The Court of Justice declares the Data Retention Directive to be invalid

The European Court of Justice determined with regard to the Data Retention Directive 2006/24/EC:

‘It entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary.’[1]

According to the European Court of Justice the scope of the data in their entirety,

‘taken as a whole, may provide very precise information on the private lives of the persons whose data are retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, activities carried out, social relationships and the social environments frequented.’[2]

Among other things the Court is of the opinion that by adopting the Data Retention Directive, the EU legislature has ‘exceeded’ the limits imposed ‘by compliance with the principle of proportionality.’[3]

Furthermore, the European Court of Justice determined, that the retention of data required by the directive may be considered to be appropriate, although

‘the wide-ranging and particularly serious interference of the directive with the fundamental rights at issue is not sufficiently circumscribed to ensure that that interference is actually limited to what is strictly necessary.’[4]

There are three reasons to be mentioned:

1. Firstly, the directive covers, in a generalised manner, all individuals, all means of electronic communication and all traffic data without any ‘differentiation, limitation or exception being made in the light of the objective of fighting against serious crime.’[5]
2. Secondly, the directive does not lay down substantive and procedural conditions under which the competent national authorities may have access to the data and subsequently use them. In particular, the access to the data is not made dependent on the prior review by a court or by an independent administrative body.
3. Thirdly, so far as concerns the data retention period, the directive imposes – without making any distinction between the categories of data on the basis of the persons concerned – a period of at least six months. That period is set at between a minimum of six months and a maximum of 24 months, but the directive does not state the objective criteria on the basis of which the period of retention must be determined in order ‘to ensure that it is limited to what is strictly necessary.’[6]

The fact that the directive does not provide for sufficient safeguards to ‘ensure effective protection of the data against the risk of abuse and against any unlawful access and use of the data’[7], has also been criticised.

Finally the European Court of Justice passes criticism on the fact,

‘that the directive does not require that the data be retained within the EU.’[8]

Therefore, the directive does not withstand or fully ensure – as required by the Charter – the control of compliance with the requirements of protection and security by an independent authority. Such a control, carried out on the basis of EU law, is an essential component of the protection of individuals with regard to the processing of personal data.

Subsequently, the Austrian Constitutional Court had to consider the Austrian implementation (of April 2012) of the now repealed Directive. The Constitutional Court declared the retention of ‘unconstitutional’ and ‘disproportionate’. In the opinion of the Constitutional Court, the passages on data retention of the Telecommunications Act, the Criminal Procedure Code and the Security Police Act are conflicting with the fundamental right to privacy, and Article 8 of the European Convention on Human Rights and the right to private and family life. In future, the controversial form of data collection and storage is going to be over, however the deletion of previously saved data could take time due to technical requirements. In its decision, the Constitutional Court followed the European Court of Justice and determined a ’disproportionality’. After the announcement by the Federal Chancellor, the retention is finally repealed. Meanwhile, the Justice Department and Department of the Interior search for possible alternatives, in which the storage of connection data of a limited group of persons is possibly made if there is a strong suspicion present.