CJEU (AG) ¦ Advocate General Places FIU Data under the Law Enforcement Directive

Advocate General: FIUs are law enforcement authorities for data protection purposes

Financial intelligence units process their core AML/CFT data as “competent authorities” under the Law Enforcement Directive (EU) 2016/680, not under the GDPR. That is the central proposal of Advocate General Medina in her Opinion of 8 October 2026 in Case C-222/25 Rahapesu Andmebüroo, a reference from the Estonian Supreme Court. She also accepts that an FIU may refuse a data subject all access to its files, but only under clear and precise statutory rules with safeguards, and never without pointing the person to indirect access through the data protection authority.

An access request that reached the Supreme Court

The case began in December 2019, when an individual asked the Estonian FIU, the Rahapesu Andmebüroo (RAB), whether Estonian or foreign credit institutions or foreign authorities had sent it information about him or made enquiries. A later request asked whether the RAB had opened a file on him and whether it had made enquiries to the United States. The RAB refused each time, relying on a provision of the Estonian AML/CFT law that allows its head to classify information as intended for internal use, and it would neither confirm nor deny that any data existed.

The Estonian data protection authority ordered the RAB to provide the information. The head of the RAB responded with a decision restricting the applicant’s access and, a few weeks later, with an order declaring, retroactively, the data in the entire RAB database to be for internal use only. The administrative court and the court of appeal in Tallinn both found the national provision incompatible with EU data protection law: it did not say which processing it covered, on what grounds access could be refused or for how long. In practice the restriction could last until the data were deleted, usually 15 years after a file is closed. The RAB appealed to the Riigikohus, which referred four questions to the Court of Justice.

Bastian Schwind-Wagner _Follow

"For the first time, the Court of Justice is asked to settle which data protection regime governs financial intelligence units, and the Advocate General gives a clear answer: FIUs work in the chain of crime prevention and fall under the Law Enforcement Directive. That fits how FIUs actually operate, and it gives them a legally sound basis for the confidentiality on which suspicious transaction reporting depends.

The opinion is just as clear that confidentiality is no blank cheque. A total refusal of access needs clear statutory criteria, documented reasons and a working route of indirect access through the data protection authority, and Member States whose FIU legislation simply declares everything internal should review it before the judgment."

GDPR or Law Enforcement Directive

The first question decides everything else. Article 41(1) of the fourth AML Directive (EU) 2015/849 says that personal data processed under that Directive is subject to the GDPR. The GDPR, however, excludes processing by “competent authorities” for the prevention, investigation, detection or prosecution of criminal offences, which is governed by Directive 2016/680. The difference has real consequences. The Law Enforcement Directive allows wider restrictions of the right of access, including a complete restriction. It provides for indirect exercise of data subject rights through the supervisory authority, and it has its own regime for transfers to third countries, with separate adequacy decisions.

The Advocate General recalls that the Directive’s scope turns on two cumulative conditions: who processes the data and for what purpose. A law enforcement purpose alone does not take processing out of the GDPR, and a competent authority that processes data for unrelated purposes stays under the GDPR as well. The Court has applied that test before: tax authorities collecting data to fight tax fraud and a road safety agency publishing penalty points fell under the GDPR, while passenger information units processing PNR data and the French copyright authority Hadopi, acting in a “pre-criminal” graduated response procedure, fell under the Law Enforcement Directive.

Why FIUs count as competent authorities

FIU models differ widely across the EU, from administrative units in ministries or central banks to police and judicial units and hybrids. The Advocate General considers that organisational form irrelevant. What counts is the mission and the powers. Under Article 32 of Directive 2015/849, an FIU must prevent, detect and combat money laundering and terrorist financing. It receives and analyses suspicious transaction reports on money laundering, associated predicate offences and terrorist financing, and it disseminates the results to the competent authorities. It has access to law enforcement information, exchanges intelligence with other FIUs and Europol, and can suspend or withhold consent to a transaction.

On that basis she treats FIUs as the EU’s financial intelligence hubs, positioned between the obliged entities that report and the authorities that investigate and prosecute. Their added value lies in analysis, which places them firmly in the chain of crime prevention. If an administrative authority such as Hadopi, without decision-making powers of its own, is a competent authority, the same must apply all the more to an FIU with autonomous analytical powers. The comparison with passenger information units, which also receive, analyse and pass on data to law enforcement, points the same way. Whether the FIU is an investigative body under national criminal procedure does not matter.

All governments that took a position agreed. Luxembourg described FIUs as having a “pre-criminal” function within a “functional continuum” leading to law enforcement, and argued that an FIU would in any event fall under the second limb of the definition, which covers any body entrusted by national law with public powers for law enforcement purposes. The Advocate General adopts that fallback.

The Commission’s objections

The European Commission argued that FIUs only handle information administratively before passing it on, and that only the receiving authorities draw conclusions about criminality. The Advocate General rejects this as inconsistent with the FIUs’ powers of access, exchange and transaction suspension. Nor does an FIU’s position in the middle of the chain prevent it from being a competent authority.

