A.L. AND E.J. v. France (dec.)

Legal summary

October 2024

A.L. AND E.J. v. France (dec.) - 44715/20 and 47930/21

Decision 24.9.2024 [Section V]

Article 1

Jurisdiction of States

French jurisdiction in respect of remote retrieval of EncroChat user data and French authorities’ transfer of data of users located in the United Kingdom to authorities of that State pursuant to European Investigation Order

Article 34

Victim

Victim status recognised without requiring applicants to prove facts where this would amount to compelled self-incrimination: preliminary objection dismissed

Article 35

Article 35-1

Exhaustion of domestic remedies

Effective domestic remedy

British applicants having failed to avail themselves of domestic remedy in France by which effective challenge could have been brought against data transfer pursuant to European Investigation Order issued by United Kingdom and against data retrieval measure: inadmissible

Facts – The applicants are two British nationals imprisoned in the United Kingdom. They were accused of using EncroChat in criminal proceedings against them in that State. EncroChat was an encrypted mobile-phone telecommunications tool which operated as a closed network and had been covertly distributed from 2016 to 2020.

Their applications to the Court concerned the remote retrieval of EncroChat user data by the French authorities from 1 April to 2 June 2020 in the context of investigations opened in France and the transfer of the data pertaining to individuals who used EncroChat in the United Kingdom to the UK law-enforcement authorities pursuant to a European Investigation Order (EIO) issued by that State on 11 March 2020. The applicants did not avail themselves of any remedies in the French courts.

Law – Article 8:

(a) Whether France had jurisdiction – The impugned data were retrieved by means of a remote data hack conducted in the context of investigations that had been entrusted to French investigators acting under the authority of French judges and prosecutors; the retrieval operations had been conducted from French territory and the hack had been launched from a server located there. The retrieval measure was thus attributable to France. The fact that the retrieval operation had produced part of its effects outside this territory, by enabling remote access to data from handsets located abroad, did not affect this finding.

The data pertaining to EncroChat users located in the United Kingdom had been collected by the French investigators prior to their transfer to the UK National Crime Agency, on the instructions of a French prosecutor pursuant to an EIO. It was not submitted that the retrieved data had been stored outside France. The investigators had been able to enforce the UK EIO by acting from their headquarters in France. It followed that the data had also been stored and shared from within French territory.

The retrieved data had concerned EncroChat users and had been such as to enable the identification of those users. Consequently, the fact that the EncroChat users located in the United Kingdom had been identified only after enforcement of the EIO did not render the transferred data any less personal and did not release France from its obligation to respect the data subjects’ rights.

Conclusion: France’s jurisdiction established. The Court noted, moreover, that this conclusion was consistent with the case-law of the Court of Justice of the European Union (CJEU) according to which the principle of mutual recognition of judgments and judicial decisions prohibited the authorities having issued an EIO for the transmission of such data as evidence from reviewing the lawfulness of the separate procedure by which the executing member State had gathered that evidence (M.N. (EncroChat) judgment).

(b) Victim status – EncroChat was an encrypted telecommunications tool that had not been freely distributed and had operated as a closed network: users had been able to communicate only among themselves, by means of dedicated phones and a subscription to the service. The data retrieval measure could therefore only have concerned a specific set of individuals, confined to EncroChat users, and not all users of telecommunications services or internet. In consequence, it remained to be determined whether the applicants had sufficiently shown that they had been part of the group of people targeted by the data retrieval operation.

Having been arrested in the wake of the impugned data retrieval operation, they had been accused of using EncroChat in the prosecution brought against them in the United Kingdom. Both applicants had shown that the prosecution had produced evidence obtained by means of the data retrieval operation. Admittedly, they had denied using EncroChat before the UK authorities and had not claimed to be users of that encrypted telecommunication tool before the Court. The Court noted, however, that such an allegation might weigh heavily in the assessment as to whether they were guilty or not. It found that the evidence they had produced was sufficient to confer victim status on them. Requiring them to prove that they had been EncroChat users at the relevant time would effectively amount to compelled self-incrimination and would constitute a disproportionate obstacle to the effective exercise of the right of individual application under Article 34 of the Convention.

Conclusion: preliminary objection dismissed (victim status).

(c) Exhaustion of domestic remedies – Neither the fact that the applicants lived outside France nor the fact that they had not freely chosen to come under the respondent State’s jurisdiction were such as to exempt them from their duty to exhaust the domestic remedies open to them in that State. The Court had to ascertain whether a remedy that satisfied the requirements of Article 35 § 1 of the Convention had been available to the applicants in France.

i. Existence and availability of remedy under Article 694‑41 of the Code of Criminal Procedure – Under French law, this Article provided that a legal challenge, an action for exclusion of evidence or any other type of remedy could be used against a measure taken in French territory pursuant to an EIO, provided that a remedy could have been used against that measure if it had been ordered in domestic proceedings. Where appropriate, the measure taken pursuant to an EIO could be challenged under the same conditions and in accordance with the same procedures as it might have been in a purely internal situation. The Court noted that the provisions of that Article allowed any “person concerned” to pursue the remedies that would have been open to him or her in France if the measure carried out pursuant to the EIO had been so in domestic proceedings. They therefore enabled the applicants to avail themselves of the procedural rights such a status would have conferred on them in a purely internal situation.

