National Courts Must Assess Legality Of General Data Retention Obligation

On 21 December 2016, the Court of Justice of the European Union ("ECJ") handed down a judgment concerning the interpretation of Article 15(1) of Directive 2002/58/EC on privacy and communications ("E-Privacy Directive") with respect to the national laws governing the retention of traffic and location data collected by service providers. The judgment was given in response to requests for preliminary rulings from Swedish and UK courts in two proceedings: Tele2 Sverige AB v. Post-och telestyrelsen (C-203/15) and Secretary of State for the Home Department v. Watson, et al. (C-698/15) ("Judgment").

The Judgment follows the 2014 case Digital Rights Ireland (C-293/12 and 594/12), in which it was held that the data retention obligation in Directive 2006/24/EC of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC ("Data Retention Directive") disproportionately interfered with the individual rights enshrined in Articles 7 and 8 of the EU Charter on Fundamental Rights ("EU Charter") (See VBB on Belgian Business Law, Volume 2014, No. 4, p. 13-14, available at www.vbb.com). As a result, the ECJ invalidated the Data Retention Directive.

Following this invalidation, the Swedish and UK courts asked the ECJ whether national legislation implementing the Data Retention Directive would also run counter to the e-Privacy Directive and the EU Charter.

In line with its prior judgment in Digital Rights Ireland, the ECJ reiterated that EU law prohibits generalised and indiscriminate surveillance, and that data concerning communications may be just as sensitive as their content because when taken as a whole it can reveal the identities of the individuals concerned, as well as details of their private lives. Based on this understanding, the ECJ observed that Member States might nonetheless have a lawful interest in retaining specific data. However, compliance with EU law requires that such an interest should be specifically mentioned in Article 15(1) of the e-Privacy Directive and its importance should be commensurate with the gravity of the intrusion on the individuals' privacy. Moreover, any measure is only legitimate insofar as the data involved is limited to the means, persons, and timeframe that are strictly necessary.

The ECJ outlined the specific conditions that Member State legislation on...