French Cour de Cassation Confirms Mandatory Notification for Transnational Data Capture in EU Investigations

Transnational Data Capture in EU Investigations

This landmark ruling on June 17, 2025, from France's highest court, The Cour de Cassation, reaffirms the crucial requirement to respect existing cooperation mechanisms—specifically the Article 31 notification—when collecting intangible evidence like telecommunication or computer data across borders within the European Union. This principle is vital for defending clients in complex, cross-border criminal cases like EncroChat and SkyECC.

The Challenge of Fading Borders in Digital Investigations

More and more investigations are taking on a transnational dimension, leading to increasingly close cooperation between investigative services, particularly within the European Union Member States. Enhanced cooperation mechanisms in criminal matters are causing borders between States to fade. This is particularly true in cybercrime cases or when suspects in traditional criminal cases use modern technological tools.

In such scenarios, obtaining computer data is central. Investigators, equipped with sophisticated tools, may feel it is natural to retrieve this data wherever it's located, regardless of geographical boundaries. While seeking evidence is not new, the traditional reflex to refrain from acting in another country without the approval of its judicial authorities is much less obvious when dealing with the retrieval of intangible evidence.

The Cour de Cassation Case: Data Capture Across EU Member States

A ruling by the French Cour de cassation (Judgment No. 24-87.110 of 17 June 2025) clearly illustrates this issue. In a drug trafficking investigation, French investigators used a data capture measure (under Article 706-102-1 of the French Code of Criminal Procedure) to infiltrate a suspect’s mobile phone. This method successfully captured the suspect's communications, even those conducted via end-to-end encrypted messaging services, which traditional wiretaps could not have intercepted.

The difficulty arose because the suspect used his phone not only on French territory but also in Spain and the Czech Republic. While the data capture carried out in France posed no jurisdictional problem, the situation changed when the device was outside France, beyond the territorial limits of French investigators and judges. Apparently, neither the investigators nor the investigating judge questioned the legality, capturing the data without considering the crossing of national borders.

The Mandate for Notification: Consistent with CJEU Precedent

In its decision, the Cour de Cassation provided a response that aligns with the established position of the Court of Justice of the European Union (CJEU).

The CJEU, in its judgment of 30 April 2024 (Case No. C-670/22) concerning data capture from EncroChat phones, affirmed that a capture measure carried out on the territory of another Member State must adhere to the obligation of notification set out in Article 31 of Directive 2014/41/EU. This means a magistrate from State A who intends to perform a data-capture measure on a phone located in State B must notify State B's judicial authorities of the operation so they can oversee and potentially end it.

The Cour de cassation reached the same conclusion in its June 17, 2025, decision, stating:

“17. A measure involving the infiltration of terminal devices aimed at extracting communication, traffic, and location data from an internet-based communication service is equivalent, according to an autonomous and uniform interpretation under EU law, to a measure of interception of telecommunications within the meaning of Article 31(1) of the aforementioned Directive (CJEU, judgment of 30 April 2024, M. N., C-670/22, § 114). Consequently, it follows that the data-capture measure carried out on the territory of Spain and the Czech Republic, Member States of the European Union, should have been notified to those States.”

The ruling unequivocally reiterates that even when the evidence is intangible and located outside French territory, existing cooperation mechanisms must be implemented.

• For an EU Member State, this mechanism is the notification required by Article 31 of Directive 2014/41/EU.

  
  

• For a State outside the European Union, cooperation requires the issuance of an international request for mutual legal assistance.

Implications for EncroChat and SkyECC Cases

This decision, which reaffirms the necessity of respecting cooperation mechanisms, is critical for lawyers involved in cases like EncroChat and SkyECC. In both emblematic cases, tens of thousands of phones were infiltrated by French investigators, and data was extensively captured without regard to the physical location of the devices. It is clear that the French judicial authorities never carried out the notification required by Article 31 of the Directive.

For the time being, the Cour de Cassation has never ruled on this issue. One reason is that French judges can only be seized with challenges to the legality of investigative measures by individuals prosecuted in French proceedings, whereas in most of these cases, EncroChat or SkyECC users were located on French territory. The underlying legal question is now at the heart of appeals lodged on behalf of individuals prosecuted in other countries, leading the Cour de cassation to refer a preliminary question to the CJEU. If the right of these individuals to petition French courts is recognised, the EncroChat and SkyECC cases could face new and spectacular developments.

The Cour de Cassation's decision is available here.