EncroChat evidence
in Europe

Most supreme courts admit EncroChat evidence: the Bundesgerichtshof, the Hoge Raad, the Tribunal Supremo, the Italian Corte di cassazione and the Court of Appeal of England and Wales. Since the CJEU's judgment in C-670/22, trial courts must disregard data the defence cannot effectively comment on, and some have done so: the Berlin Regional Court in 2021 and 2024, and the Tribunal of Imperia in January 2026. The European Court of Human Rights has two sets of EncroChat cases before it, Silgir v. Germany (No. 2) and Isha and Emmen v. Norway.

 

In spring 2020 the French Gendarmerie, working in a joint investigation team with the Netherlands and supported by Europol and Eurojust, installed an implant on EncroChat devices through the company's server in Roubaix. The data of tens of thousands of users in more than 120 countries was then passed to other states, mostly through European Investigation Orders. This page summarises how courts have dealt with that material, which cases are pending, and which defence arguments have succeeded. Where our Case Law Database has an entry, the decision links to it.

 

EncroChat evidence country by country

Six jurisdictions and the Court of Justice, sorted alphabetically. For each: the highest court that has ruled on EncroChat evidence, the leading decisions and the result.

 

England and Wales

Highest court: Court of Appeal (Criminal Division). Leading decision: R v A, B, D & C [2021] EWCA Crim 128, 5 February 2021. Result: admitted. The court held that the messages were taken from the devices while "stored in or by" the system, so the bar on intercept evidence in the Investigatory Powers Act 2016 does not apply. The Court of Appeal refused to certify the question for the Supreme Court.

 

France

Highest courts: Conseil constitutionnel and Cour de cassation. Leading decisions: Conseil constitutionnel, 8 April 2022, no. 2022-987 QPC; Cass. crim., 11 October 2022, no. 21-85.148; Cass. crim., 1 April 2026, no. 25-82.181. Result: admitted. Defence secrecy may cover the capture technique, but not the transcripts and authorisations. In 2022 the Cour de cassation quashed a ruling because the certificate of sincerity required by French law was missing. In 2026 it held that the use of means covered by defence secrecy does not in itself breach the rights of the defence, and noted that the defence had not asked for declassification.

 

Germany

Highest courts: Bundesgerichtshof and Bundesverfassungsgericht. Leading decisions: BGH, 2 March 2022, 5 StR 457/21; BVerfG, 1 November 2024, 2 BvR 684/22; BGH, 17 December 2025, 5 StR 413/25. Result: admitted for serious offences. The Berlin Regional Court excluded the data twice (1 July 2021, (525 KLs) 254 Js 592/20 (10/21); 19 December 2024, 525 KLs 8/22). The BGH set the 2024 acquittal aside on the prosecution's appeal because the evaluation of evidence was flawed, and stated that the Berlin reasoning gave it no cause to depart from its case law.

 

Italy

Highest court: Corte di cassazione. Leading decisions: Cass. Sez. Un., 29 February 2024, nos. 23755 and 23756/2024; Corte costituzionale, 22 June 2023, no. 170/2023; Tribunale di Imperia, 19 January 2026, N. 4/25 R.G.T. Result: admitted in principle. The Joint Chambers held that a prosecutor may obtain messages already decrypted in France by EIO without prior authorisation by an Italian judge. The Tribunal of Imperia refused to admit the EncroChat material because French state secrecy prevented any check of filtering, dating and attribution.

 

Netherlands

Highest court: Hoge Raad. Leading decisions: HR, 13 June 2023, ECLI:NL:HR:2023:913; HR, 14 April 2026, 24/02527. Result: admitted. In 2026 the Hoge Raad revised its 2023 framework after C-670/22: Art. 31 of the EIO Directive also protects users, and a breach can matter under Art. 359a of the Code of Criminal Procedure. On the facts there was no irregularity, because the data reached the Netherlands through the joint investigation team with prior Dutch judicial authorisation.

 

Spain

Highest court: Tribunal Supremo. Leading decision: STS 854/2025 (Pleno), 16 October 2025. Result: admitted, with probative value to be assessed case by case. A missing Art. 31 notification leads to nullity where it caused actual prejudice or was meant to circumvent the safeguards of the issuing State. The court required particular caution where the defence never received the raw data.

