Table of Contents:
- ECtHR: Azerbaijan Violates the Law in Seizures and Searches of a Journalist’s Devices and Documents
- AG Medina Clarifies the Right of Access to One’s Data in Criminal Proceedings
- AG Medina Opines on the Relationship between Religious Processing and Data Subject Rights
In the present edition, we inform our readers of two AG Opinions on the topic of the balance between data protection and religion, on one hand, and on the right of access in the framework of criminal investigations, on the other. We also report on a judgment by the ECtHR on the legality of searches of mobile devices and documents of a journalist in Azerbaijan.
ECtHR: Azerbaijan Violates the Law in Seizures and Searches of a Journalist’s Devices and Documents
On 6th October, the ECtHR ruled that Azerbaijan violated the “in accordance with the law” requirement in Article 8(2) ECHR when seizing and searching the information on a journalist’s mobile devices and documents in Anar Mammadov v. Azerbaijan. [1] As to the facts of the case, the applicant is a journalist in Azerbaijan whose mobile devices and documents were seized and searched by the Azerbaijani law enforcement authorities. The applicant filed several complaints with the ECtHR, amongst others, that the above measures violated his Article 8 ECHR rights. When examining the claims, the Court unsurprisingly established that the contested measures constituted an interference with the applicant’s right to private life, home and correspondence as protected by Article 8 ECHR. Then, the Court examined the lawfulness of the following measures individually: (1) the lawfulness of the seizures and (2) the lawfulness of examining the seized mobile devices, and (3) the effectiveness of the post-factum judicial review. The Court concluded that “even if it could be said that there was a general legal basis in the domestic law for the disputed measures, the authorities failed to properly follow the appropriate procedures. Moreover, there was no possibility of obtaining an effective judicial review a posteriori of the manner in which the seizure and inspection of items were conducted…and insufficient judicial safeguards were available to the applicant”. According to the Court this was so because the Azeri authorities relied on two mutually exclusive legal bases for the seizure of the contested items and performed the search of the devices without the required independent prior approval, e.g. by a judge. Having established the violation of the “in accordance of the law” requirement, the Court did not deem it necessary to examine whether the interference was “necessary in a democratic society”.
AG Medina Clarifies the Right of Access to One’s Data in Criminal Proceedings
On 8th October, AG Medina recommended the CJEU to rule that the Law Enforcement Directive (LED) applies to the processing of data by Financial Intelligence Units (FIU) and that the right of access to one’s data in the LED may not be absolutely restricted in X v Rahapesu Andmebüroo. As to the facts of the case, the applicant in the main proceedings filed several access requests to the Estonian FIU (“RAB”) to inquire whether data about him had been processed by the RAB and other FIUs. These requests were turned down. The dispute between X and the RAB reached the Estonian courts, resulting in the following two broad preliminary ruling questions: (1) which legal instrument applies to the processing of personal data by the FIUs and (2) under what conditions may the right of access to one’s data be restricted. As to the first question, AG Medina suggested that the CJEU should rule that the LED applies to the data processing in question, because “the processing of personal data by an FIU, such as the RAB, in the exercise of its mission to prevent, detect and combat money laundering and terrorist financing and in the light of its functions and powers in that field, must be considered as being carried out by a competent authority, within the meaning of point 7 of Article 3 of Directive 2016/680, even if the relevant FIU is not an investigative body within the meaning of the national code of criminal procedure”. In her argumentation, AG Medina analysed meticulously the exact role and powers of FIUs and observed that “FIUs, as their name indicates, are genuine intelligence hubs with the ability to take autonomous decisions when analysing relevant information” so that “their role is not reduced merely to administrative pre-handling”. [2] As to the second question, AG Medina first noted that from the facts of the case and the oral hearing, it remained unclear whether, under domestic laws, the RAB had any margin of appreciation as to whether to grant (partial) access or to refuse it in all cases. Leaving this to the national court to examine, she pointed out that the LED, and the existing case law, and the principle of proportionality, require clarity on the discretion of the RAB to decide on access requests and certain guarantees against abuse, and that Article 17 LED requires the possibility of indirect access to one’s data via the data protection supervisory authority. Third, AG Medina advised the Court to rule that FIUs may not only refuse to disclose the data to the requesting data subject, but also the reasons for the refusal (Article 15 (3) LED) “in order to avoid confirming or denying the fact that personal data related to the data subject have been processed. However, in such a situation, data subjects must always be provided with information as to the possibility of exercising their right of access through the supervisory authority pursuant to Article 17(1) of Directive 2016/680”. Finally, AG Medina suggested that “Article 15(1) of Directive 2016/680 must be interpreted as meaning that it does not preclude national legislation which, by a general provision, confers on the head of an FIU the power to restrict the rights of data subjects, for the sole reason that the understanding of the purpose, the conditions and the scope of that restriction requires the combined reading of other legal provisions, including subordinate legal provisions. However, the same provision precludes such national legislation to the extent that the relevant national legislation does not appear to lay down clear and precise rules governing the scope and conditions of application of the restriction of the right of access so that the persons whose personal data are being processed have sufficient guarantees that the data processed will be effectively protected against the risk of abuse, as well as against any unlawful access to or use of those data”.
