Do the fundamental rights to the protection of private life (Article 7 of the Charter[1]) and of personal data (Article 8 of the Charter[2]) preclude competition authorities from seizing professional emails during inspections without prior judicial authorisation?
This is the question addressed by Advocate General (“AG”) Medina in her Opinions of 20 June 2024[3] (“First Opinion”) and 23 October 2025[4] (“Second Opinion”) in IMI/Synlabhealth II.
In the First Opinion, the AG advised the Court of Justice of the European Union (“CJEU”) that:
- Professional emails constitute “communications” protected under Article 7 of the Charter but may nevertheless be seized if objectively justified, for example to investigate antitrust violations.
- Article 7 of the Charter does not preclude the seizure of company emails without prior judicial authorisation, provided that the law ensures effective safeguards against abuse and arbitrariness through ex-post judicial review.
- Equally, national law may require prior judicial authorisation and may provide that emails seized without such prior authorisation are excluded from the authority’s file, if doing so respects the principle of effectiveness and does not render enforcement of Articles 101 and 102 TFEU impossible or excessively difficult. If this is not the case, national law may need to be disapplied.
In the Second Opinion, the AG advised the CJEU that:
- As with Article 7, the seizure of company emails without prior judicial authorisation does not breach Article 8 of the Charter provided that adequate legal safeguards and ex-post judicial review are in place.
- The recent Landeck ruling[5], in which the Court ruled that the seizure of a mobile phone in the context of a criminal investigation should be subject to prior authorisation, is not applicable to the seizure of company emails as, inter alia, the seized emails do not, in principle, reveal precise and extensive information about the data subjects’ private lives.
- Even if the Court considers Landeck applicable to the antitrust inspections in the case at hand, the Portuguese Public Prosecutor should be considered as an independent body competent to grant prior authorisation in the manner required by Landeck.
Across both Opinions, AG Medina applied a structured proportionality test consistent with Landeck and other important CJEU case law. The forthcoming judgment will likely become a key reference point for reconciling fundamental rights with investigatory powers in EU competition law.
1. Background
The case arises from three identical requests for a preliminary ruling submitted by a Portuguese court[6] in three parallel cases concerning antitrust inspections.
Three groups of companies,[7] which had been dawn raided by the Portuguese Competition Authority on suspicions of national and EU competition law infringements, challenged before the Portuguese Court the legality of the seizure of employees’ emails during the inspections. Importantly in this case, the inspections had been authorised by the Public Prosecutor’s Office only, and not by a judicial authority.
In two rulings of March and May 2023 in separate cases, the Constitutional Court of Portugal ruled that the provision allowing the Portuguese Competition Authority to search and seize emails based solely on the Public Prosecutor’s authorisation was unconstitutional, and that a judicial authorisation was needed.
In this shifting context, the Portuguese Court asked the CJEU, firstly, whether professional emails exchanged between employees and managers within a company constitute protected “communications” under Article 7 of the Charter. Secondly, the Court asked whether national competition authorities (“NCAs”) may lawfully seize such emails when carrying out antitrust inspections solely on the basis of the Public Prosecutor’s authorisation, as under Portuguese law.
The CJEU initially sought to resolve the case swiftly and without a hearing. However, after AG Medina’s First Opinion, the CJEU re-allocated the joined cases to the Grand Chamber and held a hearing on 3 June 2025. This reallocation was seemingly prompted by the Landeck judgment, in which the CJEU held that the seizure of mobile phones in the context of criminal investigations must be subject to prior review by a court or an independent administrative body. The CJEU then asked AG Medina to address the implications of the Landeck judgment for the case at hand in a supplementary opinion.
2. The AG’s First Opinion
In her first Opinion, the AG examined the application of Article 7 of the Charter in the context of the antitrust inspections in question.
