{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-470-21","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-470-21)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-12","fingerprint":"ewai:eu:6fc91c","proof":"sha256:b5ed745f69d7bff054295d7cd1a5d51ec3df5436f52526932a889c5484141a10","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-470-21","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62021CJ0470","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Full Court)","paragraphs":[]},{"title":"30 April 2024 (\n *1\n )","paragraphs":[]},{"title":"Table of Contents","paragraphs":[]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"General rules concerning the protection of personal data","paragraphs":["para_8","para_9"]},{"title":"Sector-specific rules concerning the protection of personal data","paragraphs":["para_11","para_12"]},{"title":"Rules concerning the protection of intellectual property","paragraphs":[]},{"title":"French law","paragraphs":[]},{"title":"The CPI","paragraphs":[]},{"title":"Decree No 2010-236","paragraphs":[]},{"title":"The Post and Electronic Communications Code","paragraphs":[]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"Preliminary observations","paragraphs":["para_21","para_22","para_23","para_24","para_25"]},{"title":"Costs","paragraphs":["para_27","para_28","para_29","para_30","para_31","para_32"]},{"title":"French Data Network","paragraphs":["para_34","para_35","para_36"]},{"title":"THE COURT (Full Court)","paragraphs":["para_38","para_39","para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59","para_60","para_61","para_62","para_63","para_64","para_65","para_66","para_67","para_68","para_69","para_70","para_71","para_72","para_73","para_74","para_75","para_76","para_77","para_78","para_79","para_80","para_81","para_82","para_83","para_84","para_85","para_86","para_87","para_88","para_89","para_90","para_91","para_92","para_93","para_94","para_95"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_98"]},{"title":"2","paragraphs":["para_100"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"General rules concerning the protection of personal data","paragraphs":["para_104"]},{"title":"3","paragraphs":["para_106","para_107","para_108"]},{"title":"(f)","paragraphs":["para_110"]},{"title":"4","paragraphs":[]},{"title":"Article 13(1) of that directive provides:","paragraphs":["para_113","para_114"]},{"title":"(g)","paragraphs":["para_116","para_117"]},{"title":"5","paragraphs":["para_119","para_120"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":["para_122"]},{"title":"(d)","paragraphs":["para_124"]},{"title":"6","paragraphs":[]},{"title":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraphs":["para_127"]},{"title":"(1)","paragraphs":["para_129"]},{"title":"(2)","paragraphs":["para_131","para_132"]},{"title":"7","paragraphs":[]},{"title":"Article 6 of that regulation, headed ‘Lawfulness of processing’, provides in paragraph 1:","paragraphs":["para_135","para_136"]},{"title":"(f)","paragraphs":["para_138","para_139"]},{"title":"8","paragraphs":["para_141"]},{"title":"9","paragraphs":[]},{"title":"Article 23 of the GDPR, entitled ‘Restrictions’, provides, in paragraph 1 thereof:","paragraphs":["para_144","para_145"]},{"title":"(i) the protection of the data subject or the rights and freedoms of others;","paragraphs":[]},{"title":"(j) the enforcement of civil law claims.’","paragraphs":[]},{"title":"Sector-specific rules concerning the protection of personal data","paragraphs":["para_149"]},{"title":"10","paragraphs":[]},{"title":"Recitals 2, 6, 7, 11, 26 and 30 of Directive 2002/58 state:","paragraphs":["para_152","para_153","para_154"]},{"title":"(6)","paragraphs":["para_156"]},{"title":"(7)","paragraphs":["para_158","para_159"]},{"title":"(11)","paragraphs":["para_161","para_162"]},{"title":"(26)","paragraphs":["para_164","para_165"]},{"title":"(30)","paragraphs":["para_167"]},{"title":"11","paragraphs":[]},{"title":"Article 2 of Directive 2002/58, headed ‘Definitions’, provides:","paragraphs":["para_170"]},{"title":"The following definitions shall also apply:","paragraphs":[]},{"title":"(a)","paragraphs":["para_173"]},{"title":"(b)","paragraphs":["para_175"]},{"title":"(c)","paragraphs":["para_177","para_178"]},{"title":"12","paragraphs":[]},{"title":"Article 3 of that directive, entitled ‘Services concerned’, provides:","paragraphs":["para_181"]},{"title":"13","paragraphs":[]},{"title":"Article 5 of the directive, headed ‘Confidentiality of the communications’, provides:","paragraphs":["para_184","para_185","para_186"]},{"title":"14","paragraphs":[]},{"title":"Article 6 of Directive 2002/58, entitled ‘Traffic data’, provides:","paragraphs":["para_189","para_190","para_191","para_192","para_193"]},{"title":"15","paragraphs":["para_195","para_196","para_197","para_198","para_199","para_200"]},{"title":"16","paragraphs":["para_202","para_203"]},{"title":"17","paragraphs":[]},{"title":"Article 3 of that directive, entitled ‘Definitions’, provides:","paragraphs":["para_206","para_207"]},{"title":"(7) “competent authority” means:","paragraphs":[]},{"title":"(a)","paragraphs":["para_210"]},{"title":"(b)","paragraphs":["para_212","para_213"]},{"title":"Rules concerning the protection of intellectual property","paragraphs":[]},{"title":"18","paragraphs":["para_216","para_217"]},{"title":"2.   The information referred to in paragraph 1 shall, as appropriate, comprise:","paragraphs":[]},{"title":"(a)","paragraphs":["para_220","para_221"]},{"title":"3.   Paragraphs 1 and 2 shall apply without prejudice to other statutory provisions which:","paragraphs":[]},{"title":"(a)","paragraphs":["para_224"]},{"title":"(b)","paragraphs":["para_226"]},{"title":"(c)","paragraphs":["para_228"]},{"title":"(d)","paragraphs":["para_230"]},{"title":"(e)","paragraphs":["para_232"]},{"title":"French law","paragraphs":[]},{"title":"The CPI","paragraphs":[]},{"title":"19","paragraphs":["para_236","para_237"]},{"title":"20","paragraphs":[]},{"title":"Article L. 331-13 of that code provides:","paragraphs":["para_240","para_241","para_242","para_243"]},{"title":"21","paragraphs":[]},{"title":"Under Article L. 331-15 of that code:","paragraphs":["para_246","para_247","para_248"]},{"title":"22","paragraphs":[]},{"title":"The first paragraph of Article L. 331-17 of that code provides:","paragraphs":["para_251"]},{"title":"23","paragraphs":[]},{"title":"Under Article L. 331-21 of the CPI:","paragraphs":["para_254","para_255","para_256","para_257","para_258"]},{"title":"24","paragraphs":[]},{"title":"Article L. 331-24 of that code provides:","paragraphs":["para_261","para_262","para_263","para_264","para_265","para_266","para_267","para_268"]},{"title":"Offending conduct dating back more than six months may not be referred to it.’","paragraphs":[]},{"title":"25","paragraphs":[]},{"title":"Under Article L. 331-25 of that code, which governs the ‘graduated response’ procedure:","paragraphs":["para_272","para_273","para_274"]},{"title":"26","paragraphs":[]},{"title":"Article L. 331-29 of the CPI states:","paragraphs":["para_277","para_278","para_279","para_280","para_281","para_282","para_283","para_284","para_285"]},{"title":"27","paragraphs":[]},{"title":"The first and second paragraphs of Article L. 335-2 of that code stipulate:","paragraphs":["para_288","para_289"]},{"title":"28","paragraphs":[]},{"title":"The first paragraph of Article L. 335-4 of that code provides:","paragraphs":["para_292"]},{"title":"29","paragraphs":["para_294"]},{"title":"30","paragraphs":[]},{"title":"The first paragraph of Article L. 335-7-1 of that code reads as follows:","paragraphs":["para_297"]},{"title":"31","paragraphs":[]},{"title":"Pursuant to Article L. 336-3 of that code:","paragraphs":["para_300","para_301"]},{"title":"32","paragraphs":[]},{"title":"The first paragraph of Article R. 331-37 of the CPI provides:","paragraphs":["para_304"]},{"title":"33","paragraphs":[]},{"title":"Under Article R. 331-40 of that code:","paragraphs":["para_307","para_308"]},{"title":"34","paragraphs":[]},{"title":"Article R. 335-5 of the CPI states:","paragraphs":["para_311"]},{"title":"1. has failed to establish measures to make such access secure; or","paragraphs":["para_313","para_314","para_315","para_316"]},{"title":"35","paragraphs":["para_318"]},{"title":"36","paragraphs":["para_320"]},{"title":"Decree No 2010-236","paragraphs":[]},{"title":"37","paragraphs":["para_323","para_324","para_325","para_326","para_327"]},{"title":"38","paragraphs":[]},{"title":"Article 4 of that decree provides:","paragraphs":["para_330","para_331","para_332","para_333","para_334","para_335","para_336","para_337","para_338","para_339","para_340"]},{"title":"39","paragraphs":[]},{"title":"The annex to that decree provides:","paragraphs":["para_343","para_344","para_345"]},{"title":"Date and time of the occurrence;","paragraphs":[]},{"title":"IP address of the subscribers concerned;","paragraphs":[]},{"title":"Peer-to-peer protocol used;","paragraphs":[]},{"title":"Pseudonym used by the subscriber;","paragraphs":[]},{"title":"Information on the protected works or subject matter affected by the conduct;","paragraphs":[]},{"title":"File name as it appears on the subscriber’s device (where applicable);","paragraphs":["para_352","para_353","para_354"]},{"title":"Surname, forenames;","paragraphs":[]},{"title":"Postal address and email addresses;","paragraphs":[]},{"title":"Telephone number;","paragraphs":[]},{"title":"Address of the subscriber’s telephone installation;","paragraphs":["para_359","para_360","para_361"]},{"title":"The Post and Electronic Communications Code","paragraphs":[]},{"title":"40","paragraphs":[]},{"title":"Article L. 34-1, II bis , of the Post and Electronic Communications Code provides:","paragraphs":["para_365","para_366","para_367","para_368"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"41","paragraphs":["para_371"]},{"title":"42","paragraphs":["para_373"]},{"title":"43","paragraphs":["para_375"]},{"title":"44","paragraphs":["para_377"]},{"title":"45","paragraphs":["para_379"]},{"title":"46","paragraphs":["para_381"]},{"title":"47","paragraphs":["para_383"]},{"title":"48","paragraphs":["para_385"]},{"title":"49","paragraphs":["para_387"]},{"title":"50","paragraphs":["para_389"]},{"title":"51","paragraphs":["para_391","para_392","para_393"]},{"title":"(2)","paragraphs":["para_395"]},{"title":"(3)","paragraphs":["para_397"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"52","paragraphs":["para_400"]},{"title":"Preliminary observations","paragraphs":[]},{"title":"53","paragraphs":["para_403"]},{"title":"54","paragraphs":["para_405"]},{"title":"55","paragraphs":["para_407"]},{"title":"56","paragraphs":["para_409"]},{"title":"57","paragraphs":["para_411"]},{"title":"58","paragraphs":["para_413"]},{"title":"59","paragraphs":["para_415"]},{"title":"60","paragraphs":["para_417"]},{"title":"61","paragraphs":["para_419"]},{"title":"62","paragraphs":["para_421"]},{"title":"63","paragraphs":["para_423","para_424"]},{"title":"64","paragraphs":["para_426"]},{"title":"65","paragraphs":["para_428","para_429"]},{"title":"66","paragraphs":["para_431"]},{"title":"67","paragraphs":["para_433"]},{"title":"68","paragraphs":["para_435"]},{"title":"69","paragraphs":["para_437"]},{"title":"70","paragraphs":["para_439"]},{"title":"71","paragraphs":["para_441"]},{"title":"72","paragraphs":["para_443"]},{"title":"73","paragraphs":["para_445"]},{"title":"74","paragraphs":["para_447"]},{"title":"75","paragraphs":["para_449"]},{"title":"76","paragraphs":["para_451"]},{"title":"77","paragraphs":["para_453"]},{"title":"78","paragraphs":["para_455"]},{"title":"79","paragraphs":["para_457"]},{"title":"80","paragraphs":["para_459"]},{"title":"81","paragraphs":["para_461"]},{"title":"82","paragraphs":["para_463"]},{"title":"83","paragraphs":["para_465"]},{"title":"84","paragraphs":["para_467"]},{"title":"85","paragraphs":["para_469"]},{"title":"86","paragraphs":["para_471"]},{"title":"87","paragraphs":["para_473"]},{"title":"88","paragraphs":["para_475"]},{"title":"89","paragraphs":["para_477"]},{"title":"90","paragraphs":["para_479"]},{"title":"91","paragraphs":["para_481"]},{"title":"92","paragraphs":["para_483"]},{"title":"93","paragraphs":["para_485"]},{"title":"94","paragraphs":["para_487","para_488"]},{"title":"95","paragraphs":["para_490"]},{"title":"96","paragraphs":["para_492"]},{"title":"97","paragraphs":["para_494"]},{"title":"98","paragraphs":["para_496"]},{"title":"99","paragraphs":["para_498"]},{"title":"100","paragraphs":["para_500"]},{"title":"101","paragraphs":["para_502"]},{"title":"102","paragraphs":["para_504"]},{"title":"103","paragraphs":["para_506"]},{"title":"104","paragraphs":["para_508"]},{"title":"105","paragraphs":["para_510"]},{"title":"106","paragraphs":["para_512"]},{"title":"107","paragraphs":["para_514"]},{"title":"108","paragraphs":["para_516"]},{"title":"109","paragraphs":["para_518"]},{"title":"110","paragraphs":["para_520"]},{"title":"111","paragraphs":["para_522"]},{"title":"112","paragraphs":["para_524"]},{"title":"113","paragraphs":["para_526"]},{"title":"114","paragraphs":["para_528"]},{"title":"115","paragraphs":["para_530"]},{"title":"116","paragraphs":["para_532"]},{"title":"117","paragraphs":["para_534"]},{"title":"118","paragraphs":["para_536"]},{"title":"119","paragraphs":["para_538"]},{"title":"120","paragraphs":["para_540"]},{"title":"121","paragraphs":["para_542"]},{"title":"122","paragraphs":["para_544","para_545"]},{"title":"123","paragraphs":["para_547"]},{"title":"124","paragraphs":["para_549"]},{"title":"125","paragraphs":["para_551"]},{"title":"126","paragraphs":["para_553"]},{"title":"127","paragraphs":["para_555"]},{"title":"128","paragraphs":["para_557"]},{"title":"129","paragraphs":["para_559"]},{"title":"130","paragraphs":["para_561"]},{"title":"131","paragraphs":["para_563"]},{"title":"132","paragraphs":["para_565"]},{"title":"133","paragraphs":["para_567"]},{"title":"134","paragraphs":["para_569"]},{"title":"135","paragraphs":["para_571"]},{"title":"136","paragraphs":["para_573"]},{"title":"137","paragraphs":["para_575"]},{"title":"138","paragraphs":["para_577"]},{"title":"139","paragraphs":["para_579"]},{"title":"140","paragraphs":["para_581"]},{"title":"141","paragraphs":["para_583"]},{"title":"142","paragraphs":["para_585"]},{"title":"143","paragraphs":["para_587"]},{"title":"144","paragraphs":["para_589"]},{"title":"145","paragraphs":["para_591"]},{"title":"146","paragraphs":["para_593"]},{"title":"147","paragraphs":["para_595"]},{"title":"148","paragraphs":["para_597"]},{"title":"149","paragraphs":["para_599"]},{"title":"150","paragraphs":["para_601"]},{"title":"151","paragraphs":["para_603","para_604"]},{"title":"152","paragraphs":["para_606"]},{"title":"153","paragraphs":["para_608"]},{"title":"154","paragraphs":["para_610"]},{"title":"155","paragraphs":["para_612"]},{"title":"156","paragraphs":["para_614"]},{"title":"157","paragraphs":["para_616"]},{"title":"158","paragraphs":["para_618"]},{"title":"159","paragraphs":["para_620"]},{"title":"160","paragraphs":["para_622"]},{"title":"161","paragraphs":["para_624"]},{"title":"162","paragraphs":["para_626"]},{"title":"163","paragraphs":["para_628"]},{"title":"164","paragraphs":["para_630","para_631","para_632","para_633","para_634","para_635","para_636","para_637","para_638"]},{"title":"Costs","paragraphs":[]},{"title":"165","paragraphs":["para_641"]},{"title":"On