EU Data Retention Directive Declared In Violation Of EU Law

By Monika Ermert for Intellectual Property Watch

European data retention has to be rolled back after a clear judgment of the Grand Chamber of the European Court of Justice in Luxemburg today.

The highest EU Court ruled that the directive which obliges telecommunication providers to collect and store communication traffic and location data for up to 2 years, depending on the implementation in the member states, is invalid.

The press release from the court is available here [pdf].

The directive had been challenged in separate cases by Digital Rights Ireland, several Austrian citizens, plus a group of over 11,000 citizens supporting the organisation AKVorrat.

While the judges acknowledge in the ruling that data retention might be a tool to help fight organised crime, they nevertheless rejected the proportionality of limiting every EU citizen’s rights to privacy (Article 7 of the EU Charter of Fundamental Rights) and data protection (Article 8).

The Court in this ruling went beyond the arguments of the General Prosecutor, who in December last year mainly pointed to the lack of limitations with regard to access and security of the collected data. Also, the Court decided there can be no intermediate solution to allow for preparation of a new instrument, but declared the directive null and void. Member states now have to react and address the implementations to national law.

The parties and civil rights organisations in Europe welcomed the decision, calling it a “great day” for the civil liberties. “This case is a profound statement of European values by Europe’s top court. The court has rejected the principle of mass surveillance of EU citizens without suspicion as incompatible with the Charter of Fundamental Rights. It will be up to individual member states to now ensure their domestic law is in compliance with the ECJ’s judgment,” said a statement from McGarr Solicitors, who represent Digital Rights Ireland.