The Court of Justice of the EU determined on 21 December 2016 that the general and indiscriminate retention of data does not comply with EU fundamental rights to privacy, protection of data and the freedom of expression.
The Grand Chamber judgment in Tele2 Sverige and Tom Watson a.o. follows in the footsteps of the Court’s Digital Rights Ireland decision of April 2014, in which it had invalidated the EU Data Retention Directive.
Sweden and the UK, where electronic communications service providers were required to retain all of the traffic and location data of all their users and subscribers, referred to the CJEU to determine the exact scope of this ruling and the extent to which data retention is permissible. Both countries rely on an exception set out in the ePrivacy Directive, allowing Member States to restrict the Directive’s rights and obligations for the purpose of national security or criminal law enforcement.
The Court made clear that EU law sets limits to data retention, which must be targeted and governed by precise requirements that need to be outlined in national legislation.