The Interpretaton of the Charter of Fundamental Rights of the EU in Data Retention Cases: national implementation and possible changes of policy

Tomáš Ochodek

doi:10.14712/23366478.2018.41

Abstract

The Court of Justice of the EU has, on several occasions, ruled on the compatibility of so-called data retention measures with the Charter of Fundamental Rights of the EU. In particular, it has ruled that general and indiscriminate retention of certain electronic communications data is incompatible with Articles 7 and 8 of the Charter, be it in the form of EU secondary law or national legislation. Many Member States, however, still keep in place data retention measures contrary to these rulings, and progress in implementing the rulings is slow. At the same time, the rulings of the Court of Justice can also be interpreted as requiring a fundamental change in how these measures are used and how effective they can be.

Highlights

In a series of cases starting with the Digital Rights Ireland judgement, the Court of Justice of the EU (Court, Court of Justice, or CJEU) has reviewed a number of regimes within the scope of EU law regulating mass retention of data
Art. 15 (1) of E-Privacy Directive in light of Arts. 7, 8, 11, and 52 (1) of the Charter, the Court clarified that the obligation to collect and retain communications data may only be justified by the objective of fighting serious crime.[35]. It found that the national legislation laid down the data retention obligation essentially similar to the invalid Data Retention Directive.[36]. It held that even an objective such as the fight against organised crime or terrorism ‘[...] fundamental it may be, cannot in itself justify that national legislation providing for the general and indiscriminate retention of all traffic and location data should be considered to be necessary for the purposes of that fight[.]’37 Instead, the Court stated, not precluding data retention altogether, that a targeted form of retention would not run into these objections.[38]
May 2016, pp. 1–88); It should be emphasised that the Commission proposal is obviously only a starting point in the legislative process and changes may be made, but at the time of the writing of this article, the Bulgarian Presidency of the Council already suggested some changes to the regime in the proposal of 4 May 2018: Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications), available from: http://data.consilium.europa.eu/doc/document/ST-8537-2018-INIT/en /pdf [accessed 8 May 2018]

Summary

INTRODUCTION

In a series of cases starting with the Digital Rights Ireland judgement, the Court of Justice of the EU (Court, Court of Justice, or CJEU) has reviewed a number of regimes within the scope of EU law regulating mass retention of data. These cases led to the invalidation of the Data Retention Directive and a finding of incompatibility of national data retention regimes which enable the bulk collection of data. This article presents the key points of the Court’s findings. Practices such as data retention on a scale as formerly required by the Data Retention Directive

DATA RETENTION

42 Commission Proposal of 10 January 2017

See for instance

TO REINVENT OR TO CIRCUMVENT

CONCLUSION