Brussels, 08/04/2014 (Agence Europe) - Following years of controversy and legal wrangling between the Commission and several member states, among them Germany, the Court of Justice of the EU on Tuesday 8 April definitively invalidated the directive on the retention of telecoms data, which allows operators to store (for at least 6 months and up to 24 months) the telephony data of their users. These data relate to calls, localisation data and other data necessary to identify the subscriber or registered user, for the purposes of fighting terrorism and serious crime.
This 2006 directive “interferes in a particularly serious manner with the fundamental right to respect for private life and to the protection of personal data” and this interference is not limited to what is absolutely necessary, the Court rules. This means that the directive has been inapplicable since 8 April, as the Court has ruled against it. The member states which have transposed it must now decide how to respond to this ruling and initially assess whether their transposition has gone beyond what is strictly required.
Because, as several Commission sources pointed out on Tuesday lunchtime, “it is not the principle of data retention which has been rejected, but the instruments used, such as the length of the retention and means of access, which have been judged disproportionate”.
The Court was asked to respond to two specific cases brought by the Irish High Court and the Austrian Verfassungsgerichtshof (Constitutional Court), calling upon it to examine the validity of the directive and its conformity with the Charter of Fundamental Rights (right to respect for privacy and right to data protection). In its judgment, it notes that the data in question were potentially extremely intrusive and “showed, amongst other things, with whom and how a subscriber or registered user carries out a communication, determines the time of the communication and the place from which it was made”, as well as revealing the frequency of the subscriber's communications. Taken as a whole, these data could “provide very specific indications about the private life of the individuals whose data have been retained, such as daily habits, permanent or temporary places of residence, daily travel or other travel, activities carried out, social relationships and social environments frequented”, the Court observes. And the fact that the retention and subsequent use of the data “are carried out without the subscriber or registered user being informed” does not help matters, as the directive ultimately creates a feeling of “constant surveillance”.
The principle of the directive, based on the retention of data for purposes of general interest and public security, is reasonable and legitimate in itself, the Court comments, but the way the directive organises this retention is illegal, as it is completely disproportionate. “The directive generally covers all individuals, electronic communication means and data on traffic without any differentiation, limit or exception being practised on the basis of the aim of fighting serious crime”, the Court states. Nor does the directive provide any “objective criteria to guarantee that the national competent authorities have access to the data and can use them only for the purposes of preventing, identifying or taking action against crimes which could be considered (…) serious enough to justify interference of this kind”. On the contrary, it “goes no further than to make general reference to the serious crimes” defined by each member state. The same vagueness surrounds the justifications over the retention period, with the Court also criticising the lack of recourse against abuse.
Commission found fault with the directive in 2011, but did not revise it
This negative opinion of the Court, however, does not come as a complete surprise to the Commission, which has been aware since 2011 that there were issues with its directive. In a report, Commissioner Cecilia Malmström recommended revision of the instrument, which was felt to contain shortcomings over fundamental rights. A revision was announced for the year 2012. Subsequently, the Commission stated that it felt it was more reasonable to wait for the end of the work on the overall reform of the data protection rules steered by Commissioner Viviane Reding (still being discussed now) and the work on the e-privacy directive. Curiously, the Commission opted to continue with the infringement cases launched against the member states which opposed this 2006 directive, such as Germany, in full awareness of the fact that the text did not fully comply with fundamental rights.
In a tweet on Tuesday, Commissioner Cecilia Malmström sought the moral high ground by welcoming a Court decision which “brings clarity and confirms the criticism of the Commission”. What will her next steps be? With the elections and the renewal of the Commission in the next few months, it will take several months for a new version of the text to see the light of day. In the meantime, the member states must check the compliance of their transposition with the Court ruling, as data retention for anti-terrorist purposes is still permitted. The College of Commissioners is soon to debate the infringement cases still in progress and whether these should be pursued. This judgment has been welcomed universally. “The retention of telephone data for no particular reason should be abolished throughout Europe”, said the Greens at the EP, describing it as “a veritable deliverance for civic rights”. The European Data Protection Controller (EDPC) also welcomed the move, as did Viviane Reding, who describes it as a “victory for the citizens” and stressed that “security and fundamental rights must go hand in hand”. (SP)