Judgment of the Court of Justice Full Court, 30 April 2024, La Quadrature du Net and Others Personal data and action to combat counterfeiting, C-470/21

• Date: 30 April 2024
• Year: 2024

34

Judgment of the Court of Justice (Full Court), 30 April 2024, La Quadrature du Net and

Others (Personal data and action to combat counterfeiting), C-470/21

Link to the full text of the judgment

Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the

electronic communications sector – Directive 2002/58/EC – Confidentiality of electronic communications –

Protection – Article 5 and Article 15(1) – Charter of Fundamental Rights of the European Union – Articles 7,

8 and 11 and Article 52(1) – National legislation aimed at combating, through action by a public authority,

counterfeiting offences committed on the internet – ‘Graduated response’ procedure – Upstream

collection by rightholder organisations of IP addresses used for activities infringing copyright or related

rights – Downstream access by the public authority responsible for the protection of copyright and

related rights to data relating to the civil identity associated with those IP addresses retained by providers

of electronic communications services – Automated processing – Requirement of prior review by a court

or an independent administrative body – Substantive and procedural conditions – Safeguards against the

risks of abuse and against any unlawful access to or use of those data

In recent years, the Court of Justice has been called upon, on several occasions, to rule on the

retention of and access to personal data in the field of electronic communications and has

consequently established an extensive body of case-law in this area.

75

Ruling on a preliminary ruling

from the Conseil d’État (Council of State, France), the Court, sitting as the full Court, develops that

case-law by providing clarifications concerning (i) the conditions under which the general retention of

IP addresses by providers of electronic communications services cannot be regarded as entailing a

serious interference with the rights to respect for private life, to the protection of personal data and

to freedom of expression guaranteed by the Charter

76

and (ii) the possibility, for a public authority, to

access certain personal data retained in accordance with those conditions, in the context of

combating infringements of intellectual property rights committed online.

In the present case, four associations submitted a request to the Premier ministre (Prime Minister,

France) seeking the repeal of the decree relating to the automated processing of personal data.

77

As

that request was not acted upon, those associations brought an action before the Conseil d’État

(Council of State) seeking the annulment of that implicit rejection decision. In their view, that decree

and the provisions which constitute its legal basis

78

infringe EU law.

Under French law, the Haute Autorité pour la diffusion des œuvres et la protection des droits sur

internet (High Authority for the dissemination of works and the protection of rights on the internet)

(‘Hadopi’) is authorised – in order to be able to identify those responsible for infringements of

75

See, inter alia, judgments of 21 December 2016, Tele2 Sverige et Watson and Others (C-203/15 and C-698/15, EU:C:2016:970); of 2 October

2018, Ministerio Fiscal (C-207/16, EU:C:2018:788); of 6 October 2020, La Quadrature du Net and Others (C-511/18, C-512/18 and C-520/18,

EU:C:2020:791); of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications) (C-746/18,

EU:C:2021:152); of 17 June 2021, M.I.C.M. (C-597/19, EU:C:2021:492); and of 5 April 2022, Commissioner of An Garda Síochána and Others

(C-140/20, EU:C:2022:258).

76

Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

77

Décret no 2010-236, du 5 mars 2010, relatif au traitement automatisé de données à caractère personnel autorisé par l’article L. 331-29 du

code de la propriété intellectuelle dénommé « Système de gestion des mesures pour la protection des œuvres sur internet » (Decree

No 2010-236 of 5 March 2010 on the automated personal data processing system authorised by Article L. 331-29 of the code de la propriété

intellectuelle (Intellectual Property Code), known as the ‘System for the management of measures for the protection of works on the

internet’ (JORF No 56 of 7 March 2010, text No 19), as amended by décret no 2017-924, du 6 mai 2017, relatif à la gestion des droits d’auteur

et des droits voisins par un organisme de gestion de droits et modifiant le code de la propriété intellectuelle (Decree No 2017-924 of 6 May

2017 on the management of copyright and related rights by a rights management organisation and amending the Intellectual Property

Code) (JORF No 109 of 10 May 2017, text No 176).

78

In particular, the third to fifth paragraphs of Article L. 331-21 of the Intellectual Property Code.