not need to define “serious crime.” Article 15(1)'s broader objective of preventing, investigating, detecting, and prosecuting criminal offenses could justify this more limited access, subject to proportionality.

What the Court did—and did not—decide

The Court did not define “serious crime” or decide whether the concept has an autonomous meaning under EU law. It therefore left unanswered the Spanish court’s questions about whether seriousness should be determined by the potential sentence or a particular minimum threshold.

The judgment also did not require Member States to permit access for ordinary offenses. It established the limits imposed by EU law; national law remains free to impose stricter conditions on government access.

The Advocate General’s Opinion

Advocate General Henrik Saugmandsgaard Øe reached essentially the same result as the Court. His key insight was that the analysis should begin not by defining “serious crime,” but by determining the seriousness of the interference with Articles 7 and 8 of the Charter.

Government access to retained personal data constitutes an interference even if the data are not sensitive. But not every interference is equally serious. Here, the police sought limited identifying information associated with SIM cards used in the stolen phone—not communications content, detailed communications histories, or location data. The Advocate General compared the request to identifying the owner of a vehicle used in an offense and distinguished it from the revealing communications data at issue in Digital Rights Ireland and Tele2.

Accordingly, the interference was not sufficiently serious to require that the investigation concern serious crime. This approach also reflected the text of Article 15(1), which refers to the prevention, investigation, detection, and prosecution of “criminal offenses” generally.

The Advocate General went further than the Court on an issue the judgment ultimately avoided. He considered that “serious crime” should principally be defined by Member States, subject to EU fundamental-rights and proportionality requirements. If an EU-level definition were nevertheless required, he rejected reliance on a prison-sentence threshold alone, favoring consideration of factors such as the nature of the offense, the interests affected, and the applicable penalty.

The Court adopted the Advocate General’s principal approach but stopped there: because the interference was not serious, it had no need to define “serious crime” or establish a minimum sentencing threshold.

Conclusion

Ministerio Fiscal did not retreat from the privacy protections developed in Digital Rights Ireland. It refined the proportionality analysis underlying them.

The question is not only whether authorities can access the data. It is what the data allow them to know.

Government access to retained telecommunications data engages Articles 7 and 8 of the Charter. But not every interference has the same weight, and therefore not every interference requires the same justification.

When access permits authorities to reconstruct significant aspects of a person's private life, the interference is serious and requires correspondingly strong justification.

When access is narrowly confined to information that cannot produce those conclusions, the interference may be less serious—and Article 15(1) does not require the underlying investigation to concern serious crime.

Sources and additional resources

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union's official case-law database. Cases can be located by searching the case name or case number (for example, C-207/16).

Search CJEU case law on InfoCuria

• Court of Justice of the European Union, Grand Chamber, Case C-207/16, Ministerio Fiscal**, Judgment of 2 October 2018, ECLI:EU:C:2018:788.
• Opinion of Advocate General Henrik Saugmandsgaard Øe, Case C-207/16, Ministerio Fiscal**, delivered 3 May 2018, ECLI:EU:C:2018:300.

Related reading from The de la Torre Review

• “Promusicae: When an IP Address Becomes a Person.” An earlier CJEU decision examining how technical identifiers such as IP addresses can be linked to subscriber information and become personal data. The case also established an important fair-balance principle for reconciling privacy with other fundamental rights. Read the article.
• “Tele2: When Copyright Enforcement Meets Communications Privacy.” A closer look at the 2009 CJEU decision holding that EU law may permit disclosure of subscriber data for civil copyright enforcement, while requiring Member States to strike a fair balance between copyright, privacy, and other fundamental rights and respect proportionality. The case also confirms that basic Internet access providers qualify as “intermediaries” under EU copyright law. Read the article.
• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” A closer look at the 2014 judgment that invalidated the Data Retention Directive and established communications metadata as capable of revealing detailed information about an individual’s private life. It provides the doctrinal starting point for understanding Ministerio Fiscal. Read the article
• “Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story.” Ireland drew an important distinction between providers’ obligations to retain communications data and public authorities’ subsequent access to and use of those data. The Data Retention Directive regulated the former but not the latter. Ministerio Fiscal sits on the other side of that line, examining when government access to retained communications data interferes with fundamental rights and how the seriousness of that interference affects the proportionality analysis. Read the Article.
• “Rijkeboer: When the Right of Access Reaches Into the Past.” An earlier CJEU decision applying proportionality to the relationship between retention and access. Although it concerned a data subject’s access rights rather than government access to communications data, Rijkeboer similarly rejects categorical retention rules in favor of a context-specific balance between competing interests. Read the Article.
• “What Is the Charter of Fundamental Rights of the European Union?” An introduction to the Charter and its role as EU primary law, including Articles 7 and 8 on privacy and data protection and Article 52’s framework for limitations on fundamental rights. Read the Article