The European Court of Justice (the “ECJ”), in its judgment delivered on 8 April 2014, has declared invalid the EU Data Retention Directive (2006/24/EC) (the “Directive”). The matter of validity of the Directive was referred to the ECJ by two joined cases, one from Ireland and one from Austria. The issue prompting these cases was the question surrounding the legality of national measures concerning the retention of data relating to electronic communications.
In the wake of the London bombings of summer 2005, data retention was a priority for the Council of Europe, as a means of satisfying an objective of general interest, namely public security. The Irish and Austrian courts asked the ECJ to rule on whether data retention laws, drafted in accordance with Directive 2006/24, were compatible with the fundamental right to respect for private life and the fundamental right to the protection of personal data, as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
The ECJ found a number of reasons why the extent and seriousness of the interference with those fundamental rights were cause for declaring the Directive invalid. These were that the Directive:
- generalises all persons, all electronic communication and all traffic data with no differentiation, limitations or exceptions;
- fails to lay down any objective criterion for use and access of the data by national authorities, for the purposes of prevention, detection or criminal prosecutions concerning offences considered sufficiently serious to warrant the interference;
- fails to provide objective criteria to determine the basis of the period of retention between six and 24 months in order to ensure it is limited to the proportional necessity;
- fails to provide sufficient safeguards to protect data against risk of abuse or unlawful access; and
- does not require that the data be retained within the EU. This could potentially take the data outside the scope of EU data protection laws.
This ruling will now be applied to the case brought by Digital Rights Ireland before the High Court in Ireland and as such data retention laws will have to be revised on a national and European level. This case therefore highlights the increasing importance with which data protection laws are viewed within the European Union.