Grab and Go: EU Top Court Allows Antitrust Enforcers to Seize Work Emails Without Approval

Background

The cases arose from investigations by the Portuguese Competition Authority into suspected infringements of competition law. During inspections at the premises of the companies under investigation, the authority seized business records arising from emails exchanged between employees and managers. The companies challenged the seizures, arguing that their right to confidentiality of communications had been breached and that an investigating judge, rather than the Public Prosecutor's Office, should have authorized the measures. The Portuguese court referred the issue to the CJEU to clarify whether EU law required prior judicial authorization before a national competition authority could seize business emails.

The Decision

The CJEU held that EU law does not preclude Member State legislation allowing a national competition authority to seize, at professional or business premises, emails whose content relates to the subject matter of the inspection without prior court authorization. The court emphasized that emails exchanged through an undertaking's messaging system remain protected by the right to respect for private and family life, even when they are business-related, and that seizure of those emails may also concern the right to protection of personal data.

The key limiter is proportionality, backed by safeguards. The CJEU considered that email seizures may be justified by the European Union's general-interest objective of preserving undistorted competition, but only where they are provided for by law, strictly limited to the inspection's subject matter, do not give authorities unlimited or generalized access to email content, and are subject to full ex post judicial review. In the Portuguese cases, the court noted that authorization by the Public Prosecutor's Office appeared likely to support the legal framework governing the appropriateness, duration, and material scope of the measures.

Mixed-Use Devices Require Special Attention

The CJEU's reservation concerns mobile telephones, computers, and other computer storage media used for both private and professional purposes. Access to those devices may reveal detailed private information, so the analysis can differ from a targeted seizure of business emails from company systems. In that scenario, access must be subject to prior review by a court or by an independent administrative body with the powers and guarantees needed to reconcile the rights and interests at issue. This finding creates questions on the legality of the Commission’s own practice, in the midst of the review of its main procedural regulation.

For dawn raids, that means companies should be ready to distinguish corporate email repositories from personal or mixed-use devices. They should also be prepared to make timely, documented objections where inspectors seek access beyond the subject matter of the inspection or into private material that should be segregated before review.

What Companies Should Do Now

Companies should assume business emails are within reach during EU dawn raids. Dawn-raid protocols should cover who receives inspectors, who reviews the inspection authority, who coordinates with counsel, who manages IT access, and how objections are preserved in real time. Protocols should also address systems accessed, data copied, privilege claims and confidentiality assertions, and whether the requested material falls within the inspection's scope.

Companies should also map email systems before an inspection occurs. That mapping should cover active mailboxes, archives, cloud systems, shared accounts, backups, collaboration platforms, and devices that may contain both professional and private material. The practical point is to help confine collection to the lawful scope of the inspection and to support objections to overbroad or generalized access.

Finally, companies should reinforce separation between professional and private data on devices that may be accessed during an inspection. Mixed-use devices raise heightened fundamental-rights concerns, so teams should be prepared to identify them, segregate private material where appropriate, and document any objection to access that should be subject to prior review.