Thin Line Between Protection and Permission

On April 1, 2025, the European Court of Human Rights (ECtHR) delivered a landmark ruling in Ships Waste Oil Collector B.V. and Others v. the Netherlands. They held that the Netherlands’ Authority for Consumers and Markets (CMA) did not violate the European Convention on Human Rights (ECHR) when it relied on phone-tap evidence originally obtained in a criminal investigation by a separate law enforcement body. The applicant argued that this data reuse breached his rights under Article 8 (right to privacy) and Article 6 (right to a fair trial). The ECtHR rejected both claims, finding that the repurposing of lawfully gathered surveillance material was permissible under the ECHR so long as basic procedural safeguards were respected.

This ruling marks a subtle but important shift. While the ECtHR has long recognized privacy rights under Article 8 and fair trial rights under Article 6, this case tests their limits in modern enforcement. The ECtHR shows growing tolerance for evidence-sharing across criminal and administrative regimes, provided it remains proportionate and fair. Though pragmatic for regulatory efficiency, this flexibility risks eroding safeguards tied to criminal law. This article explores the ECtHR’s reasoning and its implications for future claims involving data privacy and administrative sanctions under the Convention.

The Scope of Articles 6 and 8 ECHR

Article 8 of the Convention guarantees the right to respect for private and family life, home, and correspondence. Interceptions of communications by state authorities constitute an interference with this right and must be justified under Article 8(2) as “necessary in a democratic society” and “in accordance with the law.” The ECtHR has previously ruled in cases such as Klass v. Germany and Uzun v. Germany that surveillance measures, while intrusive, may be legitimate when used for serious law enforcement purposes and subject to legal oversight.

Article 6(1) guarantees the right to a fair and public hearing by an independent and impartial tribunal. Although originally conceived in the criminal context, the ECtHR has extended its application to certain administrative proceedings – particularly where sanctions may have penal or quasi-criminal effects. In Jussila v. Finland, the ECtHR accepted that administrative sanctions may trigger Article 6 protections, albeit with a degree of procedural flexibility.

Case Summary and Ruling

The novel issue raised in this case is not the legality of the surveillance per se, but the secondary use of the data by a non-criminal agency. This raises questions about whether the purpose limitation principle embedded in privacy law should restrain the CMA’s access to and reliance on such evidence.

The applicant was initially under investigation by Dutch police for potential criminal conduct related to cartel activity. Law enforcement authorities, acting under judicial warrant, conducted covert surveillance, including the interception of telephone communications. Although the criminal case did not proceed to prosecution, the intercepted data was later shared with the CMA, which launched administrative proceedings alleging breaches of national and EU competition law. The applicant challenged the CMA’s use of this evidence, claiming that he had never been informed of the data transfer and had no opportunity to contest its admissibility. He argued that the evidence, obtained for a different legal purpose, was being used beyond its original scope, violating both his right to privacy and to a fair trial. The Dutch courts upheld the CMA’s actions, and the applicant appealed to the ECtHR, framing his claim under Articles 6 and 8 of the Convention.

In rejecting the applicant’s claims, the ECtHR emphasized a contextual and proportionality-based approach. Regarding Article 8, the ECtHR held that the initial interception was lawful, conducted under judicial supervision, and for a legitimate aim (law enforcement). The subsequent transfer to the CMA, while constituting a further interference with his privacy, did not violate Article 8 because it too had a clear legal basis, served the public interest in market regulation, and was subject to oversight. The ECtHR noted that the CMA’s use of the data was limited to the scope of its mandate and was not arbitrary or excessive. As Milanovic observes, the ECtHR has historically adopted a “suspicious but restrained” posture towards state surveillance, demanding strict oversight and procedural rigor to avoid function creep. The ECtHR’s decision here arguably marks a doctrinal softening of that scrutiny.

