Mutual recognition, Retrospective Proportionality and the Expansion of the Two-Step Test: Case C-583/24 [Tagu] Criminal proceedings against DZ

 

Dr. Ermioni Xanthopoulou, Reader/Associate Professor in Law, Brunel University of London

Photo credit: Donald Trung Quoc Don (Chữ Hán: 徵國單) - Wikimedia Commons

Introduction

On 3 November 2026, the Grand Chamber of the Court of Justice of the European Union (CJEU) gave its ruling in Tagu (C-583/24). The ruling was in response to a preliminary reference question lodged by the District Court of Amsterdam seeking clarification on whether judicial authorities executing a European arrest warrant (EAW) may refuse surrender because the sentence to be served is deemed disproportionate to the offence, contrary to Article 49(3) of the EU Charter of Fundamental Rights (Charter). The Court ruled that the alleged disproportionality of the sentence alone cannot allow the refusal of the EAW’s execution unless the penalty is so excessive that this could be in breach of Article 49(3) of the Charter and the two-step test, well-established by previous case law, is satisfied.

The blog examines the case in Tagu and reflects on whether the Court has found the right balance between cooperation interests, criminal justice imperatives and the limit posed by the protection of fundamental rights. It is argued that while this development further expands the exceptions to mutual trust within the EAW framework, it also highlights the difficulty of meeting the two-stage test as a rigid mechanism for addressing concerns over the protection of fundamental rights. As a result, the balance remains tilted in favour of mutual trust and, in this case, respect for national criminal policy, while inviting for a rigorous engagement with alleged rights violations.

Facts of the main proceedings and the questions referred for a preliminary ruling

The case concerns the execution of an EAW issued to enforce a final seven-year prison sentence imposed by the Constanța Court of Appeal on 20 December 2023. DZ was subsequently convicted for importing into Romania three grams of cannabis and four MDMA tablets together with his wife. According to the findings of the Amsterdam court, the drugs had been imported solely for personal consumption. The court also found no evidence that DZ intended to engage in the sale or distribution of the substances. Notably, Romanian law treats these acts as a single criminal offence, namely the importation of risk and high-risk drugs into the country.

The key issue before the Court was whether an executing judicial authority may refuse to execute an EAW issued for the enforcement of a custodial sentence where surrender would expose the requested person to a risk of receiving a penalty that contravenes the principle of proportionality enshrined in Article 49(3) of the Charter. More specifically, the Court was asked to clarify whether, and under what conditions, concerns regarding the proportionality of the sentence imposed in the issuing Member State may justify a departure from the principle of mutual recognition that underpins the EAW system.

Specifically, the preliminary reference concerned the interpretation of Article 1(3) of the Framework Decision on the European Arrest Warrant, read together with Article 49(3) of the Charter and the relevant provisions of Framework Decision 2004/757 on harmonising the minimum provisions on the constituent elements of acts and penalties in the field of illicit drug trafficking. More broadly, the Court was asked to clarify the relationship between the principle of mutual recognition in criminal matters and the Charter guarantee that penalties must not be disproportionate to the criminal offence.

Against that background, the Court was required to determine whether, and under what conditions, an executing judicial authority may refuse to surrender a requested person where it considers that the custodial sentence imposed in the issuing Member State is disproportionate and that the execution of the EAW would therefore infringe the principle of proportionality of penalties protected by Article 49(3) of the Charter. More specifically, the Court was asked to clarify whether such a refusal is subject to the two-stage test developed in its case law and, if so, to define the precise scope and content of each stage of that assessment.

Opinion

In his Opinion, issued on 22 January 2026, Advocate General Richard de la Tour (AG de la Tour) reaffirmed that mutual recognition of judicial decisions constitutes a cornerstone of the EAW system and that the determination of criminal penalties falls, in principle, within the competence of the issuing Member State. However, he stressed that surrender cannot be regarded as automatic where fundamental rights concerns arise. In his view, the executing judicial authority may refuse surrender where it possesses objective, reliable, specific and up-to-date evidence demonstrating the existence of systemic or generalised deficiencies in the issuing Member State's compliance with the principle of proportionality of penalties. Such deficiencies must be of a nature that prevents national courts from adequately individualising sentences for certain categories of offences. In addition, the executing authority must establish, in addition to the generic assessment of the first step concerning the finding of systemic deficiencies, that the requested person faces a real risk of being subjected to a manifestly and exceptionally disproportionate punishment. All in all, the refusal requires a two-stage assessment, combining evidence of systemic deficiencies with an individualised evaluation of the circumstances of the case.

