The European Court of Justice (ECJ) has held that the Data Retention Directive (2006/24/EC) (the Directive) is invalid because the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality under Articles 7, 8 and 52(1) of the EU Charter of Fundamental Rights (the Charter).
The Directive provides that EU member states must adopt laws requiring communications service providers (CSPs) to retain, for a period of between six and 24 months, certain types of traffic, subscriber and location data generated or processed in providing services (Articles 3 and 6). Individual member states have an option to introduce longer periods where they face particular circumstances warranting an extension for a limited period (Article 12(1), the Directive).
The UK implemented the Directive through the Data Retention (EC Directive) Regulations 2009, which came into force on 6 April 2009 (see News brief "Data retention: regulations extended to apply to inernet data", www.practicallaw.com/7-385-4832). Access to communications data retained by CSPs is regulated by Part I of Chapter II of the Regulation of Investigatory Powers Act 2000.
Article 5(4) of the Treaty on European Union (TEU) provides that, under the principle of proportionality, the content and form of EU action must not exceed what is necessary to achieve the objectives of the TEU [and the Treaty on the Functioning of the European Union]. This means that the EU legislator must not enact laws if this is not necessary, appropriate or proportionate in a strict sense.
The European Convention on Human Rights (ECHR) and the EU Charter of Fundamental Rights (Charter) protect EU citizens' fundamental rights, including the rights to:
Respect for private life (Article 8, ECHR and Article 7, Charter).
Data protection (Article 7, Charter).
Freedom of expression (Article 10, Convention and Article 11, Charter).
Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others.
Following applications by an Irish campaign group and others, a number of questions concerning the compatibility of the Directive with Article 5(4) of the TEU, and with certain fundamental rights protected by the Charter, were referred to the ECJ.
The ECJ held that the Directive is invalid because the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter. The ECJ held that:
The retention of communications data under Articles 3 to 5 of the Directive, for the purpose of possible access to them by the competent national authorities, directly and specifically affects individuals' private life. Therefore, the Directive fell within the scope of Article 7 of the Charter. The ECJ also acknowledged the potential impact that data retention could have on individuals' exercise of the freedom of expression guaranteed by Article 11 of the Charter.
The data retention requirement imposed by Articles 3 and 6 of the Directive interfered with the rights guaranteed by Article 7 of the Charter. Since the Directive also provides for the processing of personal data, it interfered with the right to the protection of personal data guaranteed by Article 8 of the Charter. This interference was not justified.
The Directive did not comply with the proportionality principle.
The ECJ also criticised:
The EU legislature for adopting a measure that covered, in a comprehensive and generalized manner, all persons and all means of electronic communication, without any differentiation, limitation or exception being made in the light of its crime-fighting objective.
The Directive for failing to lay down any objective criterion or substantive and procedural conditions governing competent national authorities' access to the data and their subsequent use for the purposes of law enforcement and public security.
The Directive for failing to require member states to provide sufficient safeguards for data security, including cross-border transfers. Specifically, the Directive did not require the data to be retained within the EU, which made it impossible to control compliance with applicable EU data protection and data security requirements. This control must be exercised by an independent authority to protect individuals' data protection rights.
The ECJ‘s press release clarifies that the Directive is invalid from the date that it came into force. There is therefore currently no EU law mandating the retention of communications data. The Commission's view is that national legislation implementing the Directive will only have to be amended to the extent required by the ECJ‘s decision, and that member states' competence to adopt their own national data retention laws under Article 15(1) of the E-Privacy Directive (2002/58/EC) remains unaffected.
Of particular importance are the ECJ's comments on the need to store retained data within the EU to ensure oversight of compliance with applicable EU data protection and data security requirements by independent EU authorities in accordance with Article 8(3) of the Charter. This requirement will become very topical as difficult decisions are made on issues such as the future of the EU-US safe harbour arrangement, the data export provisions contained in the proposed EU Data Protection Regulation and the regulation of cloud computing services (see News brief "EU data protection regulations: the long road to reform", www.practicallaw.com/8-565-4665).
Case: Digital Rights Ireland and Seitlinger and others, Joined Cases C-293/12 and 594/12; Court of Justice of the European Union press release, 8 April 2014, http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf.
First published in the April 2014 issue of PLC Magazine and reproduced with the kind permission of the publishers. Subscription enquiries 020 7202 1200.