AG Medina Opines on the Relationship between Religious Processing and Data Subject Rights
On 1st October, AG Medina published their Opinion in the case of Bisdom Gent. [3] In terms of the facts, the case essentially concerns an individual, JM, who left the Roman Catholic Church in Belgium. JM requested that “in application of the GDPR, any reference to his person be deleted from any physical or digital register or archive”. The Church recoded JM’s choice to leave, however, by merely striking through relevant personal data in registers – accordingly retaining the data in legible form. JM was not content with this, and thus “reiterated his request to have any personal data concerning him deleted from any physical or digital register or archive. That same day, JM filed a complaint with the” Belgian Data Protection Authority (GBA) “stating his disagreement with the interpretation of the GDPR applied by Bisdom Gent” – Diocese of Ghent – “and demanding that any connection between his person and any religion or organisation with a philosophical basis be erased”. The “Disputes Chamber of the GBA found that Bisdom Gent had infringed the GDPR, in particular Article 5(1)(a) thereof, read in conjunction with Article 6(1)(f), as well as Article 5(1)(b) and (c), Article 9 and Article 12(1) to (4), read in conjunction with Articles 13 and 17”. Bisdom Gent then brought an appeal against this decision before the local courts, who referred a set of questions to the CJEU. The AG considered these to essentially consist of two questions: i) do Articles 17(1) and (3) “of the GDPR, read in the light of Articles 8 and 10 of the Charter” mean “an individual who was baptised as a minor and who, as an adult, wishes to dissociate himself or herself from” a religious community have “the right to have his or her personal data erased from the baptismal register”; and ii) if so, does “the mere annotation, in the margin of the baptismal register, that a person has left the religious community” constitute erasure according to Articles 17(1) and (3). In this regard, the AG significantly considered that: i) such an adult “has, in principle, the right to have his or her personal data erased from the baptismal register where the controller fails to demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject”; ii) “a mere annotation, in the margin of the baptismal register, of a data subject’s departure from a religious community, and the striking through of the relevant personal data which still leaves them legible, does not amount to ‘erasure’ for the purposes of Regulation 2016/679”; and iii) “the fact that the baptismal register is not digital, but a unique material carrier in the form of a book with double-sided pages in which details of other data subjects are also given, and which constitutes a unique record of historical facts that are not recorded anywhere else, does not call the foregoing considerations into question”. The Opinion is extensive, and we cannot cover all its aspects in this summary. Nevertheless, it is well worth reading. In this regard, the AG touches on a range of generally fascinating issues, such as the factors to be considered in balancing religious organisations’ interests in processing, and data subjects’ rights. The AG also makes several interesting observations on requirements under data protection law, such as: with regard to research, “I am unsure as to whether research (be it scientific or historical) carried out or controlled by commercial undertakings, and which may result in preferential access to the results thereof, should fall within the scope of the GDPR provisions referring to research”; and that, in relation to erasure, ‘what really matters in this type of situation is that the erasure of the personal data should ensure that the person who has been baptised is no longer identified or at least is not easily identifiable’.
More Information:
[1] https://hudoc.echr.coe.int/#{%22itemid%22:[%22001-252624%22]}
[2] https://infocuria.curia.europa.eu/tabs/document/C/2025/C-0222-25-00000000RP-01-P-01/CONCL/327757-EN-1-html
[3] https://infocuria.curia.europa.eu/tabs/jurisprudence?lang=EN&searchTerm=C%252D12%252F25&publishedId=C-12%2F25&logicDocId=id_327439