EU data retention directive thrown out by European Court

A European Union directive that required telecom operators to retain data for two years has been deemed “invalid”, Brussels’ highest court ruled today.

The European Court of Justice (ECJ) declared the directive invalid, saying it “entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data.”

In its ruling, the court said: “The fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the persons concerned a feeling that their private lives are the subject of constant surveillance,” it said.

The case arose after Digital Rights Ireland launched a court action against the State in 2006 that questioned the legality of Irish data-retention legislation requiring phone companies and internet service providers to gather data about customer locations, calls texts and emails, and store that information for up to two years.

Brought by McGarr Solicitors, the case challenges the constitutionality and the implementation of Ireland’s legislation, both the Criminal Justice (Terrorist Offences) Act 2005 and the State’s 2006 implementation of the EU data-retention directive (2006/24/EC).

In 2012 the High Court referred the case to the ECJ, asking for an opinion on the validity of the EU directive.

Last July the case was heard by the ECJ, coupled with a related Austrian case and in mid-December, following normal procedure, the ECJ’s advocate general Pedro Cruz Villalón presented his advisory legal opinion on the case, which recommended the directive be overturned.

Mr Cruz Villalón advised that the controversial 2006 directive was unlawful and incompatible with the Charter of Fundamental Rights.

Following the ECJ’s judgment, Digital Rights Ireland’s case against the State’s legislation will now be allowed to proceed.

TJ McIntyre, chairman of the organisation, welcomed the ECJ’s decision.

“This is the first assessment of mass surveillance by a supreme court since the Snowden revelations. The ECJ’s judgement finds that untargeted monitoring of the entire population is unacceptable in a democratic society,” he said.

Ireland’s Data Protection Commissioner’s office has welcomed the decision by the European Court of Justice (ECJ) on the data retention directive.

Ultan O’Carroll, technology adviser with the office, said the ruling was to be welcomed because there was a “balance and proportionality to be struck” between rights and law enforcement which “I think the commissioner believed was not there before”.

He was speaking at an event on data protection and cyber-security organised by the Irish Internet Association at the Science Gallery in Dublin.

Mr O’Carroll said a conversation needed to be had around the balance to be struck between personal privacy and law enforcement and when people’s phone and internet data could be accessed for those purposes.

He said issues coming up in the future, which the commissioner’s office would be involved in, included the ‘Internet of Things’ and smart meter reading, as well as big data and anonymity.