A. Professional emails are protected “communications” under Article 7 of the Charter but can be seized to the extent that they are relevant to the investigation
First, AG Medina concluded that emails exchanged between employees and managers within a company, even if classified as professional, should be considered as “communications” within the meaning of Article 7 of the Charter and were thus protected.[8] She further emphasised that this protection covers not only the content of the emails but also extends to personal data related to the traffic they generate.[9]
Second, AG Medina recalled the well-known principle that, in accordance with Article 52 of the Charter, restrictions to Article 7 of the Charter were acceptable if they are provided for by law and respect the essence of that right and if, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others.[10]
In this respect, the AG found that the seizure of emails was provided by law (principle of legality),[11] respected the essence of the fundamental right at stake (given that only emails related to the investigation’s subject matter were seized, thus concerning the employees’ professional activities rather than their personal or private lives[12]), and complied with the principle of proportionality,[13] as the measures served a matter of public policy, namely the protection of competition in the market, as long as only relevant emails were placed on the file.[14] The AG thus concluded that Article 7 of the Charter does not preclude an NCA from searching for and seizing a company’s emails, provided that those emails are relevant to the subject matter of the inspection.[15]
B. The seizure of professional emails, without prior judicial authorisation, does not violate Article 7 of the Charter
In line with settled case law, the AG concluded that Article 7 of the Charter does not preclude the seizure of company emails during inspections, even without prior judicial authorisation, as long as the law provides for effective safeguards against abuse and arbitrariness through ex-post judicial review.[16]
The AG, however, considered that Member States remain free to impose greater national constitutional protections, such as requiring prior judicial approval for the seizure of emails, provided that such rules do not undermine the primacy, unity or effectiveness of EU law.[17]
The Portuguese Competition Authority objected that, in this case, applying the Constitutional Court 2023 judgments could lead to the invalidation of the decisions sanctioning the companies for competition law infringements (if evidence illegally collected was set aside). In this regard, the AG considered that national law may include rules excluding evidence obtained illegally, e.g., without the required judicial authorisation (as in this case), provided that these rules comply with the principle of effectiveness, and do not render enforcement of Articles 101 and 102 TFEU impossible or excessively difficult.[18]
According to the AG, this means that, in the case at hand, the national court should, when drawing the consequences of the Constitutional Court 2023 judgments, assess whether there is a way of redressing the lack of prior authorisation by means of ex-post judicial review, to ensure that the non-observance of the EU antitrust rules is penalised.
The AG also advised that Portuguese courts should consider disapplying national law allowing the constitutional judgments to have retroactive effect in cases in which the Portuguese Competition Authority had already made a final finding of infringement (as in this case[19]), to avoid creating a systemic risk of impunity.[20]
It is unclear whether the CJEU will actually rule on the above issue, as it seems to go beyond what the national court asked.[21] Yet, it raises an interesting constitutional question concerning the balancing between national constitutional rights and EU antitrust rules, which we may see resurface in other cases if the CJEU remains silent in this case.
3. The AG’s Second Opinion
In the Second Opinion, the AG focused on the application of Article 8 of the Charter, examining if the findings of the Landeck case were applicable in the case at hand.
The AG expectedly applied the same framework of analysis as for Article 7, and concluded that the seizure of emails during an inspection may constitute a restriction of the right to the protection of personal data, but that such restriction is acceptable (as per Article 52 of the Charter) if it is provided by law, does not affect the essence of the right and does not violate the principle of proportionality.
In particular, the AG found that such seizures have a valid legal basis under the General Data Protection Regulation (“GDPR”) – which allows data processing when necessary for the performance of a task carried out in the public interest – and the Portuguese Law on Competition.[22] She further held that these measures do not undermine the essence of Article 8 of the Charter given that they do not lead to an unlimited access to personal data.[23] Finally, the AG found that the seizure of professional emails in the context of antitrust inspections does not breach the principle of proportionality.[24]
In this regard, in line with the Landeck ruling, the AG indicated that the proportionality analysis should balance all the relevant factors, including:
- the seriousness of the limitation thus placed on the exercise of the fundamental right at issue;
- the importance of the objective of general interest pursued by that limitation;
- the link existing between the owner of the documents seized and the offence in question; and
- the relevance of the data in question for the purpose of establishing the facts.
