ECtHR: The Ukraine Failed to Protect Workplace Privacy
On 6th November, the ECtHR ruled that the Ukrainian courts had not met their positive obligations to respect the applicant’s workplace privacy in relation to the surveillance of his mobile phone by his employer in Guyvan v Ukraine. As to the facts of the case, the applicant owned a mobile phone, which he used both for private and professional purposes. Only later did his employer enter into contract with the mobile phone operator and began to pay for his calls, and assigned this phone number as a working phone number. Following this, the employer introduced restrictions on the use of the mobile phone, including on international roaming charges. Thus, these would be paid for by the employer only when employees would be on an official business trip, otherwise the incurred charges would be deduced from the concerned employee’s salary. In February 2015, the applicant’s employer initiated internal investigations against Mr Guyvan, based on findings that his work phone had incurred international roaming charges when the employee’s attendance register indicated he was at work. In the course of these investigations, the employer requested detailed information from the mobile operator for the period 1 January 2014 – 31 January 2015. The provided information contained ‘the date and time of the communication, whether the communication had been incoming or outgoing, the foreign telephone company used for roaming services, the country in which the roaming services had been used, the telephone number to or from which the communication with the applicant’s mobile phone had been made, whether the communication had been a voice call or a text message, and the duration of the calls’. In September 2015, the applicant complained before the national courts ‘that his employer had been collecting information of a personal nature about him and had refused his request for access to the data it had thus collected, in violation of the Personal Data Protection Act’. The dispute escalated to the ECtHR. Only in the course of the proceedings before the ECtHR in 2023 did the applicant learn that his employer had also launched criminal investigations with the local police in 2015. Before the ECtHR, the applicant complained that his Article 8 ECHR right to private life had been violated, because the domestic courts had failed to uphold his rights in relation to his employer having processed his personal data. The ECtHR decided to examine the complaint in the framework of the State’s positive obligations. It observed that ‘it appears that the P. company was entitled to receive information from the mobile phone operator for the purpose of establishing what calls and messages fell within the category of work communications and, accordingly, whether their costs should be borne by the company or the applicant. However, the employer’s requests of 6 and 26 February 2015 (see paragraph 10 above) were made with the very different and unrelated purpose of collecting and processing data which could reveal the applicant’s location abroad on particular dates. Furthermore, the data in question included information about the telephone numbers with which the applicant had been in contact and the countries in which roaming services had been provided, even though, by the authorities’ own admission, that information was not necessary for the purpose of establishing whether or not the applicant had been at his workplace… The Court considers that the collection and processing of data in such a way affected the applicant’s privacy. Whether such collection and processing was justified in the light of the Bărbulescu criteria was primarily a question for the domestic authorities to answer. However, the national judicial bodies did not make a full assessment of that issue as they instead concluded that the information obtained by the P. company from the mobile phone operator had not concerned the applicant’s personal data’. Thus, the Court concluded that the applicant’s right to privacy under Article 8 ECHR had been violated.
ECtHR: Switzerland Did Not Violate Prisoner’s Correspondence Confidentiality
On 6th November, the ECtHR ruled that Switzerland did not violate the right to confidentiality of prisoner’s correspondence in A.V. v Switzerland. As to the facts of the case, the applicant was placed in pre-trial detention in 2017 for attempted murder of her daughter. She complained that her right to confidentiality of correspondence under Article 8 ECHR had been violated by the prison authorities on account of the fact that they monitored systematically all her correspondence, except that with her lawyer. In its judgment, the Court first observed that there was indeed an interference with her correspondence, but that this interference had a legal basis in domestic law and pursued legitimate purposes, such as the prevention of disorder inside and outside the prison, and the commitment of further offences. As to the necessity and proportionality of the interference, the Court noted that the monitoring of the correspondence did not result in delays in or blocking of the delivery of the letters. It also noted that there were remedies in domestic law, of which the applicant made use. Thus, the Court concluded that there was no violation of Article 8 ECHR. Editor’s note: the judgment is available only in French and hence the above summary is based on the editors’ translation of the judgment and the short summary in English thereof in the Court’s press release of 6th November 2025.
