CJEU clarifies limits on NCAs’ powers to seize business emails and access employees’ personal devices during inspections

National Competition Authorities (NCAs) across the EU increasingly rely on digital evidence when investigating alleged competition law infringements. Emails, instant messages and other electronic communications have become central sources of evidence during dawn raids and inspections. However, these investigative powers must be balanced against businesses' and individuals' fundamental rights to privacy and data protection.

In a significant judgment delivered on 16 July, in joined Cases C-258/23, Imagens Médicas Integradas, C-259/23, Synlabhealth II and C-260/23, SIBS, Sociedade Gestora de Participações Sociais and Others, the Court of Justice of the European Union (CJEU) clarified the extent to which business emails are protected under EU law and the procedural safeguards that must accompany their seizure during competition investigations. In particular, the judgment addresses a key issue in competition enforcement: how to balance effective investigations of suspected competition law breaches with the fundamental rights to privacy, confidentiality of communications and protection of personal data. 

The ruling is expected to impact the conduct of competition investigations across the EU and provides important and long desired guidance for both NCAs and businesses.

Background and Facts

The case originates from three investigations carried out by the Portuguese Competition Authority (Authority) into suspected infringements of Articles 101 and 102 TFEU in the healthcare and payments sectors. The investigations concerned alleged price coordination in healthcare services and COVID-19 testing, as well as a suspected abuse of dominance in payment processing services.

To gather evidence, the Authority – after obtaining warrants from the Portuguese Public Prosecutor’s Office – carried out dawn raids at the premises of the companies IMI – Imagens Médicas Integradas S. A., Synlabhealth II S. A. and SIBS group. During the inspections investigators examined employees’ corporate email accounts and seized thousands of computer files considered relevant to the investigations.

The companies challenged the legality of the inspections before the Portuguese Competition Court. They argued that the emails of their employees constitute protected “communications” under Article 7 of the Charter of fundamental rights of the European Union (Charter) and that in any event the seizure should have been authorised by an investigating judge rather than by the Public Prosecutor’s Office.

The Competition Court referred the following three questions to the CJEU for a preliminary ruling:

• Do business emails qualify as protected “communications” under Article 7 of the Charter?
• Can NCAs seize those emails during antitrust investigations?
• If so, is authorisation by a judicial authorisation such as the Public Prosecutor sufficient, or is prior authorisation issued by a court required?

The CJEU’s judgment

Business emails are protected communications within the meaning of Article 7 of the Charter

The CJEU began its analysis by pointing out that Article 7 of the Charter, relating to the right to respect for private and family life, contains rights corresponding to those guaranteed by Article 8(1) of the European Convention on Human Rights (ECHR). Article 7 of the Charter is thus to be given the same meaning and the same scope as Article 8(1) ECHR, as interpreted by the case-law of the European Court of Human Rights (ECtHR). In this regard, the ECtHR’s case law has established that communications from business premises, just like those from a person’s home, fall within the scope of Article 8 ECHR. Therefore, the concept of protected “communications” under Article 7 of the Charter should equally be interpreted as covering email exchanges through a company’s email system.

Importantly, the CJEU emphasized that this protection applies regardless of the form or content of the emails, i.e., whether they have been classified as business-related and regardless of whether they have already been received, read, deleted or stored on company equipment.

Competition authorities may access business emailssubject to effective procedural safeguards against abuse and arbitrariness

The CJEU pointed out that the seizure of business documents by an NCA may concern not only the right to privacy provided by Article 7 of the Charter, but also the right to personal data protection provided by Article 8 of the Charter. Therefore, the seizure of emails in the course of inspections at professional premises constitutes a limitation of the exercise of those rights. 

The CJEU clarified that such limitations may be allowed if they are provided for by law, they respect the essence of those rights, they genuinely pursue an objective of general interest, and they are in line with the principle of proportionality, i.e., they are appropriate, necessary and there are no other as efficient but less invasive alternatives. 