 

EU level: Court of Justice

Leading decision: CJEU (Grand Chamber), 30 April 2024, C-670/22 (M.N.), on a reference from the Berlin Regional Court. Result: a prosecutor may issue the EIO for evidence already held in France. Infiltrating devices is an interception of telecommunications under Art. 31 of the EIO Directive; the Member State where the user is located must be notified, and that duty also protects the user. Under Art. 14(7), evidence on which the defence cannot effectively comment and which is likely to have a preponderant influence on the findings of fact must be disregarded.

 

Courts in Belgium, Montenegro and Switzerland have so far ruled mainly on SkyECC; see our SkyECC page. For EncroChat cases in those countries, contact the member listed below.

 

Pending and decided cases in Strasbourg

The ECtHR has not yet ruled on the merits of an EncroChat case.

 

A.L. and E.J. v. France (nos. 44715/20 and 47930/21)

Decision of 24 September 2024, published 17 October 2024: inadmissible. The two applicants, prosecuted in the United Kingdom, had not used the remedy that French law offers against the capture measure. The Court did not examine whether the operation complied with Art. 8. Our analysis.

 

Silgir v. Germany (No. 2) (no. 22234/25)

Communicated on 31 October 2025. Questions under Art. 8 and Art. 6 ECHR: does the use of EncroChat data in German proceedings interfere with private life and correspondence, and could the applicant communicate confidentially with his lawyer? Fair Trials intervened as a third party in March 2026. No date set. Our analysis.

 

Isha v. Norway and Emmen v. Norway (nos. 7905/25 and 9417/25)

Communicated on 6 May 2026. Convictions of 20 and 12 years based on SkyECC and EncroChat data from France. Questions under Art. 6 ECHR on the decisive weight of the data, its integrity and completeness, and the defence's ability to challenge it. No date set. Our analysis.

 

Defence approaches that have worked

Six lines of argument, each with the decision that accepted it. How much weight each one carries depends on national procedure; the member for your country can assess that.

​

1. Check whether your country was notified under Art. 31 before the implant ran on devices on its territory. Legal basis: Art. 31 of Directive 2014/41/EU; CJEU C-670/22. Accepted by: Landgericht Berlin, 525 KLs 8/22 (data excluded; set aside on other grounds by BGH 5 StR 413/25); Hoge Raad 24/02527 (breach relevant under Art. 359a); Tribunal Supremo, STS 854/2025 (nullity where actual prejudice). The Cour de cassation applies the same duty to other device surveillance (no. 24-87.110).

2. Ask for the raw data, the filtering and parsing steps, and the method used to attribute messages to a user. Where France refuses on grounds of state secrecy, ask the court to draw the consequence. Legal basis: Art. 14(7) of Directive 2014/41/EU; Art. 6 ECHR; ECtHR, Yüksel Yalçınkaya v. Türkiye. Accepted by: Tribunale di Imperia, N. 4/25 R.G.T. (material not admitted); Landgericht Berlin, 525 KLs 8/22 (secrecy breached the right to a fair trial).

3. Test the secrecy claim itself. Reporting in 2026 indicates that the French implant relied on a publicly known Android vulnerability and the open-source tool Frida. In France, apply for declassification under Art. L. 2312-4 of the Code de la défense; the Cour de cassation rejected a secrecy complaint in 2026 partly because no such request had been made (no. 25-82.181). Background: The State Secret That Never Was.

4. In French proceedings, check that the certificate of sincerity for the decrypted data is in the file. Legal basis: Art. 230-3 of the Code de procédure pénale. Accepted by: Cass. crim., 11 October 2022, no. 21-85.148.

5. Argue that using an encrypted phone does not by itself create suspicion of a crime, so the surveillance of every user was disproportionate. Legal basis: national rules on interception; Art. 8 ECHR; ECtHR, Akgün v. Turkey, no. 19699/18, 20 July 2021, §§ 151-185 (downloading or using an encrypted messaging service does not in itself found a reasonable suspicion under Art. 5 § 1 (c) ECHR). Accepted by: Landgericht Berlin, 1 July 2021, (10/21) (main proceedings not opened); the Rotterdam District Court acquitted EncroChat resellers of money laundering in 2024 because it could not be shown that all users were criminals (analysis).

6. Test whether anything other than the chats supports each charge. Legal basis: free evaluation of evidence; statutory minimum of evidence in the Netherlands. Accepted by: Tribunal Supremo, STS 854/2025 (probative value case by case); Landgericht Berlin, 525 KLs 8/22 (in the alternative, chats needed corroboration).

 

Background: Analysis of C-670/22; Digital evidence cannot stand above national law; EncroChat and SkyECC before the ECtHR.