those grounds, the Court (Full Court) hereby rules:","paragraphs":["para_643","para_644","para_645","para_646","para_647","para_648","para_649","para_650","para_651","para_652","para_653","para_654"]}],"paragraphs":[{"text":"62021CJ0470","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Full Court)","paragraph_id":"para_2"},{"text":"30 April 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"Table of Contents","paragraph_id":"para_4"},{"text":"Legal context","paragraph_id":"para_5"},{"text":"European Union law","paragraph_id":"para_6"},{"text":"General rules concerning the protection of personal data","paragraph_id":"para_7"},{"text":"– Directive 95/46/EC","paragraph_id":"para_8"},{"text":"– The GDPR","paragraph_id":"para_9"},{"text":"Sector-specific rules concerning the protection of personal data","paragraph_id":"para_10"},{"text":"– Directive 2002/58","paragraph_id":"para_11"},{"text":"– Directive (EU) 2016/680","paragraph_id":"para_12"},{"text":"Rules concerning the protection of intellectual property","paragraph_id":"para_13"},{"text":"French law","paragraph_id":"para_14"},{"text":"The CPI","paragraph_id":"para_15"},{"text":"Decree No 2010-236","paragraph_id":"para_16"},{"text":"The Post and Electronic Communications Code","paragraph_id":"para_17"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_18"},{"text":"Consideration of the questions referred","paragraph_id":"para_19"},{"text":"Preliminary observations","paragraph_id":"para_20"},{"text":"Whether access by a public authority to data relating to the civil identity associated with an IP address retained by providers of electronic communications services for the purpose of combating counterfeiting offences committed online can be justified under Article 15(1) of Directive 2002/58","paragraph_id":"para_21"},{"text":"The requirements surrounding the retention of data relating to civil identity and associated IP addresses by providers of electronic communications services","paragraph_id":"para_22"},{"text":"The requirements surrounding access to data relating to the civil identity associated with an IP address retained by providers of electronic communications services","paragraph_id":"para_23"},{"text":"The requirement of a prior review by a court or an independent administrative body before a public authority accesses data relating to the civil identity associated with an IP address","paragraph_id":"para_24"},{"text":"The requirements relating to the substantive and procedural conditions and to the safeguards against the risks of abuse and against any unlawful access to and use of those data applicable to the access by a public authority to data relating to the civil identity associated with an IP address","paragraph_id":"para_25"},{"text":"Costs","paragraph_id":"para_26"},{"text":"(Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58/EC – Confidentiality of electronic communications – Protection – Article 5 and Article 15(1) – Charter of Fundamental Rights of the European Uni …","paragraph_id":"para_27"},{"text":"In Case C‑470/21,","paragraph_id":"para_28"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 5 July 2021, received at the Court on 30 July 2021, in the proceedings","paragraph_id":"para_29"},{"text":"La Quadrature du Net,","paragraph_id":"para_30"},{"text":"Fédération des fournisseurs d’accès à Internet associatifs,","paragraph_id":"para_31"},{"text":"Franciliens.net,","paragraph_id":"para_32"},{"text":"French Data Network","paragraph_id":"para_33"},{"text":"v","paragraph_id":"para_34"},{"text":"Premier ministre,","paragraph_id":"para_35"},{"text":"Ministre de la Culture,","paragraph_id":"para_36"},{"text":"THE COURT (Full Court)","paragraph_id":"para_37"},{"text":"composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Arabadjiev, A. Prechal (Rapporteur), K. Jürimäe, C. Lycourgos, E. Regan, T. von Danwitz, F. Biltgen, N. Piçarra and Z. Csehi, Presidents of Chambers, M. Ilešič, J.-C. Bonichot, S. Rodin, P.G. Xuereb, L.S. Rossi, I. Jarukaitis, A. Kumin, N. Jääskinen, N. Wahl, I. Ziemele, J. Passer, D. Gratsias, M.L. Arastey Sahún and M. Gavalec, Judges,","paragraph_id":"para_38"},{"text":"Advocate General: M. Szpunar,","paragraph_id":"para_39"},{"text":"Registrars: V. Giacobbo and M. Krausenböck, Administrators,","paragraph_id":"para_40"},{"text":"having regard to the written procedure and further to the hearing on 5 July 2022,","paragraph_id":"para_41"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_42"},{"text":"–","paragraph_id":"para_43"},{"text":"La Quadrature du Net, Fédération des fournisseurs d’accès à Internet associatifs, Franciliens.net and French Data Network, by A. Fitzjean Ó Cobhthaigh, avocat,","paragraph_id":"para_44"},{"text":"–","paragraph_id":"para_45"},{"text":"the French Government, by A. Daniel, A.-L. Desjonquères and J. Illouz, acting as Agents,","paragraph_id":"para_46"},{"text":"–","paragraph_id":"para_47"},{"text":"the Danish Government, by J.F. Kronborg and V. Pasternak Jørgensen, acting as Agents,","paragraph_id":"para_48"},{"text":"–","paragraph_id":"para_49"},{"text":"the Estonian Government,, by M. Kriisa, acting as Agent,","paragraph_id":"para_50"},{"text":"–","paragraph_id":"para_51"},{"text":"the Finnish Government, by H. Leppo, acting as Agent,","paragraph_id":"para_52"},{"text":"–","paragraph_id":"para_53"},{"text":"the Swedish Government, by H. Shev, acting as Agent,","paragraph_id":"para_54"},{"text":"–","paragraph_id":"para_55"},{"text":"the Norwegian Government, by F. Bergsjø, S.-E. Dahl, J.T. Kaasin and P. Wennerås, acting as Agents,","paragraph_id":"para_56"},{"text":"–","paragraph_id":"para_57"},{"text":"the European Commission, by S.L. Kalėda, H. Kranenborg, P.-J. Loewenthal and F. Wilman, acting as Agents,","paragraph_id":"para_58"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 27 October 2022,","paragraph_id":"para_59"},{"text":"having regard to the order of 23 March 2023 to reopen the oral procedure, and further to the hearing on 15 May 2023,","paragraph_id":"para_60"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_61"},{"text":"–","paragraph_id":"para_62"},{"text":"La Quadrature du Net, Fédération des fournisseurs d’accès à Internet associatifs, Franciliens.net and French Data Network, by A. Fitzjean Ó Cobhthaigh, avocat,","paragraph_id":"para_63"},{"text":"–","paragraph_id":"para_64"},{"text":"the French Government, by R. Bénard, J. Illouz and T. Stéhelin, acting as Agents,","paragraph_id":"para_65"},{"text":"–","paragraph_id":"para_66"},{"text":"the Czech Government, by T. Suchá and J. Vláčil, acting as Agents,","paragraph_id":"para_67"},{"text":"–","paragraph_id":"para_68"},{"text":"the Danish Government, by J.F. Kronborg and C.A.-S. Maertens, acting as Agents,","paragraph_id":"para_69"},{"text":"–","paragraph_id":"para_70"},{"text":"the Estonian Government, by M. Kriisa, acting as Agent,","paragraph_id":"para_71"},{"text":"–","paragraph_id":"para_72"},{"text":"Ireland, by M. Browne, Chief State Solicitor, A. Joyce and D. O’Reilly, acting as Agents, and by D. Fenelly, Barrister-at-Law,","paragraph_id":"para_73"},{"text":"–","paragraph_id":"para_74"},{"text":"the Spanish Government, by A. Gavela Llopis, acting as Agent,","paragraph_id":"para_75"},{"text":"–","paragraph_id":"para_76"},{"text":"the Cypriot Government, by I. Neophytou, acting as Agent,","paragraph_id":"para_77"},{"text":"–","paragraph_id":"para_78"},{"text":"the Latvian Government, by J. Davidoviča and K. Pommere, acting as Agents,","paragraph_id":"para_79"},{"text":"–","paragraph_id":"para_80"},{"text":"the Netherlands Government, by E.M.M. Besselink, M.K. Bultermann and A. Hanje, acting as Agents,","paragraph_id":"para_81"},{"text":"–","paragraph_id":"para_82"},{"text":"the Finnish Government, by A. Laine and H. Leppo, acting as Agents,","paragraph_id":"para_83"},{"text":"–","paragraph_id":"para_84"},{"text":"the Swedish Government, by F.-D. Göransson and H. Shev, acting as Agents,","paragraph_id":"para_85"},{"text":"–","paragraph_id":"para_86"},{"text":"the Norwegian Government, by S.-E. Dahl and P. Wennerås, acting as Agents,","paragraph_id":"para_87"},{"text":"–","paragraph_id":"para_88"},{"text":"the European Commission, by S.L. Kalėda, H. Kranenborg, P.-J. Loewenthal and F. Wilman, acting as Agents,","paragraph_id":"para_89"},{"text":"–","paragraph_id":"para_90"},{"text":"the European Data Protection Supervisor, by V. Bernardo, C.-A. Marnier, D. Nardi and M. Pollmann, acting as Agents,","paragraph_id":"para_91"},{"text":"–","paragraph_id":"para_92"},{"text":"European Union Agency for Cybersecurity (ENISA), by A. Bourka, acting as Agent,","paragraph_id":"para_93"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 28 September 2023,","paragraph_id":"para_94"},{"text":"gives the following","paragraph_id":"para_95"},{"text":"Judgment","paragraph_id":"para_96"},{"text":"1","paragraph_id":"para_97"},{"text":"This request for a preliminary ruling concerns the interpretation of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electroni …","paragraph_id":"para_98"},{"text":"2","paragraph_id":"para_99"},{"text":"The request has been made in proceedings between the associations La Quadrature du Net, Fédération des fournisseurs d’accès à Internet associatifs, Franciliens.net and French Data Network, on the one hand, and the Premier ministre (Prime Minister, France) and the ministre de la Culture (Minister for …","paragraph_id":"para_100"},{"text":"Legal context","paragraph_id":"para_101"},{"text":"European Union law","paragraph_id":"para_102"},{"text":"General rules concerning the protection of personal data","paragraph_id":"para_103"},{"text":"–  Directive 95/46/EC","paragraph_id":"para_104"},{"text":"3","paragraph_id":"para_105"},{"text":"Article 7 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ), contained in Section II of that directive, entitled ‘Criteria for making data processing legitimate’, was worded as follows:","paragraph_id":"para_106"},{"text":"‘Member States shall provide that personal data may be processed only if:","paragraph_id":"para_107"},{"text":"…","paragraph_id":"para_108"},{"text":"(f)","paragraph_id":"para_109"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’","paragraph_id":"para_110"},{"text":"4","paragraph_id":"para_111"},{"text":"Article 13(1) of that directive provides:","paragraph_id":"para_112"},{"text":"‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary [measure] to safeguard:","paragraph_id":"para_113"},{"text":"…","paragraph_id":"para_114"},{"text":"(g)","paragraph_id":"para_115"},{"text":"the protection of the data subject or the rights and freedoms of others.’","paragraph_id":"para_116"},{"text":"–  The GDPR","paragraph_id":"para_117"},{"text":"5","paragraph_id":"para_118"},{"text":"Article 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ; ‘the GDPR’), entitled ‘Material scope’, provides, in paragraphs 1 and 2 thereof:","paragraph_id":"para_119"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_120"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_121"},{"text":"…","paragraph_id":"para_122"},{"text":"(d)","paragraph_id":"para_123"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_124"},{"text":"6","paragraph_id":"para_125"},{"text":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraph_id":"para_126"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_127"},{"text":"(1)","paragraph_id":"para_128"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …","paragraph_id":"para_129"},{"text":"(2)","paragraph_id":"para_130"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_131"},{"text":"…’","paragraph_id":"para_132"},{"text":"7","paragraph_id":"para_133"},{"text":"Article 6 of that regulation, headed ‘Lawfulness of processing’, provides in paragraph 1:","paragraph_id":"para_134"},{"text":"‘Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_135"},{"text":"…","paragraph_id":"para_136"},{"text":"(f)","paragraph_id":"para_137"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data …","paragraph_id":"para_138"},{"text":"Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.’","paragraph_id":"para_139"},{"text":"8","paragraph_id":"para_140"},{"text":"Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, provides, in paragraph 2(e) and (f) thereof, that the prohibition on the processing of certain types of personal data revealing, inter alia, data concerning a natural person’s sexual life or sexual orientatio …","paragraph_id":"para_141"},{"text":"9","paragraph_id":"para_142"},{"text":"Article 23 of the GDPR, entitled ‘Restrictions’, provides, in paragraph 1 thereof:","paragraph_id":"para_143"},{"text":"‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligat …","paragraph_id":"para_144"},{"text":"…","paragraph_id":"para_145"},{"text":"(i) the protection of the data subject or the rights and freedoms of others;","paragraph_id":"para_146"},{"text":"(j) the enforcement of civil law claims.’","paragraph_id":"para_147"},{"text":"Sector-specific rules concerning the protection of personal data","paragraph_id":"para_148"},{"text":"–  Directive 2002/58","paragraph_id":"para_149"},{"text":"10","paragraph_id":"para_150"},{"text":"Recitals 2, 6, 7, 11, 26 and 30 of Directive 2002/58 state:","paragraph_id":"para_151"},{"text":"‘(2)","paragraph_id":"para_152"},{"text":"This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by [the Charter]. