The Court of Justice of the European Union confirmed in a long-awaited judgment on Tuesday 6 October that a Member State cannot require online communication services to systematically collect metadata from their users. However, it has clarified a number of derogations from this principle, in particular in the event of a serious threat to national security or terrorist activity.
“Today’s judgment is a serious blow to the laws in France, the UK, and Belgium and to other current data...