AEDH

The Invalidation of the Data Retention Directive in 2014 would promote human rights but according to Eurojust would threaten the fight against serious crimes

This post is also available in: frFrançais (French)

In 2006, a European Union Directive was adopted obliging telecoms and internet services providers to retain traffic and location data and other information for a period between six months and two years, which could be used to fight serious crime in the EU[1]. The main aim of the directive was to harmonize the different regulations within the EU. As it was a directive, it had to be transposed by each EU member state, which led the civil rights organisation, Digital Rights Ireland, to declare that the measures adopted to implement the directive served as a basis for mass surveillance, violating fundamental human rights[2]. As a result, following the case involving Digital Rights Ireland, the CJEU[3] invalidated the directive in April 2014[4]. Following this, Eurojust, the European Union (EU) agency responsible for judicial cooperation in criminal matters, has carried out an analysis of EU Members States’ legislation and current challenges on data retention. Subsequently, the CJEU was again seized of a case, Tele2 and Watson[5], relating to the retention of data by the providers of electronic communications services. In this context, Eurojust conducted an analysis of the EUCJ judgement and its impact on judicial cooperation in criminal matters within the EU, with the assistance of the European Judicial Cybercrime Network.

The CJEU judgement

According to the CJEU, such a directive allowed the data to be retained and made it possible, in particular, to: know the identity of the person with whom a subscriber or registered user has communicated and by what means, to identify the time of the communication as well as the place from which that communication took place and to know the frequency of the communications of the subscriber or registered user with certain persons during a given period[6]. Those data provide very precise information on the private lives of the persons whose data are retained, such as the habits of everyday life, permanent or temporary places of residence, daily movements, activities carried out, social relationships and the social environments frequented. According to the court, by requiring the retention of these data and by allowing the competent national authorities access to these data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data. Therefore, by invalidating the data retention directive, the court ruled in favour of personal data protection[7].

In its judgement, the CJEU advocates for general and indiscriminate retention of traffic data and location data. However, the court provides that member states are free to regulate data retention in a targeted manner for the purpose of fighting serious crime. Such retention should be limited to what is strictly necessary to this end[8].

Concern and challenges

The invalidation of the directive raises new concerns, especially in terms of criminal investigations, prosecutions and judicial cooperation. Indeed, according to Eurojust, the EU landscape in terms of data retention regimes is disharmonious and the lack of common requirements may be a real threat in the fight against serious crime; “the fragmented regulation in place undermines criminal investigations and prosecutions as well as judicial cooperation in the fight against serious crime. […] there [have] been a significant number of challenges to the admissibility of evidence in criminal proceedings in approximately a year from the judgement […]. In addition, several states currently have no defined legal data retention framework upon which law enforcement and judicial authorities may efficiently and rapidly operate[9]. More precisely, Eurojust findings demonstrate the lack of a common framework within the EU member states when it comes to data retention; the vast majority of countries do have specific legislation on mandatory data retention for law enforcement purposes, but some country does not. No country appears to have the legislation containing specific targeting criteria stipulated by the CJEU (i.e., data retention permitted in a targeted manner for the purpose of fighting serious crime). Most countries having mandatory data retention rules for law enforcement purposes have defined times limitations within which data can be retained, varying from several weeks up to three years[10].

Overall, the CJEU stood in favour of personal data protection by invalidating the data retention directive. But there is still a lot to do in order to come up with a balanced and harmonized common framework for data retention rules. The unavailability of data, especially when it comes to collection of evidence, is one of the main concerns expressed by the respondents that could negatively impact ongoing investigations and prosecutions. It gives rise to even more concern given the current context of possible terrorist attacks[11]. Indeed, the invalidated data retention directive was adopted in a context of terrorist attacks (Madrid in 2004 and London in 2005) that led the Member States to shift in favour of a high level of security and was adopted in a very fast legislative process[12].

AEDH is therefore pleased that the CJEU has invalidated a directive that infringes on fundamental rights. Regarding the Eurojust conclusions calling for the establishment of a common and harmonized framework for data retention and access at EU level, AEDH considers that the main problem in the fight against organized crime and terrorism is the reluctance of law enforcement and intelligence agencies to exchange information.


[1] Euractiv, EU Court slams Data Retention Directive, April 2014 – https://www.euractiv.com/section/justice-home-affairs/news/eu-court-slams-data-retention-directive/

[2] Global Freedom of Expression, Columbia University, Digital Rights Ireland, 2015 –https://globalfreedomofexpression.columbia.edu/cases/ecj-digital-rights-ireland-ltd-v-minister-for-communications-marine-and-natural-resources-c%E2%80%9129312-and-c%E2%80%9159412-2014/

[3] Court of Justice of the European Union

[4] Conseil de l’Union européenne, Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, November 2017 – http://www.statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf

[5] CJUE, Les États membres ne peuvent pas imposer une obligation générale de conservation de données aux fournisseurs de services de communications électroniques, December 2016 – https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-12/cp160145fr.pdf

[6] CJUE, The Court of Justice declares the Data Retention Directive to be invalid, April 2014 – https://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf

[7] CJUE, The Court of Justice declares the Data Retention Directive to be invalid, April 2014 –https://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf

[8] Council of the European Union, Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, November 2017 – http://www.statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf

[9] Council of the European Union, Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, November 2017 – http://www.statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf

[10] Council of the European Union, Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, November 2017 http://www.statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf

[11] Council of the European Union, Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, November 2017 http://www.statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf

[12] Euractiv, EU Court slams Data Retention Directive, April 2014 –

https://www.euractiv.com/section/justice-home-affairs/news/eu-court-slams-data-retention-directive/

webmin