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.","paragraph_id":"para_153"},{"text":"…","paragraph_id":"para_154"},{"text":"(6)","paragraph_id":"para_155"},{"text":"The Internet is overturning traditional market structures by providing a common, global infrastructure for the delivery of a wide range of electronic communications services. Publicly available electronic communications services over the Internet open new possibilities for users but also new risks for their personal data and privacy.","paragraph_id":"para_156"},{"text":"(7)","paragraph_id":"para_157"},{"text":"In the case of public communications networks, specific legal, regulatory and technical provisions should be made in order to protect fundamental rights and freedoms of natural persons and legitimate interests of legal persons, in particular with regard to the increasing capacity for automated storage and processing of data relating to subscribers and users.","paragraph_id":"para_158"},{"text":"…","paragraph_id":"para_159"},{"text":"(11)","paragraph_id":"para_160"},{"text":"Like Directive [95/46], this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by Community law. Therefore it does not alter the existing balance between the individual’s right to privacy and the possibility for Member Sta …","paragraph_id":"para_161"},{"text":"…","paragraph_id":"para_162"},{"text":"(26)","paragraph_id":"para_163"},{"text":"The data relating to subscribers processed within electronic communications networks to establish connections and to transmit information contain information on the private life of natural persons and concern the right to respect for their correspondence or concern the legitimate interests of legal …","paragraph_id":"para_164"},{"text":"…","paragraph_id":"para_165"},{"text":"(30)","paragraph_id":"para_166"},{"text":"Systems for the provision of electronic communications networks and services should be designed to limit the amount of personal data necessary to a strict minimum. …’","paragraph_id":"para_167"},{"text":"11","paragraph_id":"para_168"},{"text":"Article 2 of Directive 2002/58, headed ‘Definitions’, provides:","paragraph_id":"para_169"},{"text":"‘…","paragraph_id":"para_170"},{"text":"The following definitions shall also apply:","paragraph_id":"para_171"},{"text":"(a)","paragraph_id":"para_172"},{"text":"“user” means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;","paragraph_id":"para_173"},{"text":"(b)","paragraph_id":"para_174"},{"text":"“traffic data” means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;","paragraph_id":"para_175"},{"text":"(c)","paragraph_id":"para_176"},{"text":"“location data” means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;","paragraph_id":"para_177"},{"text":"…’","paragraph_id":"para_178"},{"text":"12","paragraph_id":"para_179"},{"text":"Article 3 of that directive, entitled ‘Services concerned’, provides:","paragraph_id":"para_180"},{"text":"‘This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices.’","paragraph_id":"para_181"},{"text":"13","paragraph_id":"para_182"},{"text":"Article 5 of the directive, headed ‘Confidentiality of the communications’, provides:","paragraph_id":"para_183"},{"text":"‘1.   Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or o …","paragraph_id":"para_184"},{"text":"…","paragraph_id":"para_185"},{"text":"(3)   Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive [95/46], inter alia, about the purposes of the processing. …’","paragraph_id":"para_186"},{"text":"14","paragraph_id":"para_187"},{"text":"Article 6 of Directive 2002/58, entitled ‘Traffic data’, provides:","paragraph_id":"para_188"},{"text":"‘1.   Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).","paragraph_id":"para_189"},{"text":"2.   Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued.","paragraph_id":"para_190"},{"text":"3.   For the purpose of marketing electronic communications services or for the provision of value added services, the provider of a publicly available electronic communications service may process the data referred to in paragraph 1 to the extent and for the duration necessary for such services or …","paragraph_id":"para_191"},{"text":"…","paragraph_id":"para_192"},{"text":"5.   Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiri …","paragraph_id":"para_193"},{"text":"15","paragraph_id":"para_194"},{"text":"Article 15 of Directive 2002/58, headed ‘Application of certain provisions of Directive [95/46]’, provides:","paragraph_id":"para_195"},{"text":"‘1.   Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a d …","paragraph_id":"para_196"},{"text":"…","paragraph_id":"para_197"},{"text":"2.   The provisions of Chapter III on judicial remedies, liability and sanctions of Directive [95/46] shall apply with regard to national provisions adopted pursuant to this Directive and with regard to the individual rights derived from this Directive.","paragraph_id":"para_198"},{"text":"…’","paragraph_id":"para_199"},{"text":"–  Directive (EU) 2016/680","paragraph_id":"para_200"},{"text":"16","paragraph_id":"para_201"},{"text":"Article 1 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal off …","paragraph_id":"para_202"},{"text":"‘This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_203"},{"text":"17","paragraph_id":"para_204"},{"text":"Article 3 of that directive, entitled ‘Definitions’, provides:","paragraph_id":"para_205"},{"text":"‘For the purposes of this Directive:","paragraph_id":"para_206"},{"text":"…","paragraph_id":"para_207"},{"text":"(7) “competent authority” means:","paragraph_id":"para_208"},{"text":"(a)","paragraph_id":"para_209"},{"text":"any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or","paragraph_id":"para_210"},{"text":"(b)","paragraph_id":"para_211"},{"text":"any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;","paragraph_id":"para_212"},{"text":"…’","paragraph_id":"para_213"},{"text":"Rules concerning the protection of intellectual property","paragraph_id":"para_214"},{"text":"18","paragraph_id":"para_215"},{"text":"Article 8 of Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights ( OJ 2004 L 157, p. 45 , and corrigendum in OJ 2004 L 195, p. 16 ), headed ‘Right of information’, provides:","paragraph_id":"para_216"},{"text":"‘1.   Member States shall ensure that, in the context of proceedings concerning an infringement of an intellectual property right and in response to a justified and proportionate request of the claimant, the competent judicial authorities may order that information on the origin and distribution networks of the goods or services which infringe an intellectual property right be provided by the infringer …:","paragraph_id":"para_217"},{"text":"2.   The information referred to in paragraph 1 shall, as appropriate, comprise:","paragraph_id":"para_218"},{"text":"(a)","paragraph_id":"para_219"},{"text":"the names and addresses of the producers, manufacturers, distributors, suppliers and other previous holders of the goods or services, as well as the intended wholesalers and retailers;","paragraph_id":"para_220"},{"text":"…","paragraph_id":"para_221"},{"text":"3.   Paragraphs 1 and 2 shall apply without prejudice to other statutory provisions which:","paragraph_id":"para_222"},{"text":"(a)","paragraph_id":"para_223"},{"text":"grant the rightholder rights to receive fuller information;","paragraph_id":"para_224"},{"text":"(b)","paragraph_id":"para_225"},{"text":"govern the use in civil or criminal proceedings of the information communicated pursuant to this Article;","paragraph_id":"para_226"},{"text":"(c)","paragraph_id":"para_227"},{"text":"govern responsibility for misuse of the right of information; or","paragraph_id":"para_228"},{"text":"(d)","paragraph_id":"para_229"},{"text":"afford an opportunity for refusing to provide information which would force the person referred to in paragraph 1 to admit to his/her own participation or that of his/her close relatives in an infringement of an intellectual property right; or","paragraph_id":"para_230"},{"text":"(e)","paragraph_id":"para_231"},{"text":"govern the protection of confidentiality of information sources or the processing of personal data.’","paragraph_id":"para_232"},{"text":"French law","paragraph_id":"para_233"},{"text":"The CPI","paragraph_id":"para_234"},{"text":"19","paragraph_id":"para_235"},{"text":"Article L. 331-12 of the Intellectual Property Code, in the version in force on the date of the decision contested by the applicants in the main proceedings (‘the CPI’), provides:","paragraph_id":"para_236"},{"text":"‘The Haute Autorité pour la diffusion des œuvres et la protection des droits sur internet [(High Authority for the dissemination of works and the protection of rights on the internet; “Hadopi”)] is an independent public authority. …’","paragraph_id":"para_237"},{"text":"20","paragraph_id":"para_238"},{"text":"Article L. 331-13 of that code provides:","paragraph_id":"para_239"},{"text":"‘[Hadopi] shall:","paragraph_id":"para_240"},{"text":"1. Encourage the development of legal offers and monitor the lawful and unlawful use of works and subject matter covered by a copyright or a related right on electronic communications networks used for the provision of online public communication services;","paragraph_id":"para_241"},{"text":"2. Protect such works and subject matter from infringements of those rights committed in electronic communications networks used for the provision of online public communications services;","paragraph_id":"para_242"},{"text":"…’","paragraph_id":"para_243"},{"text":"21","paragraph_id":"para_244"},{"text":"Under Article L. 331-15 of that code:","paragraph_id":"para_245"},{"text":"‘[Hadopi] shall consist of a College and a Committee for the protection of rights. …","paragraph_id":"para_246"},{"text":"…","paragraph_id":"para_247"},{"text":"In the exercise of their functions, the members of the College and of the Committee for the protection of rights shall not receive instructions from any authority.’","paragraph_id":"para_248"},{"text":"22","paragraph_id":"para_249"},{"text":"The first paragraph of Article L. 331-17 of that code provides:","paragraph_id":"para_250"},{"text":"‘The Committee for the protection of rights shall be responsible for taking the measures provided for in Article L. 331-25.’","paragraph_id":"para_251"},{"text":"23","paragraph_id":"para_252"},{"text":"Under Article L. 331-21 of the CPI:","paragraph_id":"para_253"},{"text":"‘In order for the Committee for the protection of rights to carry out its duties, [Hadopi] shall be staffed by sworn public officials authorised by [its] President in accordance with conditions laid down by decree made after hearing the Conseil d’État [(Council of State, France)]. …","paragraph_id":"para_254"},{"text":"The members of the Committee for the protection of rights and the officials mentioned in the previous paragraph shall receive referrals to the committee in the manner prescribed in Article L. 331-24. They shall examine the facts.","paragraph_id":"para_255"},{"text":"They may, where necessary for the purposes of the procedure, obtain any document, irrespective of the medium on which it is stored, including data that have been retained and processed by electronic communications operators pursuant to Article L. 34-1 of the code des postes et des communications éle …","paragraph_id":"para_256"},{"text":"They may also obtain copies of the documents mentioned in the preceding paragraph.","paragraph_id":"para_257"},{"text":"They may, in particular, obtain from electronic communications operators the identity, postal address, email address and telephone number of the subscriber whose access to online public communications services has been used for the purposes of the reproduction, representation, making available or communication to the public of protected works or subject matter without the authorisation of the holders of the rights … where such authorisation is required.’","paragraph_id":"para_258"},{"text":"24","paragraph_id":"para_259"},{"text":"Article L. 331-24 of that code provides:","paragraph_id":"para_260"},{"text":"‘The Committee for the protection of rights shall act upon referral by sworn and authorised agents … appointed by:","paragraph_id":"para_261"},{"text":"–","paragraph_id":"para_262"},{"text":"lawfully constituted professional defence bodies;","paragraph_id":"para_263"},{"text":"–","paragraph_id":"para_264"},{"text":"collective management organisations;","paragraph_id":"para_265"},{"text":"–","paragraph_id":"para_266"},{"text":"the Centre national du cinéma et de l’image animée [(National Centre for Cinema and the Moving Image, France)].","paragraph_id":"para_267"},{"text":"The Committee for the protection of rights may also act on the basis of information forwarded to it by the procureur de la République [(Office of the Public Prosecutor, France)].","paragraph_id":"para_268"},{"text":"Offending conduct dating back more than six months may not be referred to it.’","paragraph_id":"para_269"},{"text":"25","paragraph_id":"para_270"},{"text":"Under Article L. 331-25 of that code, which governs the ‘graduated response’ procedure:","paragraph_id":"para_271"},{"text":"‘Where the offending conduct referred to it is liable to constitute a failure to fulfil the obligation laid down in Article L. 336-3 [of the CPI], the Committee for the protection of rights may send the subscriber … a recommendation drawing his or her attention to the provisions of Article L. 336-3, …","paragraph_id":"para_272"},{"text":"If the subscriber again engages in conduct liable to constitute a failure to fulfil the obligation laid down in Article L. 336-3 within six months of the recommendation referred to in the first paragraph being sent, the Committee may issue a further recommendation by electronic