Ruling

The Court held that the mere fact that a sentence imposed in one Member State would be regarded as unusually severe in another does not justify refusing surrender under an EAW. Rather, the case must be examined through the lens of the Court's established two-step test, which governs when fundamental rights concerns may limit mutual recognition. The first stage requires the executing judicial authority to establish whether there are systemic or generalised deficiencies in the issuing Member State's compliance with the principle of proportionality of penalties, amounting to a manifest and serious breach of Article 49(3) of the Charter and not capable of being effectively challenged through available remedies. According to the Court, the first-stage threshold is met where either the applicable sentencing regime permits inhuman or degrading punishment, or where it prevents courts from tailoring penalties to the gravity of the offence and the individual circumstances of the offender. Only where such systemic deficiencies have been established must the executing judicial authority proceed to the second stage of the assessment. The second stage requires the executing judicial authority to assess whether, in the specific circumstances of the case, the requested person faces a real risk of being subjected to a disproportionate penalty if surrendered.

Applying the two-stage test, the Court concluded that Romanian law did not disclose the systemic deficiencies required at the first stage. Judges retained discretion to individualise sentences within the statutory range, account for mitigating circumstances, reduce penalties following an admission of guilt, and distinguish between high-risk and other drugs. As a result, the sentencing framework could not be regarded as manifestly incompatible with the principle of proportionality of penalties. The Court also added that effective judicial remedies were available in the present case, as DZ had challenged his sentence both on appeal and through a subsequent point-of-law procedure. As the first-stage threshold was therefore not met, there was no need to conduct the second-stage individual assessment.

Comment:

The Court has historically been careful at allowing for derogations from mutual recognition of EAWs, favouring their execution in the interest of criminal justice, cooperation among judicial authorities and as an expression of respect to the issuing state’s criminal policy. I believe that the court has overall succeeded in striking the right balance between the protection of fundamental rights and the interests of criminal justice cooperation in this case. The ruling is careful at both  

1) asserting respect for mutual recognition of judgments and national criminal policies by ruling that disproportionality alone cannot justify refusal and

1) allowing for the check of proportionality of a sentence when it is so excessive that it may amount to inhumane or degrading punishment while fitting the exception in the two-step test, in line with well-established case law.

Allowing for a proportionality review to be performed by executing authorities, whenever penalties imposed by the courts of the issuing state are deemed harsh by the standards of the executing state, would put national criminal policies under scrutiny negating mutual trust. Proportionality is already at the heart of the EAW’s operation in express and implied ways, providing for a carefully balanced equilibrium. While issuing authorities are expected to conduct a proportionality assessment when issuing a warrant, executing authorities are not allowed to do so because they are expected to trust their counterparts. Crucially, in the absence of complete harmonisation of criminal law, executing authorities are expected to respect the domestic legislation at the issuing state as an expression of national policy on criminal law which is a policy field associated with statehood and expressing societal choices. This is also in line with ECtHR case law concerning Article 3 ECHR. The European Court of Human Rights accepts that a grossly disproportionate sentence can amount to inhuman or degrading punishment, but only on ‘rare and unique occasions’ (Harkins and Edwards v UK, 2012, §133, and restated in Sanchez-Sanchez v UK [GC], 2022, §80). In extradition cases, due regard must be had to the fact that sentencing practice legitimately varies between States (Harkins, §134).

Nevertheless, manifest disproportionality must not be ignored. The limit to mutual trust, is the protection of fundamental rights, which explains why the Court generally allows for carefully controlled exceptions, organised around the two-step test originally (Joined Cases C-404/15 and C-659/15 PPU, Pal Aranyosi and Robert Caldararu; Case C-216/18 PPU, Minister for Justice and Equality v. LM). Systemic deficiencies to criminal laws or judicial practices amounting to inhumane or degrading excessive punishment without an effective remedy that could affect the individual in question appears overall as not only a fair exception to mutual recognition but also owned to the EU value of protecting rights.

