Data Retention in Cyprus in the Light of EU Data Retention Law

Abstract

Listen

Translate article

The chapter aims at describing the Cypriot data retention regime contained in Law 183(I)/2007, which transposes the Data Retention Directive into Cyprus law, as developed through case law from the transposition of the Directive to a very recent Supreme Court judgement. The latter judgement seems capable of putting an end to the wrong direction towards which case law has been heading so far and marking the beginning of a new era of data retention. The chapter starts with the period beginning with the introduction of Law 183(I)/2007 and ending with the 2014 CJEU ruling annulling the Data Retention Directive, and then proceeds with the period beginning with the said ruling and finishing with the 2018 Supreme Court judgement. It is demonstrated that the case law has wrongly regarded Law 183(I)/2007 as having remained unaffected by the annulling CJEU ruling and has thus continued upholding court orders allowing access to retained data even after a more recent CJEU judgement in which a general and indiscriminate data retention obligation has explicitly been stated to be incompatible with the EU Charter. The chapter finishes with a discussion on the possible practical effects of the 2018 Supreme Court judgement on data retention in Cyprus as well as on the possible upcoming amendments at national and the EU level, which should be expected to clearly set the boundaries of data retention and establish legal certainty. It should however been clarified that this chapter is based on the state of the relevant law as of April 2018. Developments have taken place during the publication process which prevented or delayed the change that the present author illustrates as possible following the 2018 Supreme Court decision. More specifically, the certiorari application filed in context of the relevant case has been withdrawn and the state of the law regarding data retention in Cyprus has remained unchanged. However, the matter is currently pending before the Supreme Court of Cyprus sitting as a full bench court and remains to be seen whether there will be a change of approach. It is hoped that a development at EU level, namely the decision of the CJEU in C-207/16 Ministerio Fiscal should not be taken as entailing a deviation of the European Court from its previous case law; said decision concerns a very specific question relating to access to data only and the CJEU expressly emphasizes in paragraph 49 of its judgement that the question before it did not concern with the legality of the retention of the data at all.