means containing the …","paragraph_id":"para_273"},{"text":"Recommendations issued on the basis of this article shall state the date and time when the conduct liable to constitute a failure to fulfil the obligation laid down in Article L. 336-3 were detected. However, they shall not disclose the content of the protected works or subject matter affected by th …","paragraph_id":"para_274"},{"text":"26","paragraph_id":"para_275"},{"text":"Article L. 331-29 of the CPI states:","paragraph_id":"para_276"},{"text":"‘[Hadopi] is authorised to establish a system for the automated processing of personal data relating to individuals who are the subject of a procedure under this subsection.","paragraph_id":"para_277"},{"text":"The purpose of that processing shall be to enable the Committee for the protection of rights to implement the measures provided for in this subsection, to carry out any related procedural acts, and to implement the procedures for informing professional defence bodies and collective management organisations of any referrals to a judicial authority and of the notifications referred to in the fifth paragraph of Article L. 335-7.","paragraph_id":"para_278"},{"text":"Detailed rules for the application of this article shall be laid down by decree … Those rules shall state, inter alia:","paragraph_id":"para_279"},{"text":"–","paragraph_id":"para_280"},{"text":"the categories of data that may be recorded and the period of time for which they may be retained;","paragraph_id":"para_281"},{"text":"–","paragraph_id":"para_282"},{"text":"the parties to which those data may be communicated, which shall include providers of access to online public communications services;","paragraph_id":"para_283"},{"text":"–","paragraph_id":"para_284"},{"text":"the manner in which the individuals concerned may exercise, before [Hadopi], their right of access to data concerning them …’","paragraph_id":"para_285"},{"text":"27","paragraph_id":"para_286"},{"text":"The first and second paragraphs of Article L. 335-2 of that code stipulate:","paragraph_id":"para_287"},{"text":"‘Any edition of writings, musical compositions, drawings, paintings or any other production, printed or engraved in whole or in part, contrary to the laws and regulations relating to the authors’ ownership, is a counterfeit and any counterfeiting is an offence.","paragraph_id":"para_288"},{"text":"The counterfeiting in France of works published in France or abroad is punishable by three years’ imprisonment and a fine of EUR 300000.’","paragraph_id":"para_289"},{"text":"28","paragraph_id":"para_290"},{"text":"The first paragraph of Article L. 335-4 of that code provides:","paragraph_id":"para_291"},{"text":"‘Any fixation, reproduction, communication or making available to the public, whether for consideration or free of charge, or any television broadcast of a performance, phonogram, videogram, programme or press publication, made without the authorisation, where required, of the performer, the phonogram or videogram producer, the audiovisual communications undertaking, the press publisher or the news agency is punishable by three years’ imprisonment and a fine of EUR 300000.’","paragraph_id":"para_292"},{"text":"29","paragraph_id":"para_293"},{"text":"Article L. 335-7 of the CPI lays down the rules relating to the imposition, on persons guilty of the criminal offences referred to, inter alia, in Articles L. 335-2 and L. 335-4 of that code, of the additional penalty of suspension of access to an online public communication service for a maximum period of one year.","paragraph_id":"para_294"},{"text":"30","paragraph_id":"para_295"},{"text":"The first paragraph of Article L. 335-7-1 of that code reads as follows:","paragraph_id":"para_296"},{"text":"‘In the case of minor offences in the fifth class provided for in this Code, where provided for by the regulations, the additional penalty defined in Article L. 335-7 may be imposed in accordance with the same rules, in the event of gross negligence, on the holder of access to an online public commu …","paragraph_id":"para_297"},{"text":"31","paragraph_id":"para_298"},{"text":"Pursuant to Article L. 336-3 of that code:","paragraph_id":"para_299"},{"text":"‘A person having a right of access to online public communications services is under an obligation to ensure that that access is not used for the purposes of the reproduction, representation, making available or communication to the public of works or subject matter protected by copyright or by a related right without the authorisation of the holders … where such authorisation is required.","paragraph_id":"para_300"},{"text":"Failure by the person having access to comply with the obligation set out in the first paragraph shall not have the effect of rendering him or her liable under criminal law …’","paragraph_id":"para_301"},{"text":"32","paragraph_id":"para_302"},{"text":"The first paragraph of Article R. 331-37 of the CPI provides:","paragraph_id":"para_303"},{"text":"‘Electronic communications operators … and service providers … shall send, using a connection to the automated personal data processing system mentioned in Article L. 331-29 or using a recording medium which ensures their integrity and security, the personal data and the information mentioned in poi …","paragraph_id":"para_304"},{"text":"33","paragraph_id":"para_305"},{"text":"Under Article R. 331-40 of that code:","paragraph_id":"para_306"},{"text":"‘Where, within a period of one year following submission of the recommendation referred to in the first paragraph of Article L. 335-7-1, new offending conduct liable to constitute gross negligence as defined in Article R. 335-5 is referred to the Committee for the protection of rights, it shall info …","paragraph_id":"para_307"},{"text":"The Committee for the protection of rights may, on its own initiative, invite the person concerned to attend a hearing. The letter of invitation shall state that the person concerned is entitled to be assisted by a lawyer.’","paragraph_id":"para_308"},{"text":"34","paragraph_id":"para_309"},{"text":"Article R. 335-5 of the CPI states:","paragraph_id":"para_310"},{"text":"‘I. – Where the conditions laid down in paragraph II are met, gross negligence, punishable by the fine laid down for minor offences in the fifth class, shall be committed by a person having a right of access to online public communications services who, without legitimate reason:","paragraph_id":"para_311"},{"text":"1. has failed to establish measures to make such access secure; or","paragraph_id":"para_312"},{"text":"2. has failed to exercise due care in the implementation of those measures.","paragraph_id":"para_313"},{"text":"II. – The provisions of paragraph I shall not apply unless the following two conditions are met:","paragraph_id":"para_314"},{"text":"1. Under Article L. 331-25 and in accordance with the formal requirements laid down in that article, the Committee for the protection of rights has recommended to the person having a right of access to implement measures to make his or her access secure so as to prevent such access being used again …","paragraph_id":"para_315"},{"text":"2. During the year following receipt of that recommendation, that access is used on a further occasion for the purposes referred to in point 1 of paragraph II.’","paragraph_id":"para_316"},{"text":"35","paragraph_id":"para_317"},{"text":"With effect from 1 January 2022, pursuant to loi n o  2021-1382, du 25 octobre 2021, relative à la régulation et à la protection de l’accès aux œuvres culturelles à l’ère numérique [(Law No 2021-1382 of 25 October 2021 on the regulation and protection of access to cultural works in the digital era)] …","paragraph_id":"para_318"},{"text":"36","paragraph_id":"para_319"},{"text":"The graduated response procedure, referred to in paragraph 25 above, has, however, remained essentially unchanged even though it is no longer implemented by Hadopi’s Committee for the protection of rights, which was composed of three members appointed by the Conseil d’État (Council of State), the Co …","paragraph_id":"para_320"},{"text":"Decree No 2010-236","paragraph_id":"para_321"},{"text":"37","paragraph_id":"para_322"},{"text":"Article 1 of Decree No 2010-236, adopted on the basis, inter alia, of Article L. 331-29 of the CPI, provides:","paragraph_id":"para_323"},{"text":"‘The purpose of the personal data processing system known as the “System for the management of measures for the protection of works on the internet” is to enable the Commission for the protection of rights of [Hadopi]:","paragraph_id":"para_324"},{"text":"1. to implement the measures provided for in Book III of the legislative part of the [CPI] (Title III, Chapter I, Section 3, Subsection 3) and Book III of the regulatory part of that code (Title III, Chapter I, Section 2, Subsection 2);","paragraph_id":"para_325"},{"text":"2. to refer conduct liable to constitute an offence under Articles L. 335-2, L. 335-3, L. 335-4 and R. 335-5 of the [CPI] to the Office of the Public Prosecutor and to inform professional defence bodies and collective management organisations of those referrals;","paragraph_id":"para_326"},{"text":"…’","paragraph_id":"para_327"},{"text":"38","paragraph_id":"para_328"},{"text":"Article 4 of that decree provides:","paragraph_id":"para_329"},{"text":"‘I. – The sworn public officials authorised by the President of [Hadopi] pursuant to Article L. 331-21 of the [CPI] and the members of the Committee for the protection of rights mentioned in Article 1 shall have direct access to the personal data and information referred to in the Annex to this Decree.","paragraph_id":"para_330"},{"text":"II – The electronic communications operators and the providers referred to in point 2 of the Annex to this Decree shall be sent:","paragraph_id":"para_331"},{"text":"–","paragraph_id":"para_332"},{"text":"the technical data required to identify the subscriber;","paragraph_id":"para_333"},{"text":"–","paragraph_id":"para_334"},{"text":"the recommendations provided for in Article L. 331-25 of the [CPI] for notification by electronic means to their subscribers;","paragraph_id":"para_335"},{"text":"–","paragraph_id":"para_336"},{"text":"the information necessary for the implementation of additional penalties of suspension of access to an online public communications service notified to the Commission for the protection of rights by the Office of the Public Prosecutor.","paragraph_id":"para_337"},{"text":"III – Professional defence bodies and collective management organisations shall be informed of referrals to the Office of the Public Prosecutor.","paragraph_id":"para_338"},{"text":"IV – Judicial authorities shall be sent the reports of conduct liable to constitute an offence under Articles L. 335-2, L. 335-3, L. 335-4, L. 335-7, R. 331-37, R. 331‑38 and R. 335-5 of the [CPI].","paragraph_id":"para_339"},{"text":"The enforcement of a penalty of suspension shall be notified to the automated criminal records system.’","paragraph_id":"para_340"},{"text":"39","paragraph_id":"para_341"},{"text":"The annex to that decree provides:","paragraph_id":"para_342"},{"text":"‘The personal data and information recorded in the processing system known as the “System for the management of measures for the protection of works on the internet” shall be as follows:","paragraph_id":"para_343"},{"text":"1. Personal data and information from lawfully constituted professional defence bodies, collective management organisations, the National Centre for Cinema and the Moving Image, and the Office of the Public Prosecutor:","paragraph_id":"para_344"},{"text":"Regarding conduct liable to constitute a failure to fulfil the obligation laid down in Article L. 336-3 of the [CPI]:","paragraph_id":"para_345"},{"text":"Date and time of the occurrence;","paragraph_id":"para_346"},{"text":"IP address of the subscribers concerned;","paragraph_id":"para_347"},{"text":"Peer-to-peer protocol used;","paragraph_id":"para_348"},{"text":"Pseudonym used by the subscriber;","paragraph_id":"para_349"},{"text":"Information on the protected works or subject matter affected by the conduct;","paragraph_id":"para_350"},{"text":"File name as it appears on the subscriber’s device (where applicable);","paragraph_id":"para_351"},{"text":"Internet service provider through which access was arranged or which supplied the IP technical resource.","paragraph_id":"para_352"},{"text":"…","paragraph_id":"para_353"},{"text":"2. Personal data and information concerning the subscriber collected from electronic communications operators … and providers …:","paragraph_id":"para_354"},{"text":"Surname, forenames;","paragraph_id":"para_355"},{"text":"Postal address and email addresses;","paragraph_id":"para_356"},{"text":"Telephone number;","paragraph_id":"para_357"},{"text":"Address of the subscriber’s telephone installation;","paragraph_id":"para_358"},{"text":"Internet service provider, using the technical facilities of the service provider referred to in point 1 with which the subscriber has taken out a contract; reference number;","paragraph_id":"para_359"},{"text":"start date of suspension of access to an online public communications service.","paragraph_id":"para_360"},{"text":"…’","paragraph_id":"para_361"},{"text":"The Post and Electronic Communications Code","paragraph_id":"para_362"},{"text":"40","paragraph_id":"para_363"},{"text":"Article L. 34-1, II bis , of the Post and Electronic Communications Code provides:","paragraph_id":"para_364"},{"text":"‘Electronic communications operators shall retain:","paragraph_id":"para_365"},{"text":"1. for the purposes of criminal proceedings, preventing threats to public security and safeguarding national security, information relating to the user’s civil identity until the expiry of a period of five years from the date on which his or her contract ends;","paragraph_id":"para_366"},{"text":"2. for the same purposes as those set out in paragraph II bis (1), other information supplied by the user when taking out a contract or creating an account and payment information until the expiry of a period of one year from the date on which his or her contract ends