The Commission’s strongest argument was the wording of Article 41(1) of Directive 2015/849. The Advocate General reads that provision as being without prejudice to the Law Enforcement Directive: it does not move the boundary between the two data protection instruments. Recital 42 of the fourth AML Directive, recital 22 of Directive 2016/680 and recital 122 of the sixth AML Directive (EU) 2024/1640, which mentions both regimes and no longer contains an express rule on the applicable regime, all support that reading. The Commission’s concern that the classification could compromise FIU independence is also dismissed, since operational independence has to be ensured regardless of organisational status.

The classification is limited to the FIU’s core AML/CFT mission. Where national law gives an FIU other tasks, such as supervision of the non-financial sector (which the RAB also carries out) or the enforcement of certain financial penalties, that processing remains under the GDPR.

A total refusal of access is possible, but not unconditional

Article 15(1) of Directive 2016/680 allows Member States to restrict the right of access wholly or partly, to the extent and for as long as this is necessary and proportionate. The Advocate General accepts that confidentiality is an essential prerequisite of the AML/CFT system. It runs through the entire chain: obliged entities under the tipping-off prohibition, FIUs and law enforcement. Even the knowledge that data are being processed could jeopardise an analysis and allow suspects to conceal the origin of their funds. A total restriction of access to FIU data can therefore be necessary and appropriate.

It must, however, rest on clear and precise rules governing the scope and conditions of the restriction, with minimum safeguards against abuse and unlawful access. An absolute and unconditional restriction, without any circumstances, conditions or safeguards, is unjustified interference: without criteria in the law, neither the supervisory authority nor a court can review whether a refusal was lawful. The controller must also document the factual or legal reasons for each refusal and make them available to the supervisory authority. In the Advocate General’s words, the power to refuse access does not give the FIU “carte blanche”.

Estonia told the Court that the head of the RAB in fact decides each request individually and grants access in some cases, for instance when a person already knows of an inquiry or when the RAB freezes his or her funds. The Advocate General answers that any such discretion must itself be framed by criteria in the national measure, and that no such criteria appear in the Estonian legislation. The final assessment is for the referring court.

“Neither confirm nor deny”, with one fixed exception

On the second question, the Advocate General concludes that an FIU may refuse to give reasons for a refusal or restriction where reasons would reveal whether data about the person are processed at all. A “neither confirm nor deny” response is therefore permissible under Article 15(3) of Directive 2016/680.

What the FIU may never leave out is the information that the person can exercise the right of access through the supervisory authority under Article 17 of the Directive, and can lodge a complaint or seek a judicial remedy. No exemption is allowed here. Indirect access is what offsets the refusal: the data protection authority checks the FIU’s processing in a confidential dialogue, tells the data subject at least that the necessary verifications have taken place and decides what information the person needs to bring an effective legal challenge. National law must also let courts examine the grounds and evidence on which the supervisory authority relied.

Restrictions spread across several legal acts

The third question concerns the Estonian technique of combining a general empowerment in the AML/CFT law, an order of the FIU’s head, the public information law and a ministerial decree on the FIU database. The Advocate General reads “legislative measures” broadly and in a substantive sense, in line with the case-law of the European Court of Human Rights: a restriction can be built from several provisions, including subordinate rules, as interpreted by the courts. Having to read several acts together is not in itself a breach.

The test is foreseeability. Data subjects must be able to identify the circumstances and conditions under which their right of access may be restricted and the guarantees that protect their data. The Estonian provisions, worded in very general terms, do not appear to meet that standard. The database decree regulates the controller, the categories of data, the security level and the 15-year retention period, but says nothing specific about when access may be restricted or which safeguards apply.

What it means for FIUs, obliged entities and Luxembourg

If the Court follows the Opinion, Member States will need to check whether their FIU legislation contains real criteria for refusing access, a documentation duty and a functioning route of indirect access through the data protection authority. Blanket clauses declaring the whole FIU database internal will not survive in their current form. Luxembourg’s Cellule de Renseignement Financier (CRF), which the Opinion counts among the FIUs organised on the law enforcement or judicial model, would clearly fall within the Law Enforcement Directive for its core analytical work. The classification also affects FIU-to-FIU and third-country exchanges, which would be governed by the Directive’s own transfer rules rather than GDPR adequacy decisions.

For banks, investment fund managers and other obliged entities, the Opinion does not change their own legal position. Their processing for AML/CFT purposes stays under the GDPR, which also covers private parties that process data for law enforcement purposes. The tipping-off prohibition continues to apply to their reporting. What the case does show is how a data subject access request can reach an FIU. Customers who suspect that a bank has reported them may try the FIU directly. Compliance teams handling access requests should keep their own tipping-off analysis separate from any response the FIU gives, and should not assume that an FIU’s refusal will remain unexplained forever. Once the national framework requires documented reasons and indirect review, the content and quality of a suspicious transaction report may end up in front of a data protection authority and, ultimately, a court.

Dive deeper

• CURIA ¦ Case C-222/25 Rahapesu Andmebüroo, Opinion of Advocate General Medina of 8 October 2026 ¦ Link