The ECJ confirms the stance it adopted in declaring the Data Retention Directive invalid in 2014.
Laws against the ePrivacy Directive are not permitted: On 6 October 2020, the European Court of Justice decided on three cases related to data retention laws, which were brought before tribunals in Belgium, France, and the UK, respectively. It considered that any legislation requiring telecoms operators to retain traffic and location data, and to forward it to national authorities, falls within the scope of the ePrivacy Directive which guarantees the confidentiality of electronic communications. Since the Directive does not permit exceptions to that principle to become the rule, member states cannot adopt legislation that restricts the scope of those rights.
Data retention measures must be proportionate: The ECJ conceded that data retention measures can be adopted, however they need to comply with the Charter of Fundamental Rights of the European Union, and respond to the principle of proportionality. These arguments are similar to those the ECJ used in 2014, to strike down the Data Retention Directive. An exception can occur when a state is facing a serious threat to national security, and adopts measures that are limited in time and subject to effective review by a court or an independent administrative body.
The UK could be affected by the decision: The ECJ’s ruling could have consequences on the future relationship between the EU and the UK with regard to data transfers. Since the UK is leaving the EU, it will be free to adopt data retention rules that disregard the EU framework and today’s decision. However, this could have consequences on whether the European Commission will consider the UK an adequate destination for personal data coming from the EU.