In that balancing exercise, the AG found several distinctions between the case at hand and Landeck. In Landeck, the police seized a suspect’s personal mobile phone within a private residence, acquiring full and uncontrolled access to all of its data.[25] In that case, the CJEU found that access to personal data contained in a mobile phone was “liable to allow very precise conclusions to be drawn concerning the private life of the data subject, such as his or her everyday habits, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of that data subject and the places he or she frequents socially”. [26]
By contrast, according to the AG, the seizure of professional emails “do[es] not, in principle, allow “very precise” conclusions to be drawn on the data subject’s private lives.”[27] Further, any such data is, in any event, only collected in an ancillary manner and sparsely, without really giving the authority the possibility of realising a thorough and detailed profile of certain personal aspects of the lives of the individuals concerned.[28] The AG considered that the interference with the fundamental right was thus, not very serious, unlike in Landeck. In addition, the AG distinguished Landeck insofar as it concerned a criminal investigation against an individual, whereas competition authorities’ investigations in principle concern target companies.
The AG considered that to assess the proportionality of the restriction to Article 8 of the Charter, account must also be taken of the procedural safeguards of data processing imposed on the NCA by Article 5 of the GDPR, including the following[29]:
- The investigation must be based on a duly reasoned decision.
- When using computer investigation software, keyword searches must be used related to the investigation’s defined subject matter.
- Natural persons must be informed openly and consistently about data processing and their rights in line with the principles of fairness and transparency.
- Personal data must be securely stored only as long as necessary, accessed by accredited officials and permanently deleted once no longer needed.
- Data collection and access must be carried out in the presence of representatives of the undertaking.
- Irrelevant to the investigation personal data in seized documents must be anonymised in line with the principle of minimisation.
In this context, the AG considered that, as for Article 7, Article 8 of the Charter did not require an ex-ante judicial authorisation for the seizure of professional emails.
First, the AG noted that competition law required ex-ante judicial approval only where the seizure took place at individuals’ private homes or premises, protecting “the most sensitive areas of a person’s private life”.[30]
Second, by (an interesting) analogy with the Consob[31] judgment, the AG considered that an ex-ante judicial authorisation may be required if the objective of the investigation is also to establish the criminal liability of the person concerned by the seizure, and not that of its employees.
Third, outside these two cases, the AG considered that no ex-ante authorisation was required to the extent that ex-post review, including concerning the existence of a possible breach of Article 8 of the Charter, was available during the investigation. The AG referred specifically to recent case law of the European Court of Human Rights that made it clear that such ex-post review needs to cover the conduct of the inspection and had to be available within a reasonable time, i.e., not only at the same time as a challenge of a final decision of the authority.[32]
On this basis, the AG concluded that prior judicial authorisation is not required in situations such as the one at issue, where the circumstances differ materially from those in Landeck and sufficient legal safeguards are in place.
As a final point, the AG added that even if the CJEU were to follow Landeck, the Portuguese Public Prosecutor’s Office could still be considered as an independent body capable of granting prior authorisation in a manner required in Landeck. [33]
4. Key Takeaways
These joined cases provide important clarifications, and a well-designed framework of analysis, on the balancing between fundamental rights and effectiveness of antitrust inspections.
According to AG Medina’s First and Second Opinions, the seizure of professional emails during antitrust inspections without prior judicial authorisation, does not infringe Articles 7 and 8 of the Charter, provided that adequate procedural safeguards and ex-post judicial review are in place.
At a high level, we flag the following takeaways:
- The degree of seriousness of the interference in the fundamental rights drives the level of safeguards that must be implemented: ex-ante access to private phones will require higher safeguards than access to professional emails.
- Who is the target of the procedure matters: investigations against companies will require lower safeguards than investigations against private individuals. The seriousness of the allegations will matter as well.
- Depending on these factors, ex-ante judicial authorisation might need to be available; where it is not, ex-post judicial authorisation is enough, but the AG flags that it must be available also during the investigation – i.e., the system cannot just foresee a challenge of a final fining decision by the NCA. This principle was already foreseen in the CJEU decision in French Retailers[34], but its application remains unclear (see in this regard the recent Red Bull case[35], in which the General Court of the European Union (“GC”) found that challenging the conduct of the investigation together with the inspection decision is inadmissible).
