The Advocate General of the Court of Justice of the European Union (CJEU) has delivered an Opinion that the Data Retention Directive 2006/24/EC (Directive) is incompatible with the Charter of Fundamental Rights. However, the Advocate General proposed that the effects of the finding of invalidity should be suspended in order to enable the EU legislature to adopt, within a reasonable period, the measure necessary to remedy the invalidity found to exist.
The Directive requires telephone and internet service providers to retain details of internet and call data for not less than 6 months and not more than 2 years, in order to ensure that the data is available for the purpose of the investigation, detection and prosecution of serious crime. The Advocate General found that the Directive constitutes “a serious interference” with the right to privacy. He noted that the use of such data “may make it possible to create a both faithful and exhaustive map of a large portion of a person’s conduct strictly forming part of his private life, or even a complete and accurate picture of his private identity.”
The Advocate General also highlighted the risk that “the retained data might be used for unlawful purposes which are potentially detrimental to privacy or, more broadly, fraudulent or even malicious.” Furthermore, the data are not retained by public authorities themselves, nor under their direct control, but by the telephone and internet service providers themselves.
The Attorney General held that in light of the serious interference of the Directive with the right of citizens to privacy, it should have defined the principles which were to govern the determination of access to the data collected and retained and their use. Instead the Directive assigned the task of defining and establishing those principles to the Member States.
In addition, the Attorney General found that the Directive was incompatible with the principle of proportionality by requiring Member States to retain data for up to two years. He could not find any sufficient justification for not limiting the data retention period to less than one year.
Whilst the Advocate General’s Opinion is not binding on the CJEU, his Opinion is followed in the majority of cases. The Judges of the CJEU are now beginning their deliberations in this case, and judgment will be given at a later date.
Click here to view my earlier blog on the Communications (Retention of Data) Act 2011 which implements the Directive in Ireland.