The two-step test is also a clever construct to assert the significance of mutual recognition. More specifically, the possibility of meeting the threshold of it is actually thin. Proving systemic deficiencies on the first level and then their concrete effect on the requested person is challenging. Differences in penalties themselves are not sufficient, according to the Court, to justify the existence of systemic deficiencies. These need to be linked to broader legislation or judicial practice that amounts to inhumane or degrading punishment, without the chance of effective judicial remedy. The Court found this is not the case here and I agree with this assessment with respect to Romanian law. The sentenced person has the right to appeal, and the Romanian law allows for the individualisation of the sentence which might lead to the reduction of it.

While the exception to mutual trust cannot – and should not - be used simply to challenge national choices of sentencing it may – and must - be used to target deeper injustices stemming from draconian laws or pathologies in judicial practices revealing breaches of the essence of some rights. While I am not convinced that this is the case here, I disagree with the outcomes in previous rulings in relation the protection of fundamental rights in certain cases where systemic breaches of judicial independence was ascertained. More profoundly, my disagreement, analysed here, concerns the very structure of the test that requires both a systemic and a specific assessment where the verification of either step alone is not sufficient. This choice is structurally problematic and is likely not aligned with the ECtHR individualised assessment. While I agree that mutual trust and mutual recognition are undoubtedly worth protecting, they simply cannot exist without an effective protection of fundamental rights. Without the latter, trust fails to exist.

 

Love wins in the CJEU: Same Sex Marriages and EU free movement law

Professor Steve Peers, Law School, University of Essex

Today’s CJEU judgment in Coman was the Court’s first ruling on same-sex marriages for the purposes of EU free movement law.  (For a discussion of the background, see the earlier blog post by Alina Tryfonidou). Mr Coman, a Romanian citizen, had married his husband, a US citizen, in Belgium while residing there. He tried to return to Romania with his husband, but Romania refused residence to the latter, as (like about half of the EU Member States) it does not recognise same-sex marriage. But did EU free movement law give Mr Coman the right to family reunion with his spouse nonetheless?

In the Court’s view, which took a subtly different approach than the Advocate-General’s opinion, the answer was yes. First of all, following established case law, the Court ruled that EU free movement law doesn't apply directly to a Romanian citizen in Romania and his family member, since the EU citizens’ Directive only applies to EU citizens living in another Member State. However, that law applies by analogy, since Mr Coman had moved to another EU Member State and then returned to his Member State of nationality.

In particular, the Court invoked its 2014 ruling in O and B (discussed here), which clarified when family reunion rights applied in this scenario. It’s necessary to have “genuine residence” in another Member State, meeting the conditions for residence longer than three months set out in the citizens’ Directive (see paras 26 and 28 of today’s judgment).

But was Mr Coman’s American husband within the scope of the definition of “family member”, which includes a “spouse” (a term not further defined in the citizens’ Directive)? The Court reaffirmed its prior case law that a “spouse” was “a person joined to another person by the bonds of marriage”. Crucially, it then ruled that “the term ‘spouse’ within the meaning of” the Directive “is gender-neutral and may therefore cover the same-sex spouse of the Union citizen concerned.” While the Directive expressly permits host Member States to apply their own law when admitting registered partners, it makes no such provision regarding spouses, so such a possibility was implicitly ruled out.

The Advocate-General’s opinion made the same point in a different way, arguing  for a uniform EU-wide meaning of the word “spouse” and taking account of the trend inside and outside the EU toward recognition of same-sex marriage. On one issue, however, the judgment and the opinion differ: the opinion refers to recognition of a marriage wherever it was celebrated (para 49, referring to prior CJEU case law), while the judgment refers several times to a marriage concluded in a Member State (paras 33, 35 and 36).

