Dawn Raids: EU Opinion Backs Business Email Seizures Without Judicial Authorization

Advocate General Medina issued a well‑reasoned opinion in Joined Cases C‑258/23 to C‑260/23 before the Court of Justice of the EU (CJEU) that may allow national competition authorities to seize business emails during dawn raids at company premises without prior judicial authorization.

The CJEU has not yet decided, but the opinion’s structured proportionality analysis is likely to shape the final judgment. Companies should act now by:

• updating dawn‑raid protocols to embed GDPR‑by‑design email‑search controls,
• setting clear on‑site objection procedures for inspections,
• and enforcing clean separation between business, private, and privileged communications amongst employees, supported by bring your own device (BYOD) rules that require such technical segregation on personal devices.

Key Facts and Findings

The Portuguese competition authority (Autoridade da Concorrência) seized employee work emails during competition probes based on an authorization issued by the Public Prosecutor’s Office, but without obtaining a prior authorization to seize the emails from a court. The companies argued that business emails were protected “correspondence” under Article 7 of the EU Charter of Fundamental Rights and that only an investigating judge – not the Public Prosecutor – could authorize the seizure.

AG Medina concludes that Articles 7 and 8 of the EU Charter do not require prior judicial authorization to seize work emails at company premises. However, there must be a strict legal framework and effective safeguards in place, including meaningful ex post judicial review, to prevent abuse and arbitrariness.

AG Medina distinguishes the European Court of Justice’s Landeck ruling of 4 October 2024 (C-548/21) on mobile phone access in criminal investigations, where the court required prior review by a judge or an independent administrative body, except in urgent cases. In contrast to criminal investigations targeting private individuals, work-email seizures target business information in a professional environment to uncover anticompetitive conduct and do not entail full, uncontrolled access to a device that can map out a person’s private life.

The CJEU has still not ruled in this case and it may, in its judgment, clarify the weight of specific safeguards and the conditions for prior authorization at private premises or where personal criminal liability is at stake.

Key To-Dos for Companies

• Map your email systems and data trails. Maintain current records of email servers, archives, journaling systems, cloud tenants and backup repositories. Enabling accurate scoping reduces overbroad seizures by authorities.
• Separate business from private and privileged communications. Enforce policies that prohibit personal use on critical mailboxes and require privileged labels for counsel communications. Clear separation minimizes incidental capture of private data and protects legal privilege during seizure and review.
• Update your BYOD policies and agreements. Design clear protocols for remote work devices, requiring employees to keep business and personal information separate on any personal hardware used for work.
• Prepare a consent, transfer and confidentiality template for data undergoing inspection by authorities. Draft templates for consents, international data transfers and confidentiality, and define clear purpose and deletion clauses to preserve privilege where you decide to voluntarily cooperate with authorities.