In essence, according to the CJEU it is a matter of balancing the objective of general interest against the rights at issue, in order to ensure that any disadvantages caused by the limitations are not disproportionate to the aims pursued: “Thus, the possibility of Member States justifying a limitation of the rights guaranteed by Articles 7 and 8 of the Charter must be assessed by measuring the seriousness of the interference which such a limitation entails and by verifying that the importance of the objective of general interest pursued by that limitation is proportionate to that seriousness”

The CJEU considered that this balancing test was met in this case. The CJEU stressed that “the guarantee of undistorted competition” is an EU recognised objective of general interest capable of justifying limitations on fundamental rights. Therefore, NCAs are not prevented from examining business emails. In fact, it is difficult to consider an as effective but less intrusive alternative to the seizure of business emails. The CJEU followed the Opinion of Advocate General Medina and considered that business emails frequently provide the most direct evidence of anti-competitive conduct, making them an indispensable investigative tool. According to the Court “depriving [NCAs], as a matter of principle, of the power to seize such electronic communications related to the business would be liable to undermine the effective pursuit of the fight against cartels and abuses of dominant positions within the internal market required by Articles 101 and 102 TFEU.” In any case, searches must remain strictly limited to material relevant to the subject matter of the investigation.

The CJEU pointed out that the provisions of EU law concerning the implementation of the competition rules do not require a court to grant prior authorisation for an inspection to be carried out at business premises. However, in the absence of such prior authorisation issued by a court, the protection of individuals against abuse and arbitrariness requires a legal framework, a strict limitation of the measures at issue and safeguards in the form of a full ex post judicial review. This must provide the data subjects with appropriate redress, allowing the admissibility of the evidence gathered to be assessed. In the case at issue, the authorisation for the seizures granted by the Portuguese Public Prosecutor is likely to contribute to the strict legal framework for the inspections and seizures carried out by the Portuguese NCA.

Finally, and importantly, the CJEU distinguished searches of company systems from access to personal devices such as mobile telephones, computers or other computer storage media belonging to the managers and employees of the company under investigation. The CJEU relied on an earlier judgment in Case C-548/21, Bezirkshauptmannschaft Landeck, concerning the protection of fundamental rights in the context of a criminal investigation and stressed that since such devices may be used simultaneously for private purposes and for professional or business purposes, access may involve sensitive data and therefore give rise to a significantly greater interference with the fundamental rights to private life and personal data. If that is the case, access to such data must be subject to prior review by a court or an independent administrative body that has all the powers “to strike a fair balance between, on the one hand, the legitimate interests relating to the needs of the investigation and, on the other hand, the fundamental rights to respect for private life and protection of personal data of the persons whose data are concerned by the access.”

Practical implications/Key takeaways

The CJEU’s ruling strikes an important balance between effective competition enforcement and the protection of fundamental rights to privacy and data protection.

The judgment concludes that NCAs retain broad powers to access and seize business emails during antitrust investigations as email correspondence continues to be one of the primary sources of evidence in cartel and abuse of dominance cases. However, the CJEU also clarified that business emails are protected communications under the Charter of fundamental rights. Access to those communications must therefore be subject to a robust and strict legal framework. The key safeguard is not necessarily prior court authorisation but effective judicial review capable of ensuring any interference with privacy is necessary, proportionate and properly justified.

Further developments in national enforcement practices and more comprehensive judicial scrutiny of investigative measures affecting electronic communications can be expected as a result of this ruling. At the same time, dawn raid preparedness becomes even more crucial. Companies should regularly review and update their dawn raid procedures to address access to electronic communications, including email accounts, messaging platforms and digital document repositories, document retention policies; handling of inspectors’ requests for electronic data and protocols for employee interactions with investigators. In the context of an inspection, business – assisted by their counsel – should carefully review the scope and legal basis relied upon by NCA, the categories of documents being reviewed and seized, whether appropriate procedural safeguards are being respected and the available avenues for judicial challenge after the inspection in accordance with the CJEU’s ruling. 

Particular care should be given in case an NCA wishes to access a personal device. In its judgments in Cases T-451/20 and T-452/20, Meta Platforms Ireland v European Commission, the General Court (GC) assessed the European Commission’s (Commission’s) requests to Meta to provide internal documents prepared by or for, or received by, certain custodians, that were responsive to certain search terms, but were wholly unconnected to Meta’s commercial activities and contained sensitive personal data, subject to a data room procedure. The GC found that this processing of even sensitive personal data by the Commission is allowed, provided that adequate procedural safeguards are put in place to ensure that the interference with the right to privacy is proportionate. The set up of a data room or judicial review ex-post would constitute sufficient protection according to the GC. 

In its current judgment, the CJEU appears to go further. It acknowledged the need for heightened procedural safeguards before authorities may access personal devices, precisely due to the extensive and potentially sensitive personal data they contain and introduced an important additional level of protection: where NCAs wish to access such personal devices, after sealing them, access must be subject to prior review by a court or an independent administrative body. In this regard, businesses should design and implement clearly articulated policies governing the use of personal devices for work purposes, as searches involving employee-owned devices may raise additional privacy concerns and trigger stricter procedural requirements.