Anticipating the objections from Member States that do not permit same-sex marriage, the Court reiterated that marital status “is a matter that falls within the competence of the Member States and EU law does not detract from that competence”. In particular, “Member States are thus free to decide whether or not to allow marriage for persons of the same sex”. But that freedom had to be exercised consistently with EU law, in particular the right to free movement. Allowing Member States to apply their own law to the residence of non-EU same sex spouses “would have the effect that the freedom of movement of Union citizens who have already made use of that freedom would vary from one Member State to another, depending on whether such provisions of national law exist”.

Next, the Court dealt with the objections of those Member States who had argued that there were “public policy” or “national identity” grounds to refuse admission of same-sex spouses, where they did not recognise the existence of such a concept in national law. On this point, the Court repeated its case law that the “public policy” exception to free movement has to be interpreted strictly, applying “only if there is a genuine and sufficiently serious threat to a fundamental interest of society”. That high threshold was not met here, because recognition of a marriage for these limited purposes “does not undermine the institution of marriage in the first Member State, which is defined by national law”, and “does not require that Member State to provide, in its national law, for the institution of marriage between persons of the same sex”. Rather, it is “confined to the obligation to recognise such marriages, concluded in another Member State in accordance with the law of that state, for the sole purpose of enabling such persons to exercise the rights they enjoy under EU law”. For the same reasons, such an obligation “does not undermine the national identity” of Member States.

The Court added that any measure restricting free movement rights also has to comply with human rights guaranteed by the EU Charter of Rights, which has to be interpreted consistently with the European Convention on Human Rights. According to the case law of the European Court of Human Rights, “the relationship of a homosexual couple may fall within the notion of ‘private life’ and that of ‘family life’ in the same way as the relationship of a heterosexual couple in the same situation.”

In light of its judgment on the meaning of “spouse”, the Court had no need to define what a “partner” was, for the purpose of interpreting either the core definition of “family member” or the “extended family member” rules in Article 3 of the Directive. The Advocate-General’s opinion had argued for a Plan B: if Mr Coman’s husband was not a "spouse" due to Romanian law, he had to be considered a partner or other family member under Article 3. In principle there was a downside to that approach, since the CJEU has ruled that there is no right of admission for extended family members (see the judgment in Rahman; also the pending case of Banger, on whether returnees can invoke Article 3 by analogy as regards their extended family members). However, the opinion argued that due to the marital bond recognised by another Member State, there would be no discretion to refuse admission in this case.

Comments

This judgment falls short of the general requirement to establish same-sex marriage recognised in the US Supreme Court judgment in Obergefell. Inevitably so: the CJEU lacks the jurisdiction to rule on the marriage laws of Member States as such. The ruling only applies to free movement issues – and with some further limitations. Nevertheless it will likely be celebrated (or decried) as part of a more general development of extending same-sex marriage rights across (and outside) the EU.

In order to trigger the application of EU free movement law as regards a same sex marriage, there needs to be movement between Member States. So movement within the UK, from jurisdictions in Great Britain (where same sex marriage is recognised) to Northern Ireland (where it is not) will not count. (In any event, in light of Brexit, anyone anxious to have their same sex marriage recognised in Northern Ireland will have to meet the relevant conditions before the end of the post-Brexit transition period: see discussion here). Moreover, the judgment concerns residence, rather than marriage as such. The residence status of a same sex spouse of an EU citizen who is also an EU citizen is unlikely to be disputed.

Furthermore, the Court (unlike the Advocate-General) laid down two further limitations. It restricted its ruling to marriages concluded within a Member State. At best, it could be argued that the legal position where a same sex marriage was celebrated outside the EU was left open by the Court. Secondly, it made a point of emphasising that a period of at least three months genuinely residing in another Member State was necessary to trigger the rules: couples seeking to overcome the restrictions of their national law will have to spend some time abroad in order to do so. A gay Gretna Green – or a lesbian Las Vegas – will have to offer flats to rent, not just rooms for the night.

With these restrictions, and the Court’s obvious concern to answer the anticipated objections of some Member States (and their courts), the ruling may seem rather grudging to those supporting equal marriage. But such a conclusion would be jumping the gun.  Those who have a same-sex registered partnership, or an unregistered partnership within the scope of Article 3 of the Directive, will be able to invoke the judgment’s strong emphasis on free movement and human rights in support of their claims.  The Court could have chosen the easier option offered by the Advocate-General as Plan B – giving same-sex spouses a right to stay on the basis of Article 3, without defining them as a spouse – but it did not.  There’s a case to be made for reassuring – and eventually persuading – the opponents of equal marriage, rather than lecturing and overruling them.