or his or her account is closed;","paragraph_id":"para_367"},{"text":"3. for the purposes of combating serious crime, preventing serious threats to public security and safeguarding national security, the technical data enabling the connection source to be identified or relating to the terminal equipment used until the expiry of a period of one year from the connection or use of the terminal equipment.’","paragraph_id":"para_368"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_369"},{"text":"41","paragraph_id":"para_370"},{"text":"The Premier ministre (Prime Minister, France) having implicitly rejected their application for the repeal of Decree No 2010-236, the applicants in the main proceedings brought an action before the Conseil d’État (Council of State), by application of 12 August 2019, seeking the annulment of that impl …","paragraph_id":"para_371"},{"text":"42","paragraph_id":"para_372"},{"text":"As regards the part of the action relating to the alleged breach of the Constitution, the Conseil d’État (Council of State) referred a priority question on constitutionality to the Conseil constitutionnel (Constitutional Council, France).","paragraph_id":"para_373"},{"text":"43","paragraph_id":"para_374"},{"text":"By Decision No 2020-841 QPC of 20 May 2020, La Quadrature du Net et autres [Droit de communication à la Hadopi], the Conseil constitutionnel (Constitutional Council) declared the third and fourth paragraphs of Article L. 331-21 of the CPI contrary to the Constitution but declared the fifth paragraph of that article – with the exception of the words ‘in particular’ – consistent with the Constitution.","paragraph_id":"para_375"},{"text":"44","paragraph_id":"para_376"},{"text":"As regards the part of the action relating to the alleged infringement of EU law, the applicants in the main proceedings submitted, in particular, that Decree No 2010-236 and the provisions which constitute its legal basis permit access to connection data in a disproportionate manner for non-serious …","paragraph_id":"para_377"},{"text":"45","paragraph_id":"para_378"},{"text":"In that regard, the referring court, the Conseil d’État (Council of State), notes, first, that, in the judgment of 6 October 2020, La Quadrature du Net and Others ( C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 ), the Court held, inter alia, that Article 15(1) of Directive 2002/58, read in the lig …","paragraph_id":"para_379"},{"text":"46","paragraph_id":"para_380"},{"text":"The referring court infers from this that, as regards access to data relating to the civil identity of users of electronic communications systems, the plea raised by the applicants in the main proceedings alleging that Decree No 2010-236 is unlawful since it was adopted in the context of action to combat non-serious offences must be rejected.","paragraph_id":"para_381"},{"text":"47","paragraph_id":"para_382"},{"text":"The referring court observes, secondly, that in the judgment of 21 December 2016, Tele2 Sverige and Watson and Others ( C‑203/15 and C‑698/15 , EU:C:2016:970 ), the Court held, inter alia, that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Cha …","paragraph_id":"para_383"},{"text":"48","paragraph_id":"para_384"},{"text":"The referring court refers, more specifically, to paragraph 120 of that judgment, in which the Court stated that it is essential that such access to retained data should, as a general rule, except in cases of duly justified urgency, be subject to the requirement of a prior review carried out either …","paragraph_id":"para_385"},{"text":"49","paragraph_id":"para_386"},{"text":"The Court referred to that requirement in the judgment of 6 October 2020, La Quadrature du Net and Others ( C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 ), as regards the real-time collection of connection data by the intelligence services, and in the judgment of 2 March 2021, Prokuratuur(Conditions of access to data relating to electronic communications) ( C‑746/18 , EU:C:2021:152 ), as regards access by national authorities to connection data.","paragraph_id":"para_387"},{"text":"50","paragraph_id":"para_388"},{"text":"The referring court also notes that Hadopi, since its establishment in 2009, has issued over 12.7 million recommendations to subscribers under the graduated response procedure provided for in Article L. 331-25 of the CPI, including 827791 in 2019 alone. It follows that the officials of the Committee …","paragraph_id":"para_389"},{"text":"51","paragraph_id":"para_390"},{"text":"In those circumstances, the Conseil d’État (Council of State) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_391"},{"text":"‘(1)","paragraph_id":"para_392"},{"text":"Are the civil identity data corresponding to an IP address included among the traffic and location data to which, in principle, the requirement [of] prior review by a court or an independent administrative entity [whose decisions are binding] applies?","paragraph_id":"para_393"},{"text":"(2)","paragraph_id":"para_394"},{"text":"If the first question is answered in the affirmative, and having regard to the fact that the data relating to the civil identity of users, including their contact details, are not particularly sensitive data, is Directive [2002/58], read in the light of the [Charter], to be interpreted as precluding …","paragraph_id":"para_395"},{"text":"(3)","paragraph_id":"para_396"},{"text":"If the second question is answered in the affirmative, and having regard to the fact that the data relating to civil identity are not particularly sensitive data, that only those data may be collected and they may be collected solely for the purposes of preventing failures to fulfil obligations whic …","paragraph_id":"para_397"},{"text":"Consideration of the questions referred","paragraph_id":"para_398"},{"text":"52","paragraph_id":"para_399"},{"text":"By its three questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which authorises t …","paragraph_id":"para_400"},{"text":"Preliminary observations","paragraph_id":"para_401"},{"text":"53","paragraph_id":"para_402"},{"text":"The case in the main proceedings involves two separate and successive personal data processing operations carried out in the context of the activities of Hadopi, an independent public authority whose mission, in accordance with Article L. 331-13 of the CPI, is to protect works and subject matter cov …","paragraph_id":"para_403"},{"text":"54","paragraph_id":"para_404"},{"text":"The first processing operation, carried out upstream by sworn and authorised agents of rightholder organisations, takes place in two stages. First, IP addresses that appear to have been used for activities liable to constitute an infringement of copyright or related rights are collected on peer-to-p …","paragraph_id":"para_405"},{"text":"55","paragraph_id":"para_406"},{"text":"The second processing operation, carried out downstream by the internet service providers at Hadopi’s request, also takes place in two stages. First, the IP addresses collected upstream are matched with the holders of those addresses. Secondly, a set of personal data and information relating to thos …","paragraph_id":"para_407"},{"text":"56","paragraph_id":"para_408"},{"text":"Regarding the latter, the fifth paragraph of Article L. 331-21 of the CPI, in the version resulting from the decision of the Conseil constitutionnel (Constitutional Council) referred to in paragraph 43 above, provides that the members of Hadopi’s Committee for the protection of rights and the sworn …","paragraph_id":"para_409"},{"text":"57","paragraph_id":"para_410"},{"text":"Those different personal data processing operations are intended to enable Hadopi to take, with regard to the IP address holders thus identified, the measures provided for in the administrative procedure known as the ‘graduated response’ governed by Article L. 331-25 of the CPI. Those measures are, …","paragraph_id":"para_411"},{"text":"58","paragraph_id":"para_412"},{"text":"That being said, the questions raised by the referring court concern only the downstream processing described in paragraph 55 above and not the upstream processing, the essential characteristics of which were set out in paragraph 54 above.","paragraph_id":"para_413"},{"text":"59","paragraph_id":"para_414"},{"text":"It must however be noted that, if the prior collection of IP addresses by the rightholder organisations concerned were contrary to EU law, EU law would also preclude the use of those data in the context of the subsequent processing by providers of electronic communications services consisting in matching those addresses to data relating to the civil identity of the holders of those addresses.","paragraph_id":"para_415"},{"text":"60","paragraph_id":"para_416"},{"text":"In that context, it should be recalled at the outset that, according to the Court’s case-law, IP addresses constitute both traffic data for the purposes of Directive 2002/58 and personal data for the purposes of the GDPR (see, to that effect, judgment of 17 June 2021, M.I.C.M., C‑597/19 , EU:C:2021:492 , paragraphs  102 and  113 and the case-law cited).","paragraph_id":"para_417"},{"text":"61","paragraph_id":"para_418"},{"text":"However, the collection of IP addresses which are public and visible to everyone, by agents of rightholder organisations, does not fall within the scope of Directive 2002/58, since such processing clearly does not take place ‘in connection with the provision of … electronic communications services’, within the meaning of Article 3 of that directive.","paragraph_id":"para_419"},{"text":"62","paragraph_id":"para_420"},{"text":"By contrast, such a collection of IP addresses, authorised, as can be seen from the documents before the Court, within certain quantitative limits and under certain conditions, by the Commission nationale de l’informatique et des libertés (CNIL) (National Commission for Information Technology and Ci …","paragraph_id":"para_421"},{"text":"63","paragraph_id":"para_422"},{"text":"As regards the downstream processing described in paragraph 55 above, it falls within the scope of Directive 2002/58 since it takes place ‘in connection with the provision of … electronic communications services’, within the meaning of Article 3 of that directive, inasmuch as the data at issue are obtained from providers of electronic communications services in accordance with Article L. 331-21 of the CPI.","paragraph_id":"para_423"},{"text":"Whether access by a public authority to data relating to the civil identity associated with an IP address retained by providers of electronic communications services for the purpose of combating counterfeiting offences committed online can be justified under Article 15(1) of Directive 2002/58","paragraph_id":"para_424"},{"text":"64","paragraph_id":"para_425"},{"text":"In the light of the foregoing preliminary observations, the question arises as to whether, as the referring court asks, the limitation on the fundamental rights enshrined in Articles 7, 8 and 11 of the Charter entailed by access by a public authority, such as Hadopi, to data relating to the civil identity associated with an IP address which it already has can be justified under Article 15(1) of Directive 2002/58.","paragraph_id":"para_426"},{"text":"65","paragraph_id":"para_427"},{"text":"Access to such personal data may be granted only in so far as they have been retained in a manner consistent with Directive 2002/58 (see, to that effect, judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications), C‑746/18 , EU:C:2021:152 , paragraph  29 ).","paragraph_id":"para_428"},{"text":"The requirements surrounding the retention of data relating to civil identity and associated IP addresses by providers of electronic communications services","paragraph_id":"para_429"},{"text":"66","paragraph_id":"para_430"},{"text":"Article 15(1) of Directive 2002/58 enables the Member States to introduce exceptions to the obligation of principle, laid down in Article 5(1) of that directive, to ensure the confidentiality of personal data, and to the corresponding obligations, referred to, inter alia, in Articles 6 and 9 of that …","paragraph_id":"para_431"},{"text":"67","paragraph_id":"para_432"},{"text":"A legislative measure adopted under that provision must therefore correspond, genuinely and strictly, to one of the objectives mentioned in the preceding paragraph – the list of those objectives set out in the first sentence of Article 15(1) of Directive 2002/58 being exhaustive – and comply with th …","paragraph_id":"para_433"},{"text":"68","paragraph_id":"para_434"},{"text":"Thus, the interpretation of Article 15(1) of Directive 2002/58 must take account of the importance both of the right to respect for private life, guaranteed in Article 7 of the Charter, and of the right to protection of personal data, guaranteed in Article 8 thereof, as derived from the case-law of …","paragraph_id":"para_435"},{"text":"69","paragraph_id":"para_436"},{"text":"It should be emphasised, in that regard, that the retention of traffic and location data constitutes, in itself, first, a derogation from the prohibition laid down in Article 5(1) of Directive 2002/58 barring any person other than the user from storing those data, and, secondly, an interference with …","paragraph_id":"para_437"},{"text":"70","paragraph_id":"para_438"},{"text":"That being said, in so far as Article 15(1) of Directive 2002/58 allows Member States to introduce certain derogating measures, as noted in paragraph 66 above, that provision reflects the fact that the rights enshrined in Articles 7, 8 and 11 of the Charter are not absolute rights, but must be consi …","paragraph_id":"para_439"},{"text":"71","paragraph_id":"para_440"},{"text":"In the present case, it should be noted that although, formally, Hadopi is authorised to access only data relating to the civil identity associated with an IP address, that access has the particular feature that it first requires the providers of electronic communications services concerned to match …","paragraph_id":"para_441"},{"text":"72","paragraph_id":"para_442"},{"text":"In addition, that public authority seeks access to those data