ECtHR: Spain Did Not Violate the Right to Reputation in Baena Salamanca v Spain
On 6th November, the ECtHR ruled that the Spanish courts had struck a fair balance between the right to freedom of expression and the right to reputation of the applicant in Baena Salamanca v Spain. As to the facts of the case, the applicant is a forensic doctor who was called to examine the allegedly deteriorating health state of a prisoner (ETA member), who had applied for early release on account of his alleged short life expectancy. At the core of the applicant’s complaint to the Court lies a newspaper article in El Pais, in which the journalist claimed that the applicant did not travel to personally examine the prisoner, despite the official court order to that effect. The applicant claimed that she never received the said order and filed a retraction claim against the journalist, which was unsuccessful. She then filed a criminal claim against the journalist and a lawyer arguing that the judicial order and accompanying cover letter presented by the journalist and the lawyer in the retraction case had been tampered with. These proceedings were discontinued, because, despite the fact that the court acknowledged that the cover letter had been tampered with, it could not be proven that the tampering or knowledge thereof could be attributed to the journalist or the lawyer. Finally, the applicant filed a defamation claim against the newspaper, which was also unsuccessful. Thus, the applicant filed a complaint with the ECtHR claiming that the Spanish courts had failed to protect her right to reputation under Article 8 ECHR. The ECtHR examined the case under the framework of the positive obligations of the State and the balance to be struck between the right to reputation and the right to freedom of expression. It observed that (1) the contested publication contributed to the public debate surrounding the conditional release of the prisoner; (2) the applicant was a civil servant, who, when ‘acting in an official capacity may be subject to wider limits of acceptable criticism than private individuals’; and (3) in terms of content, the contested publication concerned facts (as opposed to value judgments), according to which the applicant had failed to comply with a court order. On that point, the Court acknowledged that ‘it is indeed unfortunate that no steps were taken to qualify the above assumption in the text of the article, given that both parties acknowledged that there was no evidence that the order of 17 August 2012 had actually been communicated to the forensic medical clinic or the applicant…. For example, it could be accepted that warning potential readers that it was unclear whether the applicant had been notified of the court order could have led to more accurate reporting on the topic of public interest’. The Court decided to focus its further analysis around the question of whether the contested statements ‘went beyond the limits of responsible journalism’. The Court concluded that this was not the case and that there was no violation of Article 8 ECHR, mainly because the journalist was not expected to distrust official sources, from which he claims to have obtained a copy of the judicial order, or to notify the applicant in advance of the publication, and because the contested publication did not have significant impact on the private and professional life of the applicant, e.g. social media offences or official proceedings against her. In addition, the Court noted that although the headline put the forensic doctor in the spotlight, overall the publication was nuanced enough. We would like to add that the judgment seems to have stirred controversy within the Court, as there are three joint dissenting opinions (against the four opinions finding no violation). The main concern of the dissenting judges seems to be that despite the wide margin of appreciation enjoyed by the Spanish authorities, they did not balance well the two competing rights, in particular by not paying attention to how the journalists obtained the contested information and whether they checked its accuracy. In particular, they did not agree that the problem concerned only factual information, but also the interpretation made of it and were also concerned that the information about the case as presented to the domestic courts raised enough doubts for the domestic courts to look more strictly into whether the article departed from proper journalism and whether the reputation of the applicant was unnecessarily tarnished.
