On February 16, 2015, Mr. Hernández Sierra filed a complaint with the Spanish police regarding a violent robbery, during which he was injured and his wallet and cell phone were stolen. On May 5, 2015, the Investigating Court denied the request made by the Judicial Police to order various electronic communications service providers to disclose the phone numbers activated between February 16 and February 27, 2015, with the IMEI code of the stolen cell phone, as well as the personal or identification information of the owners or users of the phone numbers corresponding to the SIM cards activated with that code, such as their first and last names and, where applicable, their address.
The Public Prosecutor's Office filed an appeal against the denial of those proceedings, citing the Supreme Court's ruling of July 26, 2010, in a similar case.
The Provincial Court of Tarragona decided to suspend the proceedings, citing the amendment to the Criminal Procedure Act (enacted by Organic Law 13/2015, of October 5, to strengthen procedural safeguards and regulate technological investigative measures) and
raised two questions for a preliminary ruling before the CJEU:
- Can the “sufficient seriousness of the offenses” as a criterion justifying interference with the fundamental rights recognized in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
be determined solely on the basis of the penalty that may be imposed for the offense under investigation, or is it also necessary to identify, in the criminal conduct, specific levels of harm to individual and/or collective legal interests? - In this case, if it were consistent with the constitutional principles of the Union, as applied by the CJEU in its judgment of April 8, 2014 [Digital Rights Ireland et al., C‑293/12 and C‑594/12, EU:C:2014:238] as standards for strict review of the Directive, what should be the minimum threshold for determining the seriousness of the offense based solely on the applicable penalty? Would it be compatible with a general provision setting a limit of three years’ imprisonment?
The CJEU addressed both issues in its judgment of October 2, 2018 (Case C-207/16). This judgment states that, in accordance with the principle of proportionality, in the context of the prevention, investigation, detection, and prosecution of crimes, a serious intrusion can only be justified by the objective of combating crime that is itself classified as serious. However, when the interference involved in such access is not serious, it may be justified by the objective of preventing, investigating, detecting, and prosecuting crimes in general.
The data requested by the Spanish police only makes it possible to link, for a specific period, the activated SIM card or cards to the stolen cell phone and the personal or identifying information of the holders of those SIM cards. Without cross-referencing this data with records of communications made using those SIM cards and location data, this information does not reveal the date, time, duration, or recipients of the communications made with the SIM cards in question, nor the locations where these communications took place, nor the frequency of such communications with specific individuals during a given period. Therefore, such data does not allow for precise conclusions to be drawn about the private lives of the individuals whose data is involved and cannot be characterized as a serious interference with those individuals’ fundamental rights.
The intrusion involved in accessing such data may be justified by the objective of preventing, investigating, detecting, and prosecuting crimes in general, as referred to in the first sentence of Article 15(1) of Directive 2002/58, without it being necessary for such crimes to be classified as serious.
Consequently, it is held that access by public authorities to data that allows for the identification of the holders of SIM cards activated with a stolen cell phone—such as the first names, last names, and, where applicable, the addresses of such holders—constitutes an interference with their fundamental rights, as enshrined in the aforementioned articles of the Charter, but is not of such a serious nature that such access must be limited to the fight against serious crime in the context of the prevention, investigation, detection, and prosecution of crimes in general.
Let us hope that this ruling will help dispel our courts’ reluctance when it comes to preventing, investigating, uncovering, and prosecuting any type of crime that requires the use of technological investigative measures, while balancing the various interests at stake without undermining the real chances of clarifying the facts.