for the sole purpose of identifying the holder of an IP address which has been used for activities liable to infringe copyright or related rights, since he or she has unlawfully made protected works available on the internet for downloadi …","paragraph_id":"para_443"},{"text":"73","paragraph_id":"para_444"},{"text":"That particular context cannot be ignored when examining the possible justification for a measure providing for the retention of personal data under Article 15(1) of Directive 2002/58, interpreted in the light of Articles 7, 8 and 11 of the Charter (see, by analogy, ECtHR, 24 April 2018, Benedik\n v . Slovenia , CE:ECHR:2018:0424JUD006235714, § 109).","paragraph_id":"para_445"},{"text":"74","paragraph_id":"para_446"},{"text":"Accordingly, it is in the light of the requirements arising, as regards the retention of IP addresses, from Article 15(1) of Directive 2002/58, interpreted in the light of Articles 7, 8 and 11 of the Charter, that it is necessary to examine any justification for the interference with the fundamental …","paragraph_id":"para_447"},{"text":"75","paragraph_id":"para_448"},{"text":"In that context, it should be noted that, according to the Court’s case-law, although, as noted in paragraph 60 above, IP addresses constitute traffic data for the purposes of Directive 2002/58, they are distinct from other categories of traffic data and location data.","paragraph_id":"para_449"},{"text":"76","paragraph_id":"para_450"},{"text":"In that regard, the Court has held that IP addresses are generated independently of any particular communication and mainly serve to identify, through providers of electronic communications services, the owner of the terminal equipment from which an internet communication is made. Thus, in relation …","paragraph_id":"para_451"},{"text":"77","paragraph_id":"para_452"},{"text":"It is true that, in paragraph 156 of the judgment of 6 October 2020, La Quadrature du Net and Others ( C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 ), the Court held that, despite the finding that IP addresses are less sensitive when they serve exclusively to identify the user of an electronic co …","paragraph_id":"para_453"},{"text":"78","paragraph_id":"para_454"},{"text":"The Court considered, in paragraph 153 of the same judgment, that, since IP addresses may, inter alia, when used to ‘track an internet user’s complete clickstream’ and, therefore, his or her online activity, enable a ‘detailed profile’ of the user to be produced, the retention and analysis of those …","paragraph_id":"para_455"},{"text":"79","paragraph_id":"para_456"},{"text":"However, it must be noted that the general and indiscriminate retention of a set – even a vast set – of static and dynamic IP addresses used by a person in a given period does not necessarily constitute, in every case, a serious interference with the fundamental rights guaranteed by Articles 7, 8 and 11 of the Charter.","paragraph_id":"para_457"},{"text":"80","paragraph_id":"para_458"},{"text":"In that regard, first of all, the cases that gave rise to the judgment of 6 October 2020, La Quadrature du Net and Others ( C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 ), concerned national legislation which involved an obligation to retain a set of data necessary to determine the date, time, du …","paragraph_id":"para_459"},{"text":"81","paragraph_id":"para_460"},{"text":"The retention of IP addresses under such national legislation was therefore such – in view of the other data which those rules required to be retained and the possibility of combining those various data – as to allow precise conclusions to be drawn about the private life of the persons whose data we …","paragraph_id":"para_461"},{"text":"82","paragraph_id":"para_462"},{"text":"By contrast, an obligation imposed on providers of electronic communications services, by a legislative measure under Article 15(1) of Directive 2002/58, to ensure the general and indiscriminate retention of IP addresses may, as the case may be, be justified by the objective of combating criminal of …","paragraph_id":"para_463"},{"text":"83","paragraph_id":"para_464"},{"text":"Accordingly, a Member State which seeks to impose on providers of electronic communications services an obligation to retain IP addresses, in a general and indiscriminate manner, in order to achieve an objective linked to combating criminal offences in general must ensure that the arrangements for t …","paragraph_id":"para_465"},{"text":"84","paragraph_id":"para_466"},{"text":"In order to ensure that such a combination of data allowing precise conclusions to be drawn about the private life of the person concerned is ruled out, the retention arrangements must relate to the very manner in which the retention is structured; in essence, that retention must be organised in such a way as to guarantee a genuinely watertight separation of the different categories of data retained.","paragraph_id":"para_467"},{"text":"85","paragraph_id":"para_468"},{"text":"In that regard, it is indeed for the Member State which seeks to impose on providers of electronic communications services an obligation to retain IP addresses, in a general and indiscriminate manner, in order to attain an objective linked to combating criminal offences in general, to lay down, in i …","paragraph_id":"para_469"},{"text":"86","paragraph_id":"para_470"},{"text":"In the first place, the national rules referred to in the preceding paragraph must ensure that each category of data, including data relating to civil identity and IP addresses, is kept completely separate from the other categories of data retained.","paragraph_id":"para_471"},{"text":"87","paragraph_id":"para_472"},{"text":"In the second place, those rules must ensure that, from a technical point of view, the separation of the various categories of retained data, in particular data relating to civil identity, IP addresses, the various traffic data other than IP addresses and the various location data, is genuinely watertight, by means of a secure and reliable computer system.","paragraph_id":"para_473"},{"text":"88","paragraph_id":"para_474"},{"text":"In the third place, in so far as those rules provide for the possibility of linking the retained IP addresses with the civil identity of the person concerned in compliance with the requirements stemming from Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 of the Charter …","paragraph_id":"para_475"},{"text":"89","paragraph_id":"para_476"},{"text":"In the fourth place, the reliability of that watertight separation must be subject to regular review by a public authority other than that which seeks to obtain access to the personal data retained by the providers of electronic communications services.","paragraph_id":"para_477"},{"text":"90","paragraph_id":"para_478"},{"text":"In so far as the applicable national legislation provides for such strict requirements relating to the arrangements for the general and indiscriminate retention of IP addresses and other data retained by providers of electronic communications services, the interference resulting from that retention of IP addresses cannot, due to the very manner in which that retention is structured, be categorised as ‘serious’.","paragraph_id":"para_479"},{"text":"91","paragraph_id":"para_480"},{"text":"Where such a legislative framework is introduced, the arrangements for the retention of IP addresses thus prescribed rule out the possibility that those data might be combined with other data retained in compliance with Directive 2002/58, allowing precise conclusions to be drawn about the private life of the person concerned.","paragraph_id":"para_481"},{"text":"92","paragraph_id":"para_482"},{"text":"Consequently, in the presence of a legislative framework meeting the requirements set out in paragraphs 86 to 89 above, ensuring that no combination of data will allow precise conclusions to be drawn about the private life of the persons in question, Article 15(1) of Directive 2002/58, read in the l …","paragraph_id":"para_483"},{"text":"93","paragraph_id":"para_484"},{"text":"Lastly, such a legislative framework must, as is apparent from paragraph 168 of the judgment of 6 October 2020, La Quadrature du Net and Others ( C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 ), provide for a retention period limited to what is strictly necessary and ensure, by means of clear and …","paragraph_id":"para_485"},{"text":"94","paragraph_id":"para_486"},{"text":"It is for the national court to ascertain whether the national legislation at issue in the main proceedings comply with the requirements referred to in paragraphs 85 to 93 above.","paragraph_id":"para_487"},{"text":"The requirements surrounding access to data relating to the civil identity associated with an IP address retained by providers of electronic communications services","paragraph_id":"para_488"},{"text":"95","paragraph_id":"para_489"},{"text":"It follows from the Court’s case-law that, in the field of combating criminal offences, only the objectives of combating serious crime or preventing serious threats to public security are capable of justifying the serious interference with the fundamental rights enshrined in Articles 7 and 8 of the …","paragraph_id":"para_490"},{"text":"96","paragraph_id":"para_491"},{"text":"However, where the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter entailed by a public authority’s access to data relating to civil identity retained by providers of electronic communications services, without it being possible for those data to be associated w …","paragraph_id":"para_492"},{"text":"97","paragraph_id":"para_493"},{"text":"It should also be added that, according to a principle established in the Court’s settled case-law, access to traffic and location data may be justified under Article 15(1) of Directive 2002/58 only by the public interest objective for which the providers of electronic communications services were o …","paragraph_id":"para_494"},{"text":"98","paragraph_id":"para_495"},{"text":"However, that objective of combating criminal offences in general is capable of justifying the grant of access to traffic and location data which were stored and thus retained to the extent and for the time necessary for the marketing and billing of services and the provision of value added services …","paragraph_id":"para_496"},{"text":"99","paragraph_id":"para_497"},{"text":"In the present case, in the first place, it is apparent from the national legislation at issue in the main proceedings that Hadopi does not have access to a ‘set of traffic or location data’, within the meaning of the case-law referred to in paragraph 95 above, with the result that it cannot, in pri …","paragraph_id":"para_498"},{"text":"100","paragraph_id":"para_499"},{"text":"According to that legislation and the explanations provided by the French Government in that regard, the access granted to that public authority is strictly limited to certain data relating to the civil identity of the holder of an IP address and is authorised for the sole purpose of enabling the id …","paragraph_id":"para_500"},{"text":"101","paragraph_id":"para_501"},{"text":"That national legislation must also lay down clear and precise rules capable of ensuring that the IP addresses retained in accordance with Directive 2002/58 can be used only to identify the person to whom a particular IP address was assigned, while precluding any use that allows the surveillance, by …","paragraph_id":"para_502"},{"text":"102","paragraph_id":"para_503"},{"text":"In addition, it follows from the principle established in the settled case-law referred to in paragraph 97 above that access such as that enjoyed by Hadopi under the national legislation at issue in the main proceedings, since it pursues the objective of combating criminal offences in general, can b …","paragraph_id":"para_504"},{"text":"103","paragraph_id":"para_505"},{"text":"Moreover, as can be seen from paragraphs 85 to 92 above, the retention of IP addresses, based on a legislative measure under Article 15(1) of Directive 2002/58, for the purposes of the objective of combating criminal offences in general, may be justified where the arrangements for that retention int …","paragraph_id":"para_506"},{"text":"104","paragraph_id":"para_507"},{"text":"Accordingly, in the light of the case-law referred to in paragraphs 95 to 97 above, where such a legislative framework is established, access to the IP addresses retained for the purposes of the objective of combating criminal offences in general may be justified as regards Article 15(1) of Directive 2002/58 where that access is authorised for the sole purpose of identifying the person suspected of being involved in such offences.","paragraph_id":"para_508"},{"text":"105","paragraph_id":"para_509"},{"text":"Moreover, allowing a public authority such as Hadopi to have access to data relating to the civil identity associated with a public IP address sent to it by rightholder organisations for the sole purpose of identifying the holder of that address used for online activities liable to infringe copyrigh …","paragraph_id":"para_510"},{"text":"106","paragraph_id":"para_511"},{"text":"In that case-law, while emphasising that the application of the measures provided for by Directive 2004/48 cannot affect the GDPR or Directive 2002/58, the Court held that Article 8(3) of Directive 2004/48, read in conjunction with Article 15(1) of Directive 2002/58 and Article 7(f) of Directive 95/ …","paragraph_id":"para_512"},{"text":"107","paragraph_id":"para_513"},{"text":"That being said, in the second place, for the purposes of the specific assessment of the extent of the interference with privacy entailed by a public authority’s access to personal data, the particular context in which that access takes place and, in particular, all the data and information communic …","paragraph_id":"para_514"},{"text":"108","paragraph_id":"para_515"},{"text":"Thus, in the present case, it is necessary to take into account, for the purposes of that assessment, the fact that, prior to accessing the data relating to the civil identity in question