Can the police look into your phone?

For many, the smartphone has become an extension of ourselves. Our devices contain not only contact information and messages, but also photos, location data, banking information, browser history and login credentials for numerous services. As such, they are a digital window into our private lives. This evolution poses new challenges for criminal law: when are police allowed to search a smartphone during a criminal investigation, and what safeguards should the law provide? The Court of Justice judgment No. C-548/21 of October 4, 2024 (the so-called "smartphone ruling") brings sweeping changes to this.

The Belgian situation before the smartphone ruling

For a long time, Belgium maintained a lenient regime for searching smartphones. According to article 39bis of the Code of Criminal Procedure allowed any judicial police officer to search a seized smartphone without a court order, provided the device was not secured. The Constitutional Court upheld this practice in a judgment of December 6, 2018 (judgment 174/2018), in which it ruled:

"The search in the data stored in the memory of the seized device is an accessorium of the seizure itself, as is the perusal, by the officer of judicial police, of the contents of the seized books, notebooks or documents on physical medium."

In other words, the police were allowed to search a smartphone just as they were allowed to read a confiscated notebook. Only when the security needed to be lifted or the search was extended to applications, mailboxes and the like, a court order was required.

This approach was in stark contrast to the United States, where as early as 2014 the Supreme Court in the case Riley v. California ruled that searching a smartphone requires a "warrant" (judicial authorization) because a smartphone may contain much more privacy-sensitive data than a traditional briefcase.

The trigger for the smartphone ruling

The case that gave rise to the smartphone arrest began on Feb. 21, 2021, when Austrian police discovered 85 grams of cannabis in a package intended for a certain C.G. After a search of his home, his smartphone was seized. When C.G. refused to provide the access code, the police tried several times to unlock the device, without permission from a magistrate or judge, and without documenting these attempts in the criminal file.

Although the attempts failed and the device was later returned, C.G. challenged the legality of these actions before the Tyrol Administrative Court. During these proceedings, C.G. learned that the police had attempted to access his data. This led to preliminary questions to the Court of Justice about the compatibility of this practice with EU law, in particular Articles 7 and 8 of the Charter of Fundamental Rights (right to protection of private life and personal data).

The judgment of the Court of Justice: the main principles

In its ruling of Oct. 4, 2024, the Court of Justice developed several key principles that will henceforth govern searches of smartphones:

1. The concept of 'data processing' interpreted broadly

The Court held that even a mere attempt to access a smartphone constitutes processing of personal data within the meaning of Directive 2016/680 (the Police and Justice Data Protection Directive). Article 3.2 of this directive defines processing as any operation involving personal data, including retrieval and consultation. Once police officers seize and manipulate a phone to retrieve personal data, data processing occurs - regardless of whether they actually access that data.

2. Smartphones contain a lot of (sensitive) personal data

The Court emphasized that a smartphone may contain much more privacy-sensitive data than traditional documents. Depending on the content and operational choices of the police, access to a smartphone can lead to access to traffic and location data, photos, browsing history and communications. This could allow very precise inferences about a person's private life, such as daily habits, whereabouts, activities, social relationships and even possibly data from which a person's origins, political, religious or philosophical beliefs can be inferred.

3. Prior judicial authorization required

The key message of the ruling is that when accessing the data on a smartphone poses a risk of a serious interference with the right to data protection, a prior check by a court or independent administrative authority is required. That review must be done before any attempts are made to access the data.

In doing so, the Court joins the case law of the European Court of Human Rights (ECtHR), which previously ruled, "The Court considers it necessary to reiterate that a search of the contents of a mobile telephone [...] cannot be in compliance with Article 8 of the Convention if it is left to an investigator's unfettered discretion; Article 8 requires the issuance of a warrant by an independent body when interference with the privacy of a person is at stake."

4. Exceptions possible in cases of urgency

The Court recognizes that in cases of high urgency, monitoring may occur later. This could apply, for example, where there is a risk that volatile data would disappear, the device is turned off or left on standby for too long, or there is a risk of remote data manipulation.

5. No limitation to serious crime

One striking aspect is that the Court did not rule that smartphone searches should be limited to serious crime. This is in contrast to its earlier case law on data retention, in which the Court ruled that the retention and use of traffic and location data is only justified in the fight against serious crime. It is up to the national legislature to determine for which (categories of) crimes a smartphone can be read during a criminal investigation.

6. Duty to inform

The principle of transparency requires that the data subject be informed of the search of his smartphone. According to the Court, the data subject must be informed of the grounds on which the consent to the reading of a smartphone is based as soon as it can no longer jeopardize the criminal investigation.

Practical implications for Belgium

The smartphone ruling is forcing Belgium to adjust its legislation. The current practice where police forces can search smartphones without judicial authorization is no longer tenable. Pending legislative changes, the Board of Procurators General has already issued circular COL 19/2024.

What does this mean for police departments?

1. Judicial authorization needed: Searches of smartphones that may constitute a serious interference with the right to data protection will now require judicial authorization. In practice, this can be requested from the investigating judge via mini-instruction.
2. High urgency cases: In cases of high urgency, police departments can take "strictly necessary actions" to avoid certain risks (such as loss of data). They can confiscate the device and even make a forensic copy before seeking judicial authorization. The reasons should be clearly stated in the report.
3. Consent remains possible: Searches following the data subject's consent remain possible, provided such consent is given in advance, deliberately and in writing using a standard form. Importantly, however, all other material conditions (in particular absolute necessity) must still be met.

What does this mean for suspects

1. Stronger procedural safeguards: The requirement of judicial authorization provides an important procedural safeguard against arbitrary searches of smartphones.
2. Possible exclusion of evidence: When smartphones are searched without the required judicial authorization, lawyers can argue that the evidence obtained should be excluded based on the Antigone criteria, particularly when the violation is intentional or inexcusable.
3. Right to information: Suspects now have the right to be informed of searches of their smartphones as soon as it no longer compromises the investigation.