The Article 29 Working Party (WP29), an independent European advisory on data protection and privacy, has published a statement in which it welcomes the ruling of the CJEU, of 8 April 2014, which invalidates the Data Retention Directive (2006/24/EC). The CJEU found that the Directive entails a wide-ranging and particularly serious interference with the fundamental rights to privacy and to the protection of personal data, and fails to sufficiently circumscribe such interference to ensure that it is limited to what is strictly necessary for the purpose of fighting serious crime, thereby leaving it too open for Member States to decide on the scope of data retention.
National measures based on the invalidated Directive, such as the Communications (Retention of Data) Act 2011 in Ireland, are not directly affected by the ruling. However the WP29 highlights that Member States must comply with the requirements of Article 15(1) of the E-Privacy Directive (2002/58/EC), which requires, inter alia, any data retention to be necessary, appropriate and proportionate for the prevention, investigation, detection and prosecution of criminal offences.
The ruling demonstrates the importance that the CJEU affords to the privacy and data protection rights of individuals, but its practical effects remain to the seen. The WP29 calls on the European Commission to provide, without further delay, clear guidance on the consequences of the CJEU’s judgment, both at European and at Member State level.
Working Party Statement on the ruling of the CJEU which invalidates the Data Retention Directive