available to it, Hadopi receives from the rightholder organisations, inter alia, ‘information on the protected w …","paragraph_id":"para_516"},{"text":"109","paragraph_id":"para_517"},{"text":"It appears from the documents before the Court, subject to verification by the referring court, that the information on the work concerned – as recorded in a report whose content is governed by the deliberations of the CNIL of 10 June 2010 – is limited, essentially, to the title of the work concerned and an extract known as a ‘chunk’, in the form of an alphanumeric sequence and not an audio or video capture of the work.","paragraph_id":"para_518"},{"text":"110","paragraph_id":"para_519"},{"text":"In that regard, it is true that it cannot, broadly speaking, be ruled out that access by a public authority to a limited number of data relating to the civil identity of a holder of an IP address notified to that authority by a provider of electronic communications services for the sole purpose of i …","paragraph_id":"para_520"},{"text":"111","paragraph_id":"para_521"},{"text":"However, in the present case, in view of the nature of the limited data and information available to Hadopi, it is only in atypical situations that they are liable to reveal potentially sensitive information about aspects of the private life of the individual in question that, taken together, could enable that public authority to draw precise conclusions about his or her private life, for example by establishing a detailed profile of that person.","paragraph_id":"para_522"},{"text":"112","paragraph_id":"para_523"},{"text":"That could be the case, inter alia, with regard to a person whose IP address has been used for activities infringing copyright or related rights on peer-to-peer networks repeatedly, or on a large scale, in connection with protected works of particular types that can be grouped together on the basis of the words in their title that are liable to reveal potentially sensitive information about aspects of his or her private life.","paragraph_id":"para_524"},{"text":"113","paragraph_id":"para_525"},{"text":"That being said, various factors support the view that, in the present case, the interference with the privacy of a person suspected of having engaged in an activity infringing copyright or related rights permitted by legislation such as that at issue in the main proceedings is not necessarily of a …","paragraph_id":"para_526"},{"text":"114","paragraph_id":"para_527"},{"text":"Another factor capable of further reducing the degree of interference with the fundamental rights to the protection of privacy and personal data resulting from that access by Hadopi – which appears to follow from the documents before the Court but which it is for the referring court to verify – conc …","paragraph_id":"para_528"},{"text":"115","paragraph_id":"para_529"},{"text":"Thus, in so far as national legislation satisfies the conditions set out in paragraph 101 above, the IP addresses communicated to a public authority such as Hadopi do not make it possible to track the clickstream of the holder of those addresses, which tends to confirm the finding that the interference entailed by that authority’s access to the identification data at issue in the main proceedings cannot be classified as serious.","paragraph_id":"para_530"},{"text":"116","paragraph_id":"para_531"},{"text":"In the third place, it must be borne in mind that, in order to strike the necessary balance between the rights and interests at issue imposed by the requirement of proportionality laid down in the first sentence of Article 15(1) of Directive 2002/58, even though the freedom of expression and the con …","paragraph_id":"para_532"},{"text":"117","paragraph_id":"para_533"},{"text":"In that context, due account must be taken of the fact that, as the Court has already held, as regards offences committed online, accessing the IP addresses may be the only means of investigation enabling the person to whom that address was assigned at the time of the commission of the offence to be effectively identified (see, to that effect, judgment of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 , paragraph  154 ).","paragraph_id":"para_534"},{"text":"118","paragraph_id":"para_535"},{"text":"That tends to show, as the Advocate General also pointed out, in essence, in point 59 of his Opinion of 28 September 2023, that the retention of and access to those IP addresses are – as regards combating criminal offences such as offences infringing copyright or related rights committed online – st …","paragraph_id":"para_536"},{"text":"119","paragraph_id":"para_537"},{"text":"Moreover, as the Advocate General emphasised, in essence, in points 78 to 80 of his Opinion of 27 October 2022 and in points 80 and 81 of his Opinion of 28 September 2023, not to allow such access would carry a real risk of systemic impunity not only for criminal offences infringing copyright or rel …","paragraph_id":"para_538"},{"text":"120","paragraph_id":"para_539"},{"text":"It is true that access by a public authority such as Hadopi to civil identity data associated with the IP address from which the online offence was committed is not necessarily the only possible means of investigation in order to identify the person holding that address at the time that offence was …","paragraph_id":"para_540"},{"text":"121","paragraph_id":"para_541"},{"text":"However, as the Advocate General observed in point 83 of his Opinion of 28 September 2023, such a means of investigation would be particularly intrusive since it could reveal precise information on the private life of the persons concerned. It would thus entail, for those persons, a more serious interference with the rights guaranteed in Articles 7, 8 and 11 of the Charter than would follow from legislation such as that at issue in the main proceedings.","paragraph_id":"para_542"},{"text":"122","paragraph_id":"para_543"},{"text":"It follows from the foregoing that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter must be interpreted as meaning that it does not preclude, in principle, national legislation allowing a public authority responsible for the protection of …","paragraph_id":"para_544"},{"text":"The requirement of a prior review by a court or an independent administrative body before a public authority accesses data relating to the civil identity associated with an IP address","paragraph_id":"para_545"},{"text":"123","paragraph_id":"para_546"},{"text":"The question arises, however, whether access by the public authority to data relating to the civil identity associated with an IP address must also be subject to a prior review by a court or by an independent administrative body.","paragraph_id":"para_547"},{"text":"124","paragraph_id":"para_548"},{"text":"In that regard, it is in order to ensure, in practice, full observance of the conditions which the Member States are required to establish in order to ensure that the access is limited to what is strictly necessary that the Court has held that it is ‘essential’ that access by competent national auth …","paragraph_id":"para_549"},{"text":"125","paragraph_id":"para_550"},{"text":"That prior review requires, first, that the court or independent administrative body entrusted with carrying it out must have all the powers and provide all the guarantees necessary in order to reconcile the various legitimate interests and rights at issue. As regards a criminal investigation in par …","paragraph_id":"para_551"},{"text":"126","paragraph_id":"para_552"},{"text":"Secondly, where that review is carried out not by a court but by an independent administrative body, that body must have a status that enables it to act objectively and impartially when carrying out its duties and must, for that purpose, be free from any external influence. Accordingly, it follows t …","paragraph_id":"para_553"},{"text":"127","paragraph_id":"para_554"},{"text":"Thirdly, the independent review required in accordance with Article 15(1) of Directive 2002/58 must take place before any access to the data concerned, except in the event of duly justified urgency, in which case the review must take place within a short time. A subsequent review would not enable th …","paragraph_id":"para_555"},{"text":"128","paragraph_id":"para_556"},{"text":"That being said, although, as can be seen from the case-law referred to in paragraph 124 above, the Court has held that it is ‘essential’ that access by competent national authorities to traffic and location data be subject to a prior review carried out either by a court or by an independent adminis …","paragraph_id":"para_557"},{"text":"129","paragraph_id":"para_558"},{"text":"By contrast, in cases which concerned the conditions under which access to data relating to civil identity could be justified under Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 of the Charter, no express reference was made by the Court to the requirement of such a pr …","paragraph_id":"para_559"},{"text":"130","paragraph_id":"para_560"},{"text":"It follows from the Court’s case-law relating to the principle of proportionality, compliance with which is required by the first sentence of Article 15(1) of Directive 2002/58 – in particular the case-law according to which the question whether the Member States may justify a limitation on the righ …","paragraph_id":"para_561"},{"text":"131","paragraph_id":"para_562"},{"text":"Accordingly, having regard to that principle of proportionality, it must be held that the requirement of a prior review by a court or by an independent administrative body is necessary where, in the context of national legislation allowing a public authority to access personal data, that access carr …","paragraph_id":"para_563"},{"text":"132","paragraph_id":"para_564"},{"text":"Conversely, that requirement of prior review is not intended to apply where the interference with the fundamental rights concerned entailed by access by a public authority to personal data cannot be classified as serious.","paragraph_id":"para_565"},{"text":"133","paragraph_id":"para_566"},{"text":"That is the case for access to data relating to the civil identity of users of electronic communications for the sole purpose of identifying the user concerned, and without it being possible for those data to be associated with information on the communications made, since, according to the case-law …","paragraph_id":"para_567"},{"text":"134","paragraph_id":"para_568"},{"text":"It follows that, where a retention framework as described in paragraphs 86 to 89 above is put in place, access by the public authority to the data relating to the civil identity associated with the IP addresses thus retained is not, in principle, subject to the requirement of prior review by a court or by an independent administrative body.","paragraph_id":"para_569"},{"text":"135","paragraph_id":"para_570"},{"text":"That being said, as noted in paragraphs 110 and 111 above, it cannot be ruled out that, in atypical situations, the limited data and information made available to a public authority in the context of a procedure such as the graduated response procedure at issue in the main proceedings may be liable …","paragraph_id":"para_571"},{"text":"136","paragraph_id":"para_572"},{"text":"As noted in paragraph 112 above, such a risk to privacy may arise, inter alia, where a person engages in activities infringing copyright or related rights on peer-to-peer networks repeatedly, or on a large scale, in connection with protected works of particular types that can be grouped together on the basis of the words in their title, revealing potentially sensitive information about aspects of that person’s private life.","paragraph_id":"para_573"},{"text":"137","paragraph_id":"para_574"},{"text":"Thus, in the present case, in the context of the graduated response administrative procedure, a holder of an IP address may be particularly exposed to such a risk to his or her privacy where that procedure reaches the stage at which Hadopi must decide whether or not to refer the matter to the public prosecution service with a view to the prosecution of that person for conduct liable to constitute the minor offence of gross negligence or the offence of counterfeiting.","paragraph_id":"para_575"},{"text":"138","paragraph_id":"para_576"},{"text":"That referral presupposes that the holder of an IP address has already received two recommendations and a notification letter informing that person that his or her activities are liable to criminal prosecution, measures which imply that, on each occasion, Hadopi has had access to data relating to th …","paragraph_id":"para_577"},{"text":"139","paragraph_id":"para_578"},{"text":"It cannot be ruled out that, taken together and as the graduated response administrative procedure unfolds, the data thus provided in the various phases of that procedure may reveal concordant and potentially sensitive information about aspects of the private life of the person concerned thus making it possible to establish a profile of that person.","paragraph_id":"para_579"},{"text":"140","paragraph_id":"para_580"},{"text":"Thus, the intensity of the infringement of the right to respect for private life is likely to increase as the graduated response procedure, which is a sequential process, progresses through its various stages.","paragraph_id":"para_581"},{"text":"141","paragraph_id":"para_582"},{"text":"In the present case, Hadopi’s access to all of the data relating to the person concerned collected during the various stages of that procedure may, by the linking of those data, be liable to enable precise conclusions to be drawn about the private life of that person. Accordingly, in the context of …","paragraph_id":"para_583"},{"text":"142","paragraph_id":"para_584"},{"text":"Hadopi should be permitted to identify the cases in which the holder of the IP address concerned reaches that third stage of such a graduated response procedure. Accordingly, that procedure must be organised and structured in such a way that the civil identity data of a person associated with IP add …","paragraph_id":"para_585"},{"text":"143","paragraph_id":"para_586"},{"text":"Thus, that