CJEU - C‑258/23 to C‑260/23 - Imagens Médicas Integradas

Summary

The Court of Justice of the European Union (CJEU) has ruled that business-related emails exchanged between employees and managers via an enterprise's email system are considered 'communications' protected by Article 7 of the Charter of Fundamental Rights (CFR). However, the court also held that national competition authorities can seize these emails during investigations without prior judicial authorization, provided there is a strict legal framework and adequate safeguards against abuse, including effective ex post judicial review.

Full text

Help CJEU - C‑258/23 to C‑260/23 - Imagens Médicas Integradas: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 09:11, 23 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators219 editsTag: Visual edit← Older edit Revision as of 13:11, 23 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators219 editsTag: Visual editNewer edit → Line 90: Line 90: === Holding ====== Holding === TBD.Regarding the first question and following the AG opinion, the CJEU held that Article 7 CFR must be interpreted to mean that the concept "communications", within the meaning of that article, includes business-related emails exchanged between employees and managers of an enterprise via the enterprise's email system. An email may be qualified as "work-related" does not deprive it of the protection that Article 7 CFR provides. Regarding the second and third question, the CJEU answered them all together. Articles 7 and 8 of the CFR must be interpreted as not precluding the seizure, without prior authorisation issued by a judge, of emails exchanged between employees and the management of an enterprise, during an inspection carried out by a national competition authority at the business or commercial premises of enterprises suspected of having committed infringements of Article 101 or Article 102 TFEU, provided that there is a strict legal framework governing the powers of that authority, as well as adequate and sufficient safeguards against abuse and arbitrariness, such as effective ex post judicial review of the measures in question == Comment ==== Comment == Revision as of 13:11, 23 July 2026 CJEU - C‑258/23 to C‑260/23 Imagens Médicas Integradas Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(1) GDPR Article 6(1)(e) GDPR Article 6(3) GDPR Article 101 TFEUArticle 102 TFEUArt. 7 CFREUArt. 8 CFREU Decided: 23.10.2025 Parties: Imagens Médicas Integradas SA Synlabhealth II S.A. Sociedade Gestora de Participações Sociais SA Autoridade da Concorrência Case Number/Name: C‑258/23 to C‑260/23 Imagens Médicas Integradas European Case Law Identifier: ECLI:EU:C:2025:814 Reference from: Tribunal da Concorrência, Regulação e Supervisão (Portugal) Language: 24 EU Languages Original Source: AG Opinion Initial Contributor: ap The AG opined that a national competition authority could lawfully seize emails of employees in relation to an investigation against a company, without prior judicial authorisation. This conduct is compatible with Articles 7 and 8 CFREU, provided there are a strict legal framework and safeguards in place. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts Imagens Médicas Integradas S.A., several companies in the SIBS group and Synlabhealth II S.A. (the controllers) are a number of companies in the medical field. Between 2021 and 2022, the national competition authority conducted several investigations under the authorisation of the Public Prosecutor’s Office. The information seized included employees’ emails and internal documents. The controllers objected to the competition authority seizing employees’ emails, and filed an appeal with the Tribunal da Concorrência, Regulação e Supervisão (Competition, Regulation and Supervision Court, Portugal). According to the controllers, the seizures were illegal, as they infringed their right to secrecy of correspondence. The competition court decided to stay proceedings and refer questions to the CJEU concerning the lawfulness of the seizure of emails of employees during investigations carried out by the competition authority. The competition court referred the following questions: Do the business records at issue in this case, which are transmitted by email, constitute “correspondence” for the purposes of Article 7 CFR? Does Article 7 CFR preclude business records arising from email communications between managers and employees of undertakings from being seized in the course of an investigation into agreements and practices prohibited under Article 101 TFEU (ex Article 81 [EC]) [or, in Case C 260/23, Article 102 TFEU (ex article 82 [EC])]? Does Article 7 CFR preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, bringing criminal prosecutions on the basis of the principle of legality and defending democratic legality in accordance with the Constitution, and which operates independently of the other central, regional and local authorities?’ In his initial opinion, the AG stated that Article 7 of the EU Charter of Fundamental Rights (CFR) must be interpreted as not precluding national law from allowing the national competition authority to seize (among other information) employees’ emails related to the investigation without prior judicial authorisation. However, there must be a strict legal framework for the authority’s powers, with adequate and effective safeguards against abuse and arbitrariness. The Court requested the AG to issue a supplementary opinion following the judgement in Landeck (C-548/21), in which the CJEU assessed the Law Enforcement Directive in relation with Articles 7, 8 and 52(1) CFR. The AG was asked to provide his opinion on how Article 8 CFR applies, in particular when the records and emails contain personal data. Advocate General Opinion The AG first noted that Article 8 CFR is closely related to Article 7 CFR, and the two rights may be difficult to distinguish clearly. The AG also noted that the seizure of emails by a national competition authority limits the right to data protection under Article 8 CFR if said emails contain personal data under Article 4(1) GDPR. Article 8 CFR, however, is not absolute, and may be limited in accordance with Article 52(1) CFR. For example, the national competition authority may process personal data in the emails under Article 6(1)(e) GDPR in conjunction with Article 6(3) GDPR; since the seizure was permitted under national law, the AG concluded that the processing meets the first requirement of Article 52(1) CFR (provided by law). The AG then noted that the competition authority did not collect an unlimited amount of data during its investigations, meaning the essence of Article 8 CFR was not affected. According to the AG, the seizure of emails was the least restrictive way of pursuing the objective of identifying anticompetitive practices. This case is different to that of Landeck, as it did not involve full access to individuals' mobile phone data. In principle, the emails exchanged between employees is of business nature, and therefore the processing is proportionate. Finally, the AG stated that the national competition authority did not need prior judicial authorisation to seize the emails under Article 8 CFR, as he stated in his opinion regarding Article 7 CFR. The AG reached a similar conclusion to his first opinion; Article 8 CFR must be interpreted as not precluding national law from allowing the national competition authority to seize (among other information) employees’ emails related to the investigation without prior judicial authorisation. However, there must be a strict legal framework for the authority’s powers, with adequate and effective safeguards against abuse and arbitrariness. Holding Regarding the first question and following the AG opinion, the CJEU held that Article 7 CFR must be interpreted to mean that the concept "communications", within the meaning of that article, includes business-related emails exchanged between employees and managers of an enterprise via the enterprise's email system. An email may be qualified as "work-related" does not deprive it of the protection that

Entities