On July 16, 2026, the Court of Justice of the European Union (“CJEU”) issued a decision clarifying that EU law does not, as a rule, prevent a national competition authority from seizing business emails stored on a company’s systems without prior authorisation from a court. However, strict legal safeguards and effective ex post judicial review must be implemented.

This blog post provides an overview of the decision.

I. Background

The case arose from investigations conducted by the Portuguese Competition Authority (the “Authority”) into alleged infringements of Portuguese and European competition law. Relying on warrants issued by the Public Prosecutor’s Office, the Authority conducted inspections at the premises of the companies concerned. The warrants authorized the Authority to search for, examine, copy and seize any documents, regardless of the medium on which they were stored, that were directly or indirectly related to the suspected practices, including business emails and internal documents concerning the companies’ commercial policies.

The companies challenged the inspections before the Portuguese courts, arguing that the Authority’s access to and seizure of business emails infringed the right to respect for communications protected by Article 7 of the Charter of Fundamental Rights of the European Union (the “Charter”).

II. The CJEU’s Judgment

The CJEU first confirmed that business emails exchanged through a company’s email system constitute “communications” within the meaning of Article 7 of the Charter, notwithstanding their exclusively professional nature. In reaching that conclusion, the CJEU relied on the case law of the European Court of Human Rights, according to which the protection of communications extends to professional correspondence and does not depend on the content of the communication, the medium used, or whether the communication is exchanged through company-owned equipment. Likewise, the fact that an employer prohibits personal use of its email system does not deprive those emails of protection.

Next, the CJEU considered whether EU law requires prior authorization from a court before a competition authority may seize business emails stored on a company’s professional systems.

As a preliminary matter, the CJEU acknowledged that business emails may contain personal data. Accessing and seizing such emails may therefore interfere both with the right to respect for communications under Article 7 and with the right to the protection of personal data under Article 8 of the Charter.

The CJEU then recalled that the rights protected by Articles 7 and 8 of the Charter are not absolute and may be subject to limitations where those limitations are provided for by law, respect the essence of the rights concerned, pursue an objective of general interest recognized by the European Union, and comply with the principle of proportionality (Article 52(1) of the Charter).

Applying those principles, the CJEU concluded that the investigative powers at issue satisfied those requirements. In particular:

• the Authority’s investigative powers were clearly established in national law;
• the measures did not undermine the essence of Articles 7 and 8 of the Charter, as the Authority did not enjoy unlimited or generalized access to emails and any data obtained could be used only for the purposes of identifying the anticompetitive conduct under investigation;
• the seizure of business emails pursued the legitimate objective of ensuring the effective enforcement of EU competition law, which constitutes an objective of general interest recognised by Union law;
• access to business emails is often indispensable for detecting anticompetitive conduct, and no equally effective, less intrusive alternative exists; and
• while prior judicial authorisation is not required, access to business emails must be subject to adequate safeguards against abuse and arbitrariness, including effective ex post judicial review.

Finally, the CJEU concluded its reasoning by drawing a distinction between business emails stored on a company’s professional systems and data stored on devices belonging to employees or managers in a personal capacity. According to the CJEU, access to personal devices may reveal extensive information about an individual’s private life extending well beyond strictly professional communications. As a result, it constitutes an interference significantly more serious with the rights guaranteed under Articles 7 and 8 of the Charter. Access to such communications must thus be subject to prior review by a court or an independent administrative authority vested with sufficient powers and guarantees to determine whether the measure is justified and proportionate in light of the fundamental rights at stake.

*          *          *

Covington’s Data Privacy and Cybersecurity team regularly advises companies on their most challenging data protection and compliance issues in the EU, UK and other key markets. If you have any questions about the topics discussed in this article, please do not hesitate to contact us.