CJEU - C‑258/23 to C‑260/23 - Imagens Médicas Integradas

Summary

The Court of Justice of the European Union (CJEU) has ruled that business-related emails exchanged between employees and managers are considered protected communications under Article 7 CFR. This protection extends to personal data within these emails under Article 8 CFR. Consequently, national competition authorities require prior judicial authorization to seize such emails during inspections, even if the emails are professional in nature or there's an internal policy prohibiting personal use.

Full text

Help CJEU - C‑258/23 to C‑260/23 - Imagens Médicas Integradas: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:51, 27 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators228 editsTag: Visual edit← Older edit Latest revision as of 10:59, 29 July 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators228 editsTag: Visual edit Line 90: Line 90: === Holding ====== Holding === === First question === Regarding the first question, the CJEU held that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] must be interpreted as meaning that the concept of “communications” includes business-related emails exchanged between employees and managers through an enterprise’s email system. The professional nature of an email, its content, whether it has been read or deleted, or an internal prohibition on personal use do not remove it from the protection afforded by [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]. Personal data contained in or generated by such communications is also protected under Article 8 CFR.Regarding the first question, the CJEU held that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] must be interpreted as meaning that the concept of “communications” includes business-related emails exchanged between employees and managers through an enterprise’s email system. The professional nature of an email, its content, whether it has been read or deleted, or an internal prohibition on personal use do not remove it from the protection afforded by [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]. Personal data contained in or generated by such communications is also protected under Article 8 CFR. === Second and third questions === Regarding the second and third questions, the CJEU examined them together and reformulated them as asking whether [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR] preclude the seizure, without prior judicial authorisation, of employees’ and managers’ emails during an inspection carried out at an enterprise’s business premises by a national competition authority investigating potential infringements of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 101] or [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 102 TFEU].Regarding the second and third questions, the CJEU examined them together and reformulated them as asking whether [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR] preclude the seizure, without prior judicial authorisation, of employees’ and managers’ emails during an inspection carried out at an enterprise’s business premises by a national competition authority investigating potential infringements of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 101] or [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 102 TFEU]. Latest revision as of 10:59, 29 July 2026 CJEU - C‑258/23 to C‑260/23 Imagens Médicas Integradas Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(1) GDPR Article 6(1)(e) GDPR Article 6(3) GDPR Article 101 TFEUArticle 102 TFEUArticle 7 CFRArticle 8 CFRArticle 52(1) CFR Decided: 23.10.2025 Parties: Imagens Médicas Integradas SA Synlabhealth II S.A. Sociedade Gestora de Participações Sociais SA Autoridade da Concorrência Case Number/Name: C‑258/23 to C‑260/23 Imagens Médicas Integradas European Case Law Identifier: ECLI:EU:C:2025:814 Reference from: Tribunal da Concorrência, Regulação e Supervisão (Portugal) Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms The CJEU held that professional emails are protected communications under Articles 7 and 8 CFR, but may be seized by a competition authority during an investigation without prior judicial authorisation, provided that a strict legal framework and adequate safeguards against abuse and arbitrariness are in place. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 1.4 First question 1.5 Second and third questions 2 Comment 3 Further Resources English Summary Facts Imagens Médicas Integradas S.A., several companies in the SIBS group and Synlabhealth II S.A. (the controllers) are a number of companies in the medical field. Between 2021 and 2022, the national competition authority conducted several investigations under the authorisation of the Public Prosecutor’s Office. The information seized included employees’ emails and internal documents. The controllers objected to the competition authority seizing employees’ emails, and filed an appeal with the Tribunal da Concorrência, Regulação e Supervisão (Competition, Regulation and Supervision Court, Portugal). According to the controllers, the seizures were illegal, as they infringed their right to secrecy of correspondence. The competition court decided to stay proceedings and refer questions to the CJEU concerning the lawfulness of the seizure of emails of employees during investigations carried out by the competition authority. The competition court referred the following questions: Do the business records at issue in this case, which are transmitted by email, constitute “correspondence” for the purposes of Article 7 CFR? Does Article 7 CFR preclude business records arising from email communications between managers and employees of undertakings from being seized in the course of an investigation into agreements and practices prohibited under Article 101 TFEU (ex Article 81 [EC]) [or, in Case C 260/23, Article 102 TFEU (ex article 82 [EC])]? Does Article 7 CFR preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, bringing criminal prosecutions on the basis of the principle of legality and defending democratic legality in accordance with the Constitution, and which operates independently of the other central, regional and local authorities?’ In his initial opinion, the AG stated that Article 7 of the EU Charter of Fundamental Rights (CFR) must be interpreted as not precluding national law from allowing the national competition authority to seize (among other information) employees’ emails related to the investigation without prior judicial authorisation. However, there must be a strict legal framework for the authority’s powers, with adequate and effective safeguards against abuse and arbitrariness. The Court requested the AG to issue a supplementary opinion following the judgement in Landeck (C-548/21), in which the CJEU assessed the Law Enforcement Directive in relation with Articles 7, 8 and 52(1) CFR. The AG was asked to provide his opinion on how Article 8 CFR applies, in particular when the records and emails contain personal data. Advocate General Opinion The AG first noted that Article 8 CFR is closely related to Article 7 CFR, and the two rights may be difficult to distinguish clearly. The AG also noted that the seizure of emails by a national competition authority limits the right to data protection under Article 8 CFR if said emails contain personal data under Article 4(1) GDPR. Article 8 CFR, however, is not absolute, and may be limited in accordance with Article 52(1) CFR. For example, the national competition authority may process personal data in the emails under Article 6(1)(e) GDPR in conjunction with Article 6(3) GDPR; since the seizure was permitted under national law, the AG concluded that the processing meets the first requirement of Article 52(1) CFR (provided by law). The AG then noted that the competition authority did not collect an unlimited amount of data

Entities