And there’s a broader perspective too, quite apart from the legal technicalities. In light of the history of pink triangles and Stonewall riots, of chemical castration and teenage suicides, of hatred, bigotry and persecution, the right to move across the European Union with a marriage recognised as an equal affirmation of family life can only be welcomed.

Barnard & Peers: chapter 13, chapter 9

Photo credit: UK Student Life

Is Workplace Privacy Dead? Comments on the Barbulescu judgment

Steve Peers

When can an employer read an employee’s e-mails or texts, or track her use of the Internet? It’s an important question for both employers and employees. A judgment this week in Barbulescu v Romania addressed the issue, but unfortunately has been greeted by press headlines such as ‘EU court allows employers to read all employee e-mails’. This is wrong on two counts: it’s not a judgment of an EU court, but of the separate European Court of Human Rights; and the ruling does not allow employers to read all employee e-mails without limitation.

So what exactly did the judgment decide? And would the ruling have been any different if an EU court had decided it?

Background

The European Court of Human Rights (ECtHR) has jurisdiction only to interpret the European Convention on Human Rights (ECHR) and its protocols. The Barbulescu case concerns the right to privacy under Article 8 ECHR, which can be limited on certain grounds according to Article 8(2). It follows on from, and further develops, previous rulings on similar issues.

In Halford v UK, a well-known case concerning a policewoman suing her local force for sex discrimination, the ECtHR ruled that Article 8 was breached when the police force intercepted calls from a separate work telephone which they had provided for her to contact her lawyers. The key points of the judgment were that Article 8 can apply to workplaces, depending on whether there was a ‘reasonable expectation of privacy’. Ms. Halford had such an expectation since the police force had made a particular point of providing her with a separate telephone and assuring her that she could use it to discuss the litigation privately.

Obviously, situations like that are rare. It’s far more common that an employee might use a computer or phone provided by the employer in the ordinary course of work in order to have some private communication. Yet Article 8 can also protect employees in those cases too. In Copland v UK, the ECtHR ruled that Article 8 was breached when an employee’s phone calls, e-mails and Internet use from work were monitored by her boss. The crucial point was that there was ‘no warning that her calls [or e-mail or Internet use] would be liable to monitoring’.

The new judgment

How is Barbulescu different from Copland? The answer is that the facts are quite different. In the newer case, the employer had an absolute ban on employee’s use of work equipment for private reasons. Barbulescu’s boss suspected that he was not complying with this policy, and informed him of its suspicions, on the basis of monitoring his account. The employee denied non-compliance, so the employer presented him with a transcript of his Yahoo Messenger communications, which included personal communications. He sued his employer in the Romanian courts and lost, so he brought his compliant to the ECtHR.

The Court ruled that the complaint was admissible, but the majority rejected his Article 8 claim on the merits. While Article 8 was applicable, his employer was simply trying to enforce its absolute ban on private use of work equipment, and he had breached his employment contract. The employer had only accessed the account to check whether he was using it just for professional purposes, given that he had claimed that he did not use it for private reasons. The use of the transcript of his communications was limited, since the identity of the other parties to the communication was not disclosed. Other documents stored on his computer were not checked, and he did not have a convincing reason for using work equipment for private purposes.

One dissenting judge argued in detail that the majority was quite wrong on the merits, arguing for more stringent control of employers’ monitoring of employees’ private Internet use (primarily by means of detailed notification requirements). It should be noted that Mr. Barbulescu can still ask the Grand Chamber of the ECtHR to review this judgment, since it was issued by a Chamber of judges.

Impact

The Court is clearly not overturning its prior case law: it distinguishes Halford and Copland, rather than reversing them. So Barbulescu definitely does not give employers carte blanche to put their employees under surveillance. There remain – as there were before this judgment – cases where such surveillance is justified, and cases where it is not. The importance of Barbulescu is some clarification on where the dividing line falls between those two categories.