linking for the purposes of the third stage of the graduated procedure must be suspended when the obtention of those civil identity data, corresponding to a case in which an activity infringing copyright or related rights has possibly been repeated for a second time, triggers the requirement of a prior review by a court or an independent administrative body described in paragraph 141 above.","paragraph_id":"para_587"},{"text":"144","paragraph_id":"para_588"},{"text":"In addition, the organisation of the requirement for prior review referred to in paragraphs 141 to 143 above, since it is limited to the third stage of the graduated response procedure and does not apply to the previous stages of that procedure, also allows account to be taken of the argument that i …","paragraph_id":"para_589"},{"text":"145","paragraph_id":"para_590"},{"text":"Furthermore, as regards the object of the prior review referred to in paragraphs 141 to 143 above, it follows from the case-law referred to in paragraphs 95 and 96 above that, where the person concerned is suspected of having committed the offence of ‘gross negligence’ defined in Article R. 335-5 of …","paragraph_id":"para_591"},{"text":"146","paragraph_id":"para_592"},{"text":"However, even access allowing such precise conclusions to be drawn should be authorised in cases where the evidence before that court or independent administrative body supports the suspicion that the person has committed the offence of counterfeiting referred to in Article L. 335-2 of the CPI or Ar …","paragraph_id":"para_593"},{"text":"147","paragraph_id":"para_594"},{"text":"Lastly, as regards the manner in which that prior review is to be carried out, the French Government submits that, in view of the particular characteristics of Hadopi’s access to the data in question, in particular its massive scale, it would be appropriate for a prior review, if it were required, t …","paragraph_id":"para_595"},{"text":"148","paragraph_id":"para_596"},{"text":"However, a prior review may in no case be entirely automated since, as is apparent from the case-law referred to in paragraph 125 above, in the case of a criminal investigation, it is a requirement of such a review, in any event, that the court or independent administrative body concerned must be ab …","paragraph_id":"para_597"},{"text":"149","paragraph_id":"para_598"},{"text":"Such a balancing of the various legitimate interests and rights concerned requires the intervention of a natural person, all the more so where the automatic nature and large scale of the data processing in question poses privacy risks.","paragraph_id":"para_599"},{"text":"150","paragraph_id":"para_600"},{"text":"Furthermore, an entirely automated review is not, as a rule, capable of ensuring that the access does not go beyond the limits of what is strictly necessary and that the persons whose personal data are concerned have effective safeguards against the risks of abuse and against any unlawful access to or use of those data.","paragraph_id":"para_601"},{"text":"151","paragraph_id":"para_602"},{"text":"Thus, while automated reviews may make it possible to verify some of the information contained in the rightholder organisations’ reports, such reviews must, in any event, go hand in hand with reviews by natural persons that fully meet the requirements set out in paragraphs 125 to 127 above.","paragraph_id":"para_603"},{"text":"The requirements relating to the substantive and procedural conditions and to the safeguards against the risks of abuse and against any unlawful access to and use of those data applicable to the access by a public authority to data relating to the civil identity associated with an IP address","paragraph_id":"para_604"},{"text":"152","paragraph_id":"para_605"},{"text":"It is apparent from the case-law of the Court that access to personal data can satisfy the requirement of proportionality imposed by Article 15(1) of Directive 2002/58 only if the legislative measure authorising it provides, by means of clear and precise rules, that that access is subject to complia …","paragraph_id":"para_606"},{"text":"153","paragraph_id":"para_607"},{"text":"As the Court has pointed out, the need for such safeguards is all the greater where the personal data are subject to automated processing (judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18 , EU:C:2020:559 , paragraph  176 and the case-law cited).","paragraph_id":"para_608"},{"text":"154","paragraph_id":"para_609"},{"text":"In that regard, in reply to a question put by the Court with a view to the hearing on 5 July 2022, the French Government confirmed that, as stated, moreover, by Article L. 331-29 of the CPI, Hadopi’s access to data relating to civil identity in the context of the graduated response procedure is the …","paragraph_id":"para_610"},{"text":"155","paragraph_id":"para_611"},{"text":"It is apparent in particular from the documents before the Court that, in the course of that data processing, Hadopi officials check – in an essentially automated manner and without assessing the facts concerned as such – whether the reports referred to that authority contain all the information and …","paragraph_id":"para_612"},{"text":"156","paragraph_id":"para_613"},{"text":"Since such automated processing is likely to involve a certain number of false positives and, above all, the risk that a potentially very significant amount of personal data may be misused by third parties for unlawful or abusive purposes, it is important that, under a legislative measure, the data …","paragraph_id":"para_614"},{"text":"157","paragraph_id":"para_615"},{"text":"Lastly, it must be added that the processing of personal data by a public authority, such as the processing carried out by Hadopi in the context of the graduated response procedure, must comply with the specific rules for the protection of those data laid down by Directive 2016/680, the purpose of w …","paragraph_id":"para_616"},{"text":"158","paragraph_id":"para_617"},{"text":"In the present case, even if, under the applicable national law, it does not have decision-making powers of its own, Hadopi, when it processes personal data in the context of the graduated response procedure and adopts measures such as a recommendation or a notification to the person concerned that …","paragraph_id":"para_618"},{"text":"159","paragraph_id":"para_619"},{"text":"In that regard, the French Government stated, in response to a question put to it by the Court with a view to the hearing on 5 July 2022, that since the measures adopted by Hadopi in the context of the graduated response procedure ‘are of a pre-criminal nature directly linked to the judicial proceed …","paragraph_id":"para_620"},{"text":"160","paragraph_id":"para_621"},{"text":"By contrast, such data processing by Hadopi does not fall within the scope of the GDPR. Article 2(2)(d) of the GDPR provides that that regulation does not apply to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.","paragraph_id":"para_622"},{"text":"161","paragraph_id":"para_623"},{"text":"As the Advocate General observed in point 104 of his Opinion of 27 October 2022, since Hadopi is required to comply with Directive 2016/680 in the context of the graduated response procedure, the persons involved in such a procedure must enjoy a set of substantive and procedural safeguards including …","paragraph_id":"para_624"},{"text":"162","paragraph_id":"para_625"},{"text":"In that context, it is apparent from the national legislation at issue in the main proceedings that, in the context of the graduated response procedure, more specifically at the time the second recommendation is sent and at the time of the subsequent notification that the conduct found is liable to …","paragraph_id":"para_626"},{"text":"163","paragraph_id":"para_627"},{"text":"In any event, it is for the referring court to ascertain whether that national legislation provides for all the substantive and procedural safeguards prescribed by Directive 2016/680.","paragraph_id":"para_628"},{"text":"164","paragraph_id":"para_629"},{"text":"In the light of all the foregoing considerations, the answer to the three questions referred for a preliminary ruling is that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as not precluding national legislation whi …","paragraph_id":"para_630"},{"text":"–","paragraph_id":"para_631"},{"text":"those data are retained in conditions and in accordance with technical arrangements which ensure that the possibility that that retention might allow precise conclusions to be drawn about the private life of those IP address holders, for example by establishing a detailed profile of those persons, i …","paragraph_id":"para_632"},{"text":"–","paragraph_id":"para_633"},{"text":"that public authority’s access to such data retained separately and in a genuinely watertight manner serves exclusively to identify the person suspected of having committed a criminal offence and is subject to the necessary safeguards to ensure that that access cannot, except in atypical situations, …","paragraph_id":"para_634"},{"text":"–","paragraph_id":"para_635"},{"text":"the possibility, for the persons responsible for examining the facts within that public authority, of linking such data with files containing information that reveals the title of protected works the making available of which on the internet justified the collection of IP addresses by rightholder or …","paragraph_id":"para_636"},{"text":"–","paragraph_id":"para_637"},{"text":"the data processing system used by the public authority is subject at regular intervals to a review, by an independent body acting as a third party in relation to that public authority, intended to verify the integrity of the system, including the effective safeguards against the risks of abusive or unlawful access to or use of those data, and its effectiveness and reliability in detecting potential offending conduct.","paragraph_id":"para_638"},{"text":"Costs","paragraph_id":"para_639"},{"text":"165","paragraph_id":"para_640"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_641"},{"text":"On those grounds, the Court (Full Court) hereby rules:","paragraph_id":"para_642"},{"text":"Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/ …","paragraph_id":"para_643"},{"text":"must be interpreted as not precluding national legislation which authorises the public authority responsible for the protection of copyright and related rights against infringements of those rights committed on the internet to access data, retained by providers of publicly available electronic commu …","paragraph_id":"para_644"},{"text":"–","paragraph_id":"para_645"},{"text":"those data are retained in conditions and in accordance with technical arrangements which ensure that the possibility that that retention might allow precise conclusions to be drawn about the private life of those IP address holders, for example by establishing a detailed profile of those persons, i …","paragraph_id":"para_646"},{"text":"–","paragraph_id":"para_647"},{"text":"that public authority’s access to such data retained separately and in a genuinely watertight manner serves exclusively to identify the person suspected of having committed a criminal offence and is subject to the necessary safeguards to ensure that that access cannot, except in atypical situations, …","paragraph_id":"para_648"},{"text":"–","paragraph_id":"para_649"},{"text":"the possibility, for the persons responsible for examining the facts within that public authority, of linking such data with files containing information that reveals the title of protected works the making available of which on the internet justified the collection of IP addresses by rightholder or …","paragraph_id":"para_650"},{"text":"–","paragraph_id":"para_651"},{"text":"the data processing system used by the public authority is subject at regular intervals to a review, by an independent body acting as a third party in relation to that public authority, intended to verify the integrity of the system, including the effective safeguards against the risks of abusive or unlawful access to or use of those data, and its effectiveness and reliability in detecting potential offending conduct.","paragraph_id":"para_652"},{"text":"[Signatures]","paragraph_id":"para_653"},{"text":"(\n *1\n ) Language of the case: French.","paragraph_id":"para_654"}],"word_count":21305,"cites":["C-203/15","C-698/15","C-511/18","C-512/18","C-520/18","C-746/18","C-597/19","C-252/21","C-207/16","C-275/06","C-140/20","C-311/18"],"sha256":"4551cde75ecddbad15d5a5498fcbf14b9a3b94ec922ee94a5379569c74efa377","source_url":"https://publications.europa.eu/resource/celex/62021CJ0470.ENG.xhtml.ECR_62021CJ0470_EN_01.html","fetched_at":"2026-09-30T13:38:50.588+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-470-21","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-470-21","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-470-21","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-470-21"},"hash":"sha256:b5ed745f69d7bff054295d7cd1a5d51ec3df5436f52526932a889c5484141a10","version":"legal-2026-10-12","expires":"2026-10-14T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-12+legal-2026-10-12+2026-10-12T21:04:16","content_hash":"sha256:b5ed745f69d7bff054295d7cd1a5d51ec3df5436f52526932a889c5484141a10","revalidate_after":"2026-10-13T03:51:58.374Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-470-21","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-470-21"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-470-21"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-470-21"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":2},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-470-21","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-f159b9da4905fae03c361170d4007df8","response_hash":"sha256:b5ed745f69d7bff054295d7cd1a5d51ec3df5436f52526932a889c5484141a10"}},"freshness":{"freshness_class":"stable","as_of":"2026-11-02T16:48:14.931Z","valid_for":604800,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-470-21","note":"Oföränderligt objekt med hash. Får cachas länge.","tokens":40786}}