LEGAL CASE NOTE published on 03 Feb 2017 • Department / Unit Legal & Policy

Data retention reloaded

The Court of Justice of the EU determined on 21 December 2016 that the general and indiscriminate retention of data does not comply with EU fundamental rights to privacy, protection of data and the freedom of expression.

The Grand Chamber judgment in Tele2 Sverige and Tom Watson a.o. follows in the footsteps of the Court’s Digital Rights Ireland decision of April 2014, in which it had invalidated the EU Data Retention Directive.

Sweden and the UK, where electronic communications service providers were required to retain all of the traffic and location data of all their users and subscribers, referred to the CJEU to determine the exact scope of this ruling and the extent to which data retention is permissible. Both countries rely on an exception set out in the ePrivacy Directive, allowing Member States to restrict the Directive’s rights and obligations for the purpose of national security or criminal law enforcement.

The Court made clear that EU law sets limits to data retention, which must be targeted and governed by precise requirements that need to be outlined in national legislation.

The Court’s decision was rendered shortly before the Commission published a proposal for a revised ePrivacy Directive. The ePrivacy Directive regulates the processing of personal data and the protection of privacy in the electronic communications sector, covering, inter alia, the use of cookies to gain/gather data from end-users’ devices for the purpose of enhancing users’ Internet experience or providing personalised services. The Commission’s proposal retains said exception, applicable on grounds of national security and fighting serious crime.

Relevant Links

Judgment of the Court (Grand Chamber)
EBU Reply: ePrivacy

Contact detail

Anne-Catherine Berg
Senior Legal Counsel
+41 22 717 25 16
Jenny Weinand
Legal Counsel
+41 22 717 2420