Teal blue graphic

European Parliament opinion clarifies the legality of EU data retention

The EU Data Retention Directive 2006/24/EC (the Directive) came into force in May 2006. It required all telecommunications data, including mobile, landline phones, fax and email, to be indiscriminately collected and retained by providers for a minimum of six months and up to two years.

In April 2014, in the joined cases of C-293/12 (Digital Rights Ireland) and C-593/12 (Seitlinger), the Court of Justice of the European Union (CJEU) held that the Directive was invalid as it did not comply with articles 7, 8 and 52(1) of the Charter of Fundamental Rights of the European Union (the Judgment).

Following the Judgment, the European Parliament (EC) Committee of Civil Liberties, Justice and Home Affairs (the Committee) requested a legal opinion from the EP's legal services department to determine the Judgment' impact on, amongst other things, the laws created by Member States when transposing the Directive, European Union laws and international agreements/schemes (such as the Passenger Names Records Agreements) relating to data retention.

The Opinion

The legal opinion created by EP's legal services department (the Opinion) was leaked to the public on 7 January 2015. The Opinion is comprehensive and responds in detail to all of the Committee's questions. Some important points to note are:

Current laws and agreements/schemes

The Opinion states that the ruling of invalidity of the Directive will not automatically affect the validity of any other Member State law, EU law or international agreement/scheme as they benefit from the "presumption of legality". This did however come with a caveat that such laws or agreements/schemes could be subject to future challenge in a similar manner to the Directive and their validity would need to be assessed on a case by case basis.

Proposed laws and agreements

According to the Opinion "All new and pending EU legislative proposals which concern the special context of "general programmes of surveillance" must clearly now take account of the reasoning of the Court of Justice…[and]…Great care must therefore be taken in such cases to ensure full respect of the Charter". In addition to this, the Opinion also states that the same considerations will also apply to any international agreements/schemes under negotiation.

Therefore, all proposed legislation, agreements or schemes relating to data retention which have an EU element to them shall need to take into account and should comply with the CJEU's considerations in the Judgment, including strict compliance with the Charter of Fundamental Rights of the European Union.

One of the most significant comments in the Opinion is that the EU legislature's ability to legislate in relation to data retention legislation may be reduced. This may lead to significant judicial review on all new EU legislation relating to data retention.

Options for Member States

As stated above, the Judgment does not make any Member State law related to the Directive invalid. It does however have a twofold affect on such Member State laws.

Firstly, Member States are free to repeal their laws relating to the retention of data as they are no longer obliged to have such laws under the Directive.

Secondly, if a Member State decides to retain any laws relating to the retention of data, it is highly likely that such laws will fall under the scope of the e-Privacy Directive and as such must comply with the Charter of Fundamental Rights of the European Union, in particular the principles of proportionality and necessity. This may lead to some necessary modifications.

It is interesting to note that a number of Member States' data retention laws were held to be invalid before the Judgment was made and a number have subsequently been held invalid. In the UK the Data Retention and Investigatory Powers Act 2014 (DRIP) was fast tracked into force on 17 July 2014 following the Judgment to replace the previous UK regulations on data retention which transposed the Directive into UK law. The DRIP has already received much criticism and is currently subject to a judicial review on its validity.

The full Opinion can be found here.

Conclusion

The Opinion seems to suggest that the immediate effects of the Judgment will only be felt if individual Member States take action to repeal, modify or create new legislation in light of the CJEU's comments. A number of Member States have already repealed such legislation and the UK has implemented new legislation so it seems possible that this trend might continue.

In the medium to long term there is likely to be a number of challenges to legislation and international agreements/data retention schemes. Organisations whose activities involve such schemes should keep abreast of any challenges or changes to such agreements/schemes.

Future EU legislation is likely to be in a significantly different form than the Directive and will have to take into consideration the respect of family and private life, the protection of personal data and the principles of proportionality and necessity. It will certainly be interesting to see how this area of law develops over the coming years.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at February 2015. Specific advice should be sought for specific cases; we cannot be held responsible for any action (or decision not to take action) made in reliance upon the content of this publication.

TLT LLP is a limited liability partnership registered in England & Wales number OC 308658 whose registered office is at One Redcliff Street, Bristol BS1 6TP England. A list of members (all of whom are solicitors or lawyers) can be inspected by visiting the People section of this website. TLT LLP is authorised and regulated by the Solicitors Regulation Authority under number 406297.

Insights & events View all