In relation to Article 6, the ECtHR considered whether the administrative proceedings were fair given the use of covertly obtained evidence. It reaffirmed that the use of such material does not in itself render a trial unfair, provided the accused can challenge it and that it is not the sole/decisive basis for the decision. In this case, the ECtHR found that the applicant had sufficient procedural means to dispute the evidence before the CMA and in domestic courts, thus satisfying Article 6 requirements.

The ECtHR’s reasoning rested heavily on the principles of proportionality, procedural fairness, and legality, rather than drawing hard lines between criminal and non-criminal regimes. This approach underscores the ECtHR’s commitment to substance over form, focusing on the practical implications for individual rights rather than rigid legal classifications.

Doctrinal Implications

The ruling marks an evolution in the ECtHR’s approach to evidentiary safeguards. Traditionally, the ECtHR has guarded the boundary between criminal and administrative processes, particularly when sensitive investigatory techniques are involved. By permitting inter-agency transfer and use of criminal phone-tap evidence in a regulatory context, the ECtHR appears to loosen this boundary in favour of enforcement pragmatism. This reflects a broader trend in European law towards what might be called functional convergence, i.e. where different arms of the state cooperate across legal departments to pursue overarching regulatory goals. Yet, this shift raises doctrinal concerns.

First, the ruling dilutes the purpose limitation principle, a cornerstone of data protection in European law. Under this principle, personal data collected for one specific and lawful purpose, such as criminal prosecution, should not be reused for an unrelated objective without clear legal basis, strict necessity, and strong procedural safeguards. Scholars have stressed that the purpose limitation principle is not merely technical but central to safeguarding autonomy and democratic accountability in EU data governance. Although the ECtHR did not directly engage with EU data protection instruments such as the General Data Protection Regulation (GDPR) or the Law Enforcement Directive, its apparent tolerance for the administrative reuse of lawfully intercepted data risks undermining this core tenet. By allowing the transfer and use of surveillance evidence in a separate regulatory context without requiring additional judicial authorization or individual notice, the process bypasses traditional legal safeguards. As a result, the ECtHR opens the door to functional repurposing of data that weakens the foreseeability and autonomy protections the Convention is meant to guarantee.

Second, the judgment blurs the distinction between investigatory standards in criminal and administrative enforcement. Surveillance techniques like phone-tapping, which would normally be subject to strict scrutiny in a criminal context, are now deemed admissible in administrative proceedings where procedural safeguards are less robust. The ECtHR emphasized the general fairness of the proceedings and the availability of remedial channels, but it did not require the same degree of notice, disclosure, or judicial control that one would expect in a criminal trial. This asymmetry is doctrinally significant. As administrative regimes increasingly impose severe financial and reputational penalties, the continued application of lighter safeguards becomes harder to justify. The ECtHR’s reliance on procedural flexibility may therefore be overly deferential to national authorities, raising the normative question of whether Article 6 protections should be reinforced, not relaxed, when punitive consequences flow from the use of intrusive evidence.

Conclusion

The ECtHR’s April 2025 judgment marks a significant moment in the evolving doctrine of Convention rights in the context of multi-agency enforcement. By allowing the administrative reuse of criminally obtained phone-tap evidence, the ECtHR has signaled a shift towards a more integrated view of state functions and a pragmatic reading of procedural safeguards under Articles 6 and 8. While this development may enhance enforcement capacity in increasingly complex regulatory landscapes, it also stretches the traditional limits of privacy and fairness protections. In doing so, it risks normalizing expansive data flows between state agencies without fully accounting for long-standing justifications behind evidentiary boundaries and purpose limitations. As Florczak-Wątor notes, the ECtHR plays a pivotal role in anchoring surveillance regimes within the rule of law – yet its permissive stance here risks loosening those anchors in favour of enforcement pragmatism.

Going forward, the ECtHR and national regulators must tread carefully. As state functions converge, so too must our understanding of legal safeguards evolve to ensure that Convention rights remain robust, predictable, and meaningful in a digital age.