Legally speaking, that line is determined by the degree of ‘reasonable expectation of privacy’ that employees have at the workplace. They have such an expectation where the employer has expressly allowed them to use a phone or computer for private purposes (Halford), or where it was tolerated (Copland). In this case, the crucial difference is that the employer banned such use.

Moreover, the Court also mentions other specific factors, as listed above: access to the communications followed a denial by the employee; use of the transcript of the communications was limited; other documents stored on the computer were not checked; and there was no convincing reason for using work equipment for private purposes. The Court also emphasised the fact that the employee brought an employment law claim, rather than a criminal law or data protection law claim. Arguably, all of these factors are relevant and must be considered in addition to the employer’s ban on private use of work equipment.

In any event, the ruling is questionable authority, for two reasons. First of all, it’s possible that the Grand Chamber of the ECtHR will review it and overturn it. This would be richly deserved because – with the greatest respect – it’s a very poorly reasoned judgment. Secondly, it’s arguable that EU law sets higher standards. Let’s examine these two points in turn.

Comments

What are the flaws in reasoning? First of all, the majority in Barbulescu purport to distinguish the prior judgment in Copland, but in fact they contradict that previous ruling. They describe it as a case where employee use of the employer’s Internet was ‘tolerated’. That’s true, but it’s not all. As can be seen from the quote above, the crucial point of that judgment was that the employee was not told about the employer’s surveillance. That’s a crucial distinction because it’s not clear whether the employee knew about the surveillance in this case (the point was disputed between the parties, and the ECtHR decided not to address it). Of course, the point has much broader relevance: there may be many other employers in Europe which have a blanket ban on employee use of the Internet, but which have not informed their employees about surveillance. Is that failure to inform crucial (Copland), or (apparently) not (Barbulescu)? Or is it only crucial where the private use of employer equipment is not banned?

Secondly, there are internal contradictions in the reasoning. The Court places great stress on the fact that the employer only subjected the employee to surveillance when he claimed that his use of the messaging service was for work reasons only. So it had no reason to expect to find personal data in those messages, when it checked them to see if he was lying (para 57). That sounds reasonable. But in the presentation of the facts (at para 7), the accusation that the employee was using work equipment for personal reasons was based on placing him under surveillance. In other words, he was put under surveillance first. This isn’t a minor quibble, because it raises an important question of whether employers which impose a general ban on the private use of work equipment have a general prerogative to place their employees under surveillance, or whether there must be some specific reason (such as the employee’s denial of an accusation to that effect) to do so.

The Court also asserts that the identities of other people were not disclosed in the transcripts of private messages. But the judgment refers to the applicant’s brother and fiancée. Anyone who knows him knows who they are. Indeed, if Barbulescu has a social media presence, I could probably find out who they are myself – with a bit of help from Google Translate. (I haven’t actually tried this).

Finally, the Court accepts that the Article 8 right to privacy is affected, but (as the dissenting judge points out) it doesn’t properly apply Article 8(2). This means that the Court doesn’t identify what interests justify the breach of the right to privacy, whether the breach was in accordance with the law, or whether it was proportionate and necessary. While the employer interest in enforcing its policy on work equipment should fall within the scope of ‘the rights and freedoms of others’ as a justification, it’s far from clear that the employer’s actions were clear and foreseeable (part of the ‘in accordance with the law’ test) or proportionate.

EU law

As noted at the outset, the judgment was issued by the European Court of Human Rights, not an ‘EU court’. (I’ll be sending every journalist who got this wrong a batch of pork pies specially seasoned by David Cameron). But there is a substantive EU law element here, as briefly noted by the ECtHR. Data protection law is one of the two main areas where EU law and human rights law frequently overlap (the other area is asylum law).

There are several reasons to distinguish between EU law and the ECHR.  First of all, EU law applies to 28 states, while the ECHR applies to 47. This distinction is blurred a little in data protection law, since some non-EU states (Schengen associates) have agreed to apply EU data protection law; that law also applies to some companies based outside the EU (Google Spain); and non-EU countries are judged by the EU on whether their law is ‘adequate’ from the EU’s perspective, meaning it has to be quite similar to EU law (Schrems).