EDPB Opinion on Draft Adequacy Decision for Brazil
On 4th November, the EDPB published their ‘Opinion 28/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by Brazil’. In the Opinion, the EDPB consider the standard of protection in Brazil in light of ‘the Draft Decision itself as well as on the basis of an analysis of the documentation that is publicly available in the official websites of the Brazilian authorities’. In principle, the EDPB ‘positively notes that the data protection framework, in particular, General Data Protection Law in Brazil (‘LGPD’), together with Presidential decrees and binding regulations issued by Brazil’s Data Protection Authority…establish requirements (including in relation to the principles, data subject rights, transfers, oversight and redress) that are closely aligned with the GDPR and case law of the Court of Justice of the European Union’. The EDPB also, however, highlight certain issues of concern, and the need for the close monitoring of the development of the Brazilian framework moving forward. In this regard, the EDPB, for example, note limitations in Brazilian law to obligations to provide information to data subjects and supervisory authorities where commercial and industrial secrecy is involved, and highlights the need for close monitoring of these provisions in practice to understand their impacts on data subjects and the powers of the supervisory authority. Equally, the EDPB notes that the LGPD ‘does not apply to data processing conducted for the exclusive purposes of public safety, national defence, State security, or the investigation and prosecution of criminal offenses. At the same time, the EDPB positively notes that the Federal Supreme Court of Brazil in its case-law has
interpreted the LGPD in a way that expanded its partial applicability to the processing of personal data for criminal investigations and maintenance of public order’. In consequence, the EDPB ‘invites the Commission to further assess and clarify in the draft Decision the applicability of the LGPD in case of personal data processing for criminal law enforcement purposes, including’ the supervisory authority’s ‘investigatory and corrective powers vis-a-vis law enforcement authorities, as well as to take into careful consideration any relevant development in this regard as part of its monitoring obligation’. There is much in the Opinion, and we cannot cover everything in this short report. Accordingly, we would suggest all interested in the issue of international transfers consult the Opinion in full.
Advocate General Delivers Opinion on Competition Authority’s Search and Seizure Powers
On 23rd October 2025, the Advocate General delivered their Opinion in joined cases C-258/23-C-260/23 Imagens Médicas Integradas. In terms of the facts, ‘the national competition authority seized emails whose content relates to the subject matter of’ an inspection, ‘without having prior judicial authorisation’. In this regard, a series of questions were referred to the CJEU concerning whether Article 7 of the Charter would preclude the legitimacy of such a practice. In this regard, following ‘the judgment in Landeck, the Court decided, at the request of the (former) Fourth Chamber, to refer the present cases to the Grand Chamber’. In the Landeck judgment ‘the Court held, in particular, that Article 4(1)(c) of Directive (EU) 2016/680, read in the light of Articles 7 and 8 and Article 52(1) of the Charter, does not preclude national legal rules which afford the competent authorities the possibility to access personal data contained in a mobile telephone for the purposes of the prevention, investigation, detection and prosecution of criminal offences. However, the Court held that the exercise of that possibility must be subject, among other conditions, to prior review by a court or an independent administrative body, except in duly justified cases of urgency’. In the present, supplementary, Opinion, the AG was thus tasked with considering ‘whether the guidance provided in Landeck should be taken into account in answering the referring court…in particular as regards’ the following question referred for a preliminary ruling: ‘Does Article 7’ of the Charter ‘preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, bringing criminal prosecutions on the basis of the principle of legality and defending democratic legality in accordance with the Constitution, and which operates independently of the other central, regional and local authorities?’ In consideration of this question, the AG concluded that Article 7 of the Charter ‘must be interpreted as not precluding legislation of a Member State pursuant to which, in the course of an inspection at the premises of an undertaking, carried out as part of an investigation into an infringement of Article 101 or 102 TFEU, the national competition authority may search for and seize emails whose content relates to the subject matter of the inspection without having prior judicial authorisation, provided that a strict legal framework for that authority’s powers has been laid down together with adequate and effective safeguards against abuse and arbitrariness, in particular comprehensive ex post facto judicial review of the measures at issue’. This is a supplementary Opinion, and, accordingly, we would suggest all interested in the subject matter of the case to consult the original Opinion as well as this one. As always, it remains to be seen whether, and to which degree, the Court follows the AG in its decision.