Dutch Supreme Court revises its EncroChat framework after C-670/22: Art. 31 also protects users

In its judgment of 14 April 2026 the Dutch Supreme Court (Hoge Raad) used an EncroChat case to explain what CJEU C-670/22 means for its earlier framework (HR 13 June 2023, ECLI:NL:HR:2023:913). It revised that framework: Art. 31 Directive 2014/41/EU protects not only State sovereignty but also the privacy and communication rights of the users intercepted, so a breach can be relevant when deciding on legal consequences under Art. 359a of the Code of Criminal Procedure. Infiltrating terminal devices to collect traffic, location and content data is an interception of telecommunications. The court restated the CJEU rule that evidence on which the defence cannot comment effectively and which may have a predominant influence must be disregarded. On the facts it found no irregularity, because the data reached the Netherlands through the French-Dutch joint investigation team with prior Dutch judicial authorisation. The prison sentence was reduced for breach of the reasonable-time requirement.