The Question at Hand
You're preparing your compliance team for a potential competition law inspection. Your legal counsel asks: should you assume investigators need a court order before copying your business emails? The Court of Justice of the European Union (CJEU) just answered that question, complicating your data protection strategy.
On July 16, 2026, the CJEU ruled that national competition authorities can seize business emails stored on company systems without prior judicial authorization. This decision, stemming from Portuguese Competition Authority inspections, establishes that while business emails qualify as "communications" protected under Article 7 of the Charter of Fundamental Rights of the European Union, investigators don't need a judge's approval before copying them during dawn raids.
This creates a tension for compliance officers: you're accountable for protecting employee privacy under the General Data Protection Regulation (GDPR) while maintaining cooperation obligations under competition law. The ruling forces you to navigate this challenging landscape.
The Case for Broad Investigatory Access
Competition enforcement depends on speed and surprise. Requiring prior judicial authorization for email seizures gives companies time to sanitize evidence. Cartels don't document their conduct in formal board minutes; they coordinate through Outlook and Teams messages. By the time investigators secure a warrant, the smoking-gun email thread may be deleted.
The CJEU acknowledged this reality, finding that access to business emails is "often indispensable" for detecting anticompetitive conduct and that "no equally effective, less intrusive alternative exists." This isn't legal boilerplate; it's a recognition that modern antitrust violations live in digital communications.
From an enforcement perspective, the safeguards are adequate. The Authority's powers were clearly established in Portuguese law. Investigators operated under warrants from the Public Prosecutor's Office specifying the suspected practices. Any data obtained could be used only to identify the anticompetitive conduct under investigation, not for unrelated purposes.
Most importantly, the ruling doesn't eliminate judicial oversight. It shifts it from ex ante authorization to ex post review. Companies can challenge the seizure in court after it occurs. If investigators exceeded their mandate or grabbed irrelevant personal data, judges can exclude the evidence and impose consequences. This review occurs after you can see what was actually taken, not based on hypothetical scenarios in a warrant application.
The Case for Prior Judicial Authorization
Here's the counter-argument: ex post review is cold comfort when your employees' communications are already copied to a government hard drive. The CJEU confirmed that business emails constitute "communications" under Article 7 of the Charter, with protection extending to professional correspondence regardless of content or medium. The European Court of Human Rights has held that this protection doesn't vanish just because your employer prohibits personal use of company email.
That matters because business email accounts contain more than competitive intelligence. They hold medical appointment confirmations, union organizing discussions, whistleblower tips to regulators, and attorney-client privileged exchanges. Even if your policy prohibits personal use, your employees are human. They're going to use their work email for sensitive communications.
When investigators copy an entire mailbox during an inspection, they're accessing all of it. The distinction the CJEU drew between company systems and personal devices is legally coherent but practically meaningless. Your employees don't maintain separate devices for "strictly professional" versus "might reveal my private life" emails. They use one inbox, and that inbox is now in the hands of competition authorities without a judge ever reviewing the scope of intrusion.
The proportionality analysis falls apart under scrutiny. Yes, email access is valuable for investigations. But so is wiretapping suspects' phones, and we require warrants for that. The CJEU's reasoning suggests that investigative utility automatically outweighs privacy concerns, which isn't how Article 52(1) of the Charter is supposed to work. Limitations must "respect the essence" of the rights concerned and comply with proportionality. Seizing thousands of emails based on a prosecutor's warrant, not a judicial determination, stretches both requirements.
Where Practitioners Actually Land
In practice, most compliance teams are preparing for inspections under the assumption that emails will be copied without prior court involvement. You're not going to win a legal argument at 7 a.m. when investigators arrive with a warrant. Your job is to have a protocol ready.
That means training employees on what constitutes business versus personal data, though the CJEU made clear that distinction won't protect professional emails. It means documenting your email retention policies and ensuring they align with both GDPR requirements and litigation hold obligations. It means having outside counsel on speed dial who can attend the inspection and preserve your right to challenge the scope later.
You're also implementing technical controls that weren't designed for this scenario but might limit exposure. Privileged Access Management for executive accounts. Automated classification tags that flag legally privileged communications. Mobile device management policies that keep truly personal communications on employee-owned devices, which the CJEU acknowledged require higher protection.
None of this prevents the seizure. It just gives you better arguments during ex post judicial review and cleaner data hygiene if regulators copy your systems.
Our Take
The CJEU got the legal framework right but underestimated the practical privacy impact. Business emails do warrant protection under Article 7 of the Charter, and competition enforcement does serve a legitimate general interest. The problem is the court's assumption that ex post review provides adequate safeguards.
It doesn't. By the time you're in court challenging the seizure, investigators have already reviewed communications that may include privileged, personal, or entirely irrelevant content. Exclusion of evidence after the fact doesn't erase the privacy intrusion. The court should have required prior judicial authorization for bulk email seizures, with narrow exceptions for time-sensitive situations where evidence destruction is imminent.
For compliance officers, this ruling means your data protection obligations and your competition law cooperation duties are now in direct conflict. You can't fully satisfy both. The best you can do is document your safeguards, train your teams on the distinction between company and personal systems, and preserve your right to challenge overreach after it happens. That's not a satisfying answer, but it's the reality the CJEU just created.
