On 8 April 2014, the Court of Justice of the European Union declared the Data Retention Directive invalid. The case, Digital Rights Ireland, was brought against the Irish authorities and others. The court found that blanket data collection violated the EU Charter of Fundamental Rights, in particular the right to privacy in Article 8(1).
The Council’s Legal Services were reported to have said in closed session that paragraph 59 of the ruling “suggests that general and blanket data retention is no longer possible.”
What the directive demanded
Directive 2006/24/EC was passed on 15 March 2006. It ordered member states to hold the telecommunications data of all citizens, meaning phone and internet connections, for at least six months and at most twenty-four. Police and security agencies could ask for it. Among the details they could obtain were IP addresses and the time of use of every email, phone call and text message.
The catch: nothing in the text required a court to approve access.
The politics ran back to September 2005, when a plenary session on retaining telecommunications data was held under the UK presidency of the European Council and chaired by the British Home Secretary. The Council reached agreement on 1 and 2 December. Adoption followed in March 2006, under the Austrian presidency.
Physicians, journalists, privacy and human rights groups, unions, IT security firms and legal experts had all raised concerns.
Romania pushes back
Romania’s experience showed what the law looked like at national level. Its first transposition, Law 298/2008, was struck down by the Constitutional Court in 2009 for violating the constitutional rights to privacy, confidentiality of communications and free speech.
The European Commission responded in 2011 by suing Romania for failing to implement the directive and threatening a fine of 30,000 euros per day. Parliament passed a replacement in 2012, and President Traian Băsescu signed it in June. Romanian non-governmental organisations and the media nicknamed Law 82/2012 “the Big Brother law.”
The Constitutional Court declared that law unconstitutional too, on 8 July 2014, three months after the EU court’s ruling.
A legal opinion funded by the Greens-European Free Alliance in the European Parliament later concluded that blanket retention of data on people who are not under suspicion generally violates the Charter. It applied that finding both to national retention laws and to comparable EU schemes, including passenger name records and the Terrorist Finance Tracking Programme.
