Data Retention: EU Court of Justice Denounces Mandatory Data Retention

Paris, 8 April 2014 — In a judgement issued this morning, the Court of Justice of the European Union opposed itself to the bulk data retention of our online communications by ruling the 2006 European Data Retention Directive invalid. In the midst of the ongoing debate on mass surveillance, this legal decision represents an important step towards regaining our fundamental right to respect for private life and to the protection of personal data.

Since its adoption in 2006, the Data Retention Directive was heavily criticised by civil society organisations, Members of the European Parliament¹See summary of the report of the Civil Liberties Committee (LIBE) of the European Parliament., European institutions and the constitutional courts of several member states²The constitutional courts of Romania (2009), Germany (2010), Bulgaria (2010), Cyprus (2011) and the Czech Republic (2011) ruled the national transpositions of the Directive unconstitutional finding that the invasion of citizens’ private life was unproportional. A similar challenge is currently under way in Belgium.. One of the most controversial sections in the Directive is the obligation on telcom operators and Internet access providers to ensure that their subscribers’ data “are retained for periods of not less than six months and not more than two years from the date of the communication” in order “to ensure that those data are available for the purpose of the investigation, detection and prosecution of serious crime”.

These measures were so heavily criticised not least because effective alternative measures of data preservation, that are targeted and thus much more proportional, were already in place in dozens of countries. These measures call on technical intermediaries to preserve specific data and communicate technical data in their possession to authorities within the framework of an investigation³See EDRi’s Shadow Evaluation Report on the Data Retention Directive (2006/24/EC)..

The decision came in response to cases brought by the High Court of Ireland and the Austrian Verfassungsgerichtshof (constitutional court) requesting the Court of the European Union to examine the validity of the Data Retention Directive. In a press release, the Court stated today that in its opinion, “the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data”.

This ruling has an erga omnes effect which means that the decision does not just rule on the cases of Ireland and Austria, but extends to all European countries thus obliging some member states to reform their national legislation in order to ensure that it complies with today’s ruling. In France, this decision will directly affect the measures of data retention imposed on telecom operators [fr] (specifically those measures contained in the “loi de programmation militaire”) and those on hosting services [fr].

“This landmark decision is a victory for all defenders of privacy who have been fighting mandatory data retention across Europe since 2006 against the bulk retention of communications. Following a year of intense debate on mass surveillance, the EU Court of Justice makes clear that laws adopted in the name of the war on terror have led to unacceptable violations of privacy. This ruling is an invitation for everyone to continue the fight against surveillance by all appropriate means, be they technical, political or legal. One legislative step at a time, our governments had drifted away from the rule of law and now is the time to remind them that fundamental rights are the cornerstones of our democracies and non-negotiable” concluded Félix Tréguer, co-founder of La Quadrature du Net.