Seizure and Examination of Mobile Data and Data Carriers in Austria: Where Do We Stand and What’s Next?

By: Oliver Michael Loksa (Schönherr)

If the Public Prosecutor’s Office (PPO) seeks to seize objects for evidentiary purposes, to secure civil-law claims, or to enforce property rights, the Austrian Code of Criminal Procedure (ACCP) mandates that the PPO must establish the basis for suspicion, identify the objects to be seized and their relevance, and demonstrate that the seizure is both proportionate and necessary. In other words, the PPO must justify why the evidentiary purpose would be compromised if less intrusive measures were taken. Unlike house searches or surveillance measures, a court order is not required for such seizures.

Historically, the seizure and analysis of mobile data and data carriers were treated no differently from the seizure of other physical objects, without consideration of the unique data protection and privacy implications involved.

This approach has since been reconsidered due to two pivotal rulings:

Decision by the Constitutional Court, December 2023
On 14 December 2024 (G 352/2021), the Constitutional Court of Austria issued a landmark decision on whether the provisions governing the seizure of “ordinary” objects extend to mobile data and data carriers. The Court ruled that they do not. It emphasized that accessing data carriers intrudes deeply into privacy, providing not just a snapshot of behavior but detailed insights into significant aspects of an individual’s past and present life.

The Court outlined key aspects for amending the legal framework. It stated that the PPO would need to secure an order from the court of first instance before seizing such data. The legal framework would also need to ensure that data analysis is comprehensible and limited to what is necessary for the investigation. Affected individuals should be informed adequately to safeguard their rights, and independent supervision should be established to review whether the PPO or police comply with the court order.

The Court set a deadline of 31 December 2024 for lawmakers to amend the current provisions. After this date, the existing rules on seizures of all kinds will cease to be valid.

Decision by the ECJ, October 2024
Uncertainty regarding the seizure of mobile data and data carriers was compounded by a ruling of the European Court of Justice (ECJ) on 4 October 2024 (C-548/21). This decision, based on Directive (EU) 2016/680 and the EU Charter of Fundamental Rights, confirmed that such data could be seized and analyzed regardless of the seriousness of the offense, extending these measures beyond grave offenses.

The ECJ, however, aligned with the Constitutional Court in emphasizing the need for a court order, precise legal rules defining the types of offenses involved to ensure proportionality, and the right of individuals to be informed about the purpose of data processing and the available remedies.

Unlike the Constitutional Court’s ruling, the ECJ’s decision is binding on all Member States, requiring immediate compliance with its interpretation of EU law. Failure by national courts to adhere to the ECJ’s decision risks violating EU law…

CONTINUE READING…