These provisions transposed into domestic law Article 14 of Directive 2014/41/EU of 3 April 2014 regarding the EIO in criminal matters (“the Directive”), which provided that member States were to ensure that legal remedies equivalent to those available in a similar domestic case were applicable to the investigative measures indicated in an EIO, and had to be read in the light of point 22 of the Directive. The Court noted that they seemed to be consistent with the case-law of the CJEU according to which member States were required to ensure compliance with the right to an effective remedy enshrined in the first paragraph of Article 47 of the Charter of Fundamental Rights of the European Union (EU) in the procedure for issuing and executing an EIO (Gavanozov II judgment) Where an EIO had been issued with a view to the transmission of evidence already in the possession of the authorities of the executing member State, the CJEU had held that the authorities of the issuing State were not authorised to review the lawfulness of the separate procedure by which the executing member State had gathered it (M.N. (EncroChat) judgment). Having regard to the international undertakings of the States in question, the Court attached decisive importance to the remedies available in the executing State.

ii. Scope of the remedy under Article 694-41 of the Code of Criminal Procedure – Under this statute, the applicants could have applied for the exclusion of the evidence obtained through the enforcement of the EIO of 11 March 2020 under the same conditions and in accordance with the same procedures as a person under judicial investigation in France, arguing that they were in a comparable procedural situation and that the retrieval measures in question were incompatible with the requirements of Article 8 of the Convention. An application for exclusion from evidence could thus be filed with the Investigation Division, subject to compliance with any formal requirements and time-limits provided for by domestic law. The Court observed, moreover, that this remedy did not require the applicants to incriminate themselves since domestic case-law accepted that such applications for exclusion from evidence were admissible when they were lodged by persons who were accused of using EncroChat in the proceedings against them.

Thus, the Government had convincingly demonstrated that a remedy had been available to the applicants by which to challenge the lawfulness and proportionality of the retrieval of the data and their transfer to the UK authorities for inclusion as evidence in their criminal cases. In any event, where there was a doubt about the effectiveness of a remedy, the issue should be tested before the domestic courts.

iii. Means of redress afforded by this remedy – Such a remedy, if successful, could lead to the finding of a breach of Article 8 of the Convention and to the exclusion, in France, of the evidence obtained through the enforcement of the EIO. In addition, Article D47-1-16 of the Code of Criminal Procedure provided that the issuing member State was to be informed of the existence and outcome of this remedy. Moreover, Article 14 § 7 of the Directive required the issuing State to take into account a successful challenge against the recognition or execution of an EIO in accordance with its own national law. In the Court’s view, such means of redress, which derived both from EU law and from the provisions transposing it into French law, were to be regarded as appropriate. There was nothing to suggest that this remedy, had it been used, would have been ineffective in the circumstances of the case, as the applicants’ prosecutions were still pending and the UK courts were required to take account of any potentially successful outcome.

iv. Conclusion – The Court took the view that there had been a remedy available to the applicants by which they might have effectively challenged the data transfer measure taken pursuant to the EIO issued on 11 March 2020, together with the data retrieval measure. However, they had failed to avail themselves of any remedy in the French courts and had not put forward any particular circumstance that might have exempted them from doing so. The domestic courts had thus been deprived of an opportunity for the development of their case-law on this subject, which would potentially have been beneficial to anyone else in a similar or comparable situation.

Conclusion: inadmissible (failure to exhaust domestic remedies).

In the light of the above considerations, the Court took the view that an effective remedy against the impugned data retrieval measure had been available to the applicants, such that their complaint under Articles 6 and 13 of the Convention was manifestly ill-founded.

(See also Gherghina v. Romania (dec.) [GC], 42219/07, 9 July 2015, Legal Summary; M.N. and Others v. Belgium (dec.) [GC], 3599/18, 5 May 2020, Legal Summary; H.F. and Others v. France [GC], 24384/19 and 44234/20, 14 September 2022, Legal Summary; Ukraine and the Netherlands v. Russia (dec.) [GC], 43800/14 et al., 30 November 2022, Legal Summary; Wieder and Guarnieri v. the United Kingdom, 64371/16 and 64407/16, 12 September 2023; Communauté genevoise d'action syndicale (CGAS) v. Switzerland [GC], 21881/20, 27 November 2023, Legal Summary; Gavanozov II, judgment of 11 November 2021, C-852/19, EU:C:2021:902; M.N. (EncroChat), judgment of 30 April 2024 (Grand Chamber), C-670/22, EU:C:2024:372)

© Council of Europe/European Court of Human Rights
This summary by the Registry does not bind the Court.

To access legal summaries in English or French click here.
For non-official translations into other languages click here.