Access by public authorities to electronic data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone: not limited to serious criminal offences since it is a non-serious interference with fundamental rights.

On 16 February 2015, Mr. Hernández Sierra filed a complaint with the Spanish police for a violent robbery, during which he was injured and his wallet and mobile telephone were stolen. On 5 May 2015, the Examining Magistrates’ Court rejected the request made by the police to order various providers of electronic communications services to provide the telephone numbers activated between 16 February and 27 February 2015 with the IMEI code of the stolen mobile telephone and the personal data concerning the identity of the owners or users of the telephone numbers corresponding to the SIM cards activated with said code, such as their forenames, surnames, and, if necessary, their addresses.

The Public Prosecutor’s Office lodged an appeal against the rejection of the request, invoking the judgment of 26 July 2010 handed down by the Supreme Court in a similar case. The Provincial Appellate Court of Tarragona decided to stay the proceedings, recalling the amendment of the Code of Criminal Procedure (enacted under Organic Act No. 13/2015 of 5 October 2015, strengthening procedural due process and regulating technological investigative measures), and referred two questions to the CJEU for a ruling:

  1. Can the sufficient seriousness of offences, as a criterion which justifies interference with the fundamental rights recognised by Articles 7 and 8 of the Charter of Fundamental Rights of the EU, be determined taking into account only the sentence which may be imposed in respect of the offence investigated, or is it also necessary to identify in the criminal conduct particular levels of harm to individual and/or collective legally protected interests?
  2. If it were in accordance with the constitutional principles of the European Union, used by the CJEU in its judgment of 8 April 2014 [Digital Rights Ireland and Others, C-293/12 and C-594/12] as standards for the strict review of the Directive, to determine the seriousness of the office solely on the basis of the sentence which may be imposed, what should the minimum threshold be? Would it be compatible with a general provision setting a minimum of three years’ imprisonment?

The CJEU ruled on both questions in its judgment of 2 October 2018 (case C-207/16).

In this judgment, it is stated that pursuant to the principle of proportionality, in the areas of prevention, investigation, detection and prosecution of criminal offences, a serious interference may be justified only by the objective of fighting crime which must also be defined as serious. However, when the interference entailed by such access is not serious, it may be justified by the objective of preventing, investigating, detecting and prosecuting criminal offences generally.

The data sought by the Spanish police only enable the SIM card or cards activated with the stolen mobile telephone to be linked, during a specific time period, with the data concerning the identity of the owners of those SIM cards. Without checking those data against the data concerning the communications made with those SIM cards and the location data, it is not possible to determine the date, time, duration or recipients of the communications made with the SIM cards in question, or the locations where the communications were made, or the frequency of those communications with certain people during a certain time period. Therefore, said data do not allow precise conclusions to be drawn regarding the private lives of the persons whose data is affected, and therefore it cannot be regarded as a serious interference in the fundamental rights of those individuals.

The interference entailed by access to said data may be justified by the objective of preventing, investigating, detecting and prosecuting criminal offences generally, as referred to in the first sentence of Article 15(1) of Directive 2002/58, without it being necessary that those criminal offences be defined as serious.

Consequently, it is stated that the access of public authorities to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as forenames, surnames, and if necessary, their addresses, constitutes interference with their fundamental rights, enshrined in the aforementioned articles of the Charter, which is not sufficiently serious to mean that said access is to be limited, in the areas of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime.

Let us hope that this judgment helps to reduce the reluctance of courts in Spain, when it comes to prevention, investigation, detection and prosecution of any type of crime in which technological investigative measures are required, encouraging them to weigh the different interests involved but without hindering the chances of establishing the facts of the matter.

  Author: Juan José Caselles

Visit our website: http://www.elzaburu.es/en