The Court of Justice of the European Union (CJEU) has ruled that the Data Retention Directive 2006/24/EC (Directive) is invalid.
The Irish High Court (in Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources & Ors C-293/12) and the Austrian Constitutional Court (in Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and others, C 594/12), asked the CJEU to examine the validity of the Directive.
The Directive requires telephone and internet service providers to retain details of internet and call data for 6 to 24 months, as well as related data necessary to identify the subscriber or user, in order to ensure that the data are available for the purpose of the prevention, investigation, detection and prosecution of serious crime.
The CJEU followed the Opinion of Advocate General of the CJEU delivered on 12 December 2013 (see my earlier blog entitled ‘Data Retention Directive is incompatible with the Charter of Fundamental Rights’). It found that the Directive “entails a wide-ranging and particularly serious interference” with the Charter of Fundamental Rights, in particular, the rights to respect for private life and to the protection of personal data, “without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary“.
The CJEU held that by adopting the Directive, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality.
The data to be retained makes it possible, in particular, (1) to know the identity of the person with whom a subscriber or registered user has communicated and by what means, (2) to identify the time of the communication as well as the place from which that communication took place, and (3) to know the frequency of the communications of the subscriber or registered user with certain persons during a given period.
Given that the CJEU has not limited the temporal effect of its judgment, the declaration of invalidity takes effect from the date on which the Directive entered into force. This means that national laws implementing the Directive will now be open to challenge in national courts.
Digital Rights Ireland’s case challenging mass surveillance under the Directive, which was implemented in Ireland by the Communications (Retention of Data) Act 2011, will now be allowed to continue before the Irish High Court.