By rejecting the applicability of the Landeck judgment to the seizure of professional emails, the AG also leaves open an interesting question for the antitrust practitioners: what about the seizure of mobile phones (especially those for dual private and professional use), a measure commonly taken by NCAs during inspections?
The answer is not straightforward given that the Landeck analysis was multifactorial and as is often the case, the judgment does not make it clear which factor holds the strongest weight.
On the one hand, the CJEU seemingly placed a lot of weight on the fact that access to a private mobile phone provided a lot of personal data (and potentially gave access to sensitive data). The same conclusion would apply to a phone used both privately and professionally and seized in an antitrust inspection.
On the other hand, there would be similar mitigating factors as in the AG opinion: antitrust investigations generally target companies; inspectors only search for unlawful commercial practices which are well-defined in the inspection decision; they use targeted keywords such that collection of personal information is likely ancillary and sparse; procedural safeguards are (must) be implemented, including allowing the presence of company representatives when the phones are searched. Where the EU courts would land on this proportionality assessment will be for another case. While we are waiting for the CJEU’s ruling in IMI/Synlabhealth II, AG Medina’s pair of opinions must, in any case, be commended for adding clarity and systematicity in the assessment required to balance the respect for fundamental rights and antitrust inspections.
[1] Article 7 of the EU Charter of Fundamental Rights (“Charter”) covers the right to respect for private and family life.
[2] Article 8 of the Charter covers the right to the protection of personal data.
[3] Opinion of AG Medina in Joined Cases C-258/23 to C-260/23, 20 June 2024, EU:C:2024:537.
[4] Opinion of AG Medina in Joined Cases C-258/23 to C-260/23, 23 October 2025, EU:C:2025:814.
[5] CJEU, Case C-458/21, Bezirkshauptmannschaft Landeck, 4 October 2024, EU:C:2024:830.
[6] The Competition, Regulation and Supervision Court of Portugal (“Portuguese Court”).
[7] IMI – Imagens Médicas Integradas S.A. (“IMI”), several companies within the SIBS group (together, “SIBS”) and Synlabhealth II S.A. (“Synlabhealth”).
[8] Opinion of AG Medina in Joined Cases C-258/23 to C-260/23, 20 June 2024, EU:C:2024:537, para 30.
[9] Ibid., para 31.
[10] Ibid, para 33.
[11] Ibid., para 34.
[12] Ibid., para 35.
[13] Ibid., paras 37-38.
[14] Ibid., para 36.
[15] Ibid., para 39.
[16] Ibid., para 45.
[17] Ibid., paras 47-54.
[18] Ibid., paras 59-60.
[19] In the case at hand, the companies involved were found to have breached EU competition rules and fined. See IMI’s fining decision here; SIBS’s fining decision here; and Synlabhealth’s settlement decision here.
[20] Opinion of AG Medina in Joined Cases C-258/23 to C-260/23, 20 June 2024, EU:C:2024:537, paras 61-62.
[21] Ibid., para 57.
[22] Opinion of AG Medina in Joined Cases C-258/23 to C-260/23, 23 October 2025, EU:C:2025:814, paras 11-14.
[23] Ibid., paras 15-18.
[24] Ibid., paras 19-32.
[25] Ibid., para 25.
[26] CJEU, Case C-458/21, Bezirkshauptmannschaft Landeck, 4 October 2024, EU:C:2024:830, para. 93.
[27] Ibid., para 30.
[28] Ibid., paras 28-29.
[29] Ibid., paras 32-36.
[30] Ibid., para 40.
[31] CJEU, Case C-481/19, Consob, EU:C:2021:84.
[32] Ibid., para 43. See also para 45 (“…in particular in the form of an ex post facto judicial review of the measures at issue, both during and at the end of the investigation procedure) (emphasis added).
[33] Ibid., para 47.
[34]CJEU, Case C-693/-20P, Intermarché Casino Achats v Commission, EU:C:2023:172, para 55.
[35] GC, Case T-306/23, Red Bull and Others v Commission, EU:T:2025:959.
Leave a Reply