The two judgments of the European Court of Justice in the four cases of Privacy International, La Quadrature du Net and Others, French Data Network and Others and Ordre des Barreaux francophones et germanophone and Others: The Grand Chamber is trying hard to square the circle of data retention

Abstract

On 6 October 2020, the Grand Chamber of the European Court of Justice rendered two landmark judgments in Privacy International, La Quadrature du Net and Others, French Data Network and Others as well as Ordre des barreaux francophones et germanophone and Others. The Grand Chamber confirmed that EU law precludes national legislation which requires a provider of electronic communications services to carry out the general and indiscriminate transmission or retention of traffic data and location data for the purpose of combating crime in general or of safeguarding national security.In situations where a Member State is facing a serious threat to national security which proves to be genuine and present or foreseeable, such State may however derogate from the obligation to ensure the confidentiality of data relating to electronic communications by requiring, by way of legislative measures, the general and indiscriminate retention of this data for a period which is limited in time to what is strictly necessary but which may be extended if the threat persists.11Joined Cases 511/18, C-512/18 and 520/18 La Quadrature du Net and Others [2020] paras 168 and 177. In respect of combating serious crime and preventing serious threats to public security, a Member State may also provide for the targeted retention of this data and its expedited retention. Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority. It is likewise open to a Member State to carry out a general and indiscriminate retention of IP addresses assigned to the source of a communication where the retention period is limited to what is strictly necessary or even to carry out a general and indiscriminate retention of data relating to the civil identity of users of means of electronic communication. In the latter case, the retention is not subject to a specific time limit.