Privacy at risk: EU Court ruling exposes gaps in Serbian rawn raid rules

The EU and ECHR standards: business vs. personal devices

The EU Court confirmed that business e-mails exchanged through official systems constitute protected "communications" under Article 7 of the Charter, even where they relate to work matters, and that the competition authority may seize such communications when taking measures to safeguard competition.

For business premises and business devices, the Court held that competition authorities may seize business correspondence without prior court approval, but only if domestic law clearly limits those powers and provides effective judicial review afterwards. The reasoning is straightforward: privacy is a fundamental right. Any restriction must be based on law, must not undermine the core of that right, and must be proportionate. The Court also drew on European Court of Human Rights (ECHR) case law, which requires that the lack of prior judicial approval be offset by effective subsequent judicial review.

For personal devices, such as mobile phones or laptops owned by employees or managers, the Court applied a stricter standard. These devices contain a mix of personal and work data, potentially revealing individuals' habits, movements and social relationships. Access to data stored on such devices therefore requires prior approval by a court or authorisation by an independent body. Subsequent judicial review alone is insufficient. The Opinion of Advocate General Medina, on which the Court relied, reinforced this point.

The problem: Serbian practice falls short of European standards

In Serbia, the Commission for Protection of Competition routinely seizes electronic data from computers, servers and mobile phones during dawn raids. Most investigations now rely on evidence collected in this manner. But there is no prior judicial review, as dawn raids are authorised solely by the Commission President, nor is there effective subsequent judicial review prescribed by the law. The Dawn Raid Authorisation, which the Commission delivers to the raided undertakings, specifies that the Authorisation cannot be challenged in court, as a court appeal is permitted only against the final decision in the case.

The gap is clear. The EU and ECHR standards require that even without prior judicial approval for the search of business premises, there must be clear legal limits and effective subsequent judicial review. For personal devices, the EU Court now establishes that prior court and independent body approval is mandatory under EU law. The approach in Serbia conflicts with both ECHR and EU Court standards. 

This decision of the EU Court could serve as a catalyst for reform in Serbia. A modern enforcement framework must strike the right balance between the effective enforcement of competition law and the full protection of the right to privacy and other fundamental rights in proceedings before the Commission. Against this background, the Authorities in Serbia should urgently consider the following measures:

1. ensure effective subsequent judicial review of all measures taken during dawn raid;
2. regulate access to business and personal devices (phones, laptops etc.) during dawn raids, including introduction of prior judicial or adequate administrative review for access to private devices;
3. define clearer legal limits on the Commission's powers to prevent arbitrary data seizures and reviews.

Until Serbia aligns its rules with these standards, evidence from dawn raids risks being found unlawfully obtained – whether by domestic or international courts (ECHR). More fundamentally, Serbia's competition enforcement framework will remain out of step with the fundamental rights protections it is already bound to uphold.