Secondly, the procedure and remedies are different. EU law is usually developed by means of a national court pausing its proceedings, asking the CJEU some questions and then reopening the case at national level and applying the answers it gets. It can then apply the remedies available in national law, which can sometimes be affected by EU law too (see Vidal-Hall and Benkharbouche). In this case, the Romanian courts noted the EU law points, but decided against the applicants on the merits without asking the CJEU questions. Arguably the final national court should have sent questions to the CJEU, and its failure to do so is itself an ECHR breach (see Daniel Sarmiento’s discussion here), but Mr. Barbulescu didn’t raise that point. If he had won in the ECHR, the only remedies he could get would be a declaration, costs and damages.

EU law can also be applied against private parties, subject to the limited ability to apply it in the case of Directives. That limitation will soon disappear when the upcoming data protection Regulation comes into force. The ECHR cannot apply to private parties as such, which is why this case had to be brought against the Romanian state, not Barbulescu’s employer, although the ECtHR swept aside that distinction by referring to the doctrine of positive obligations (ie the State must ensure that human rights are protected in private relationships).

The biggest issue is whether substantive EU law would give greater protection. While the ECtHR noted that this case involved Mr. Barbulescu’s ‘personal data’ within the meaning of EU law, it did not examine the EU legislation (the current data protection Directive) further. The dissenting judge did so, taking into account also ‘soft law’ of the EU’s ‘Article 29 working party’. This body of national data protection supervisors frequently meets to adopt detailed policy statements taking a very assertive view of how to interpret EU data protection law. Then they return home, and fail to enforce the policies they agreed to.

Under the EU Directive, can his employer justify collecting Barbulescu’s personal data? He did not consent to the collection of that data, so the employer would either have to argue that it was ‘necessary for the performance of a contract’, or for its ‘legitimate interests’. In the latter case, those interests could be outweighed by his rights. There’s no clear answer from this wording whether the CJEU would decide this case the same way, interpreting the Directive: it’s arguable (as the national courts held) that it was ‘necessary’ to monitor the employee’s communications in order to enforce the rule against private use of communications, or that the factors referred to by the ECtHR were enough to give precedence to the employer’s interests over the worker’s rights. But the overall pro-privacy tone of recent CJEU rulings on data protection (Digital Rights, Google Spain, Rynes, Schrems) suggest that the CJEU would be more likely to rule that some prior notification of surveillance was required.

Another issue is that some of the data concerned the employee’s health and sex life. EU law prohibits processing this, and other ‘sensitive’ personal data. But this prohibition is a legal fiction, as in fact a number of grounds for processing sensitive data are permitted. In practice, it’s more accurate to say that it’s harder to justify processing such data. Applying that rule to this case, the Directive states that such data can be processed if ‘necessary’ to carry out the employer’s obligations and rights ‘in the specific field of employment law’, if that is ‘authorized by national law providing for adequate safeguards’. It’s hard to know if these criteria were met in this case. (These rules will not change much under the future Regulation. There will be a new clause allowing Member States to have special rules for employment issues, but there’s no specific mention of employer surveillance).

Given that Romania is bound by the EU Directive, should the ECtHR have looked further at the EU law issues? It’s an awkward point, since the ECtHR doesn’t have jurisdiction as such to rule on EU law. But interferences with the right to privacy must be ‘in accordance with the law’. So there should at least have been a cursory examination of whether the national law, and the national court’s interpretation of it, appeared to be consistent with the relevant EU law. The ECtHR avoided doing this, because (very unusually for a privacy case) it ignored the ‘in accordance with the law’ test entirely.

Conclusion

Altogether, this judgment is not the ECtHR’s finest hour. But it may not be the final word on this important issue either. It remains to be seen whether the Grand Chamber might review this case, or whether the CJEU or national courts, perhaps excited by the new Regulation, might insist that higher standards apply in national law. For the time being, though, employers should be aware that there is still a fine line between acceptable and unacceptable monitoring of their employees.

Barnard & Peers: chapter 9

Photo credit: tony_anscombe_work_privacy-618x336.jpg