What did the Court decide?
In Joined Cases C-258/23, C-259/23, and C-260/23 [1] IMI, Synlabhealth and SIBS (“IMI”), the Grand Chamber of the CJEU clarified the extent to which competition authorities can obtain electronic communications and access digital devices during competition inspections. The judgment confirms that business emails may be seized without prior judicial authorisation in certain circumstances while also highlighting that access to employee-owned or mixed-use devices raises distinct privacy and data protection concerns that necessitate enhanced procedural safeguards.
Two aspects of the judgment are likely to be of particular interest to businesses:
Workplace communications remain protected communications
In answering the first question referred, the Court held that the concept of “communications” in Article 7 of the Charter of Fundamental Rights (the “Charter”) encompasses business emails exchanged between employees and managers through an undertaking’s messaging system. The fact that a communication is work-related and sent from a corporate email account or governed by an employer’s internal policies does not deprive it of Charter protection.
The Court also highlighted that workplace emails are likely to contain personal data protected by Article 8 of the Charter. For businesses, the significance of this finding is that competition authorities reviewing workplace emails are engaging not only the right to respect for communications under Article 7, but also the separate right to data protection under Article 8. While the Court accepted that access to such material may be necessary to investigate anti-competitive conduct, it emphasised that these powers must operate within a clear legal framework and be accompanied by appropriate safeguards and oversight.
Although the judgment concerned email communications, its reasoning has the potential to be relevant to other workplace communication tools, including Microsoft Teams and other internal messaging platforms. As business communications increasingly move beyond email, the decision confirms that the same privacy and data protection considerations are likely to arise when regulators seek access to those platforms.
Company-owned devices vs employee-owned / mixed-use devices
The Court’s recognition that workplace communications engage Articles 7 and 8 of the Charter informed its approach to devices used by employees for both professional and private purposes. It observed that access to employee-owned devices may expose investigators not only to business communications, but also to photographs, browsing histories, location data and private messages. Such access is therefore capable of giving rise to a serious interference with the rights protected by Articles 7 and 8 of the Charter.
For that reason, the Court held that access to employee-owned or mixed-use devices must be subject to prior review by a court or another independent authority. By contrast, business emails may be seized without prior judicial authorisation, provided the inspection takes place within a strict legal framework and is subject to effective ex post judicial review.
The judgment establishes a clear distinction between company-owned systems and employee-owned or mixed-use devices, with the latter attracting enhanced procedural safeguards because of the broader privacy and data protection interests involved.
What does this mean for businesses in Ireland?
The decision in IMI sits comfortably alongside the existing Irish dawn raid jurisprudence. Irish courts have long recognised the tension between effective regulatory enforcement and privacy rights, with proportionality and judicial oversight playing a central role in striking that balance. In CRH plc v CCPC [2], (“CRH”) the Court was primarily concerned with the volume of material falling outside the scope of the investigation. While accepting that some degree of overcollection may be inevitable in digital investigations, the Court emphasised that any interference with privacy rights must remain proportionate and be accompanied by procedures allowing the legality of the seizure and review process to be effectively scrutinised. In ComReg v Eircom [3] (“Eircom”) the focus was different. The case concerned the procedures by which seized material, including potentially privileged and irrelevant documents, would be filtered and reviewed. The High Court accepted the legitimacy of ComReg’s investigative powers but closely examined whether the proposed review process adequately protected confidentiality and privilege while enabling the regulator to fulfil its statutory functions.
Taken together, these cases demonstrate that the Irish courts accepted the legitimacy of the underlying investigative powers, but focused closely on the procedures governing the seizure and review of the material obtained during an inspection and whether those procedures adequately protected the rights of affected parties.
What appears novel in IMI is that the Court moved beyond questions of proportionality and review processes to focus on the nature of the device being searched. While the Irish courts have traditionally concentrated on the scope of search powers, proportionality, privilege and judicial supervision, the CJEU drew a distinction between material held on company-owned systems and material stored on employee-owned or mixed-use devices.
The Court recognised that employee-owned or mixed-use devices present a different category of privacy concern. Unlike company systems, such devices are likely to contain significant volumes of personal information unrelated to the investigation, including private communications, photographs, browsing histories and location data. It was this heightened intrusion into Articles 7 and 8 rights that led the Court to conclude that additional safeguards are required.
This raises an important question for future Irish dawn raid cases: are the safeguards that apply to searches of company-owned systems sufficient where regulators seek access to employee-owned or mixed-use devices? According to the CJEU, the answer is no. While business communications stored on company systems may be reviewed without prior judicial authorisation, subject to a strict legal framework and effective ex post review, access to employee-owned or mixed-use devices must be subject to prior review by a court or another independent authority.
This is a significant development. CRH and Eircom focused on the safeguards surrounding the review of material after it had been seized. By contrast, IMI establishes that, in the specific context of employee-owned or mixed-use devices, post-seizure safeguards are insufficient. Prior independent scrutiny is required before access to such devices is granted.
In that respect, IMI may be more closely aligned with the growing body of Irish case law recognising that privacy concerns are particularly relevant in the digital environment. In Quirke v DPP [4] the courts recognised that electronic devices can contain vast quantities of personal information and therefore raise different privacy considerations to searches of physical spaces or documents.
As business communications increasingly take place through smartphones, Teams chats and other digital collaboration tools, the distinction drawn by the Court in IMI is likely to become an important feature of future dawn raid challenges in Ireland. For businesses, the judgment provides a potential basis for arguing that access to employee-owned or mixed-use devices requires a greater degree of scrutiny and procedural protection than access to company-owned devices.
Contact us
If you would like to discuss this topic further, please get in touch with the Competition and Regulation team or your usual Matheson contact.
[1] Joined Cases C-258/23, C-259/23, and C-260/23 (IMI — Imagens Médicas Integradas S.A. (C-258/23), Synlabhealth II (C-259/23), and SIBS – Sociedade Gestora de Participações Sociais and Others (C-260/23) v Autoridade da Concorrência) ECLI:EU:C:2026:585.
[2] CRH plc and Irish Cement Ltd v. Competition and Consumer Protection Commission [2017] IESC 34.
[3] Commission for Communications Regulation v. Eircom Limited [2014] IEHC 49.
[4] The People (DPP) v. Patrick Quirke [2023] IESC 20.
