CJEU annuls Data Retention Directive
The decision stems from references to the CJEU by the High Court in Ireland and the Austrian Constitutional Court as to the validity of Directive 2006/24/EC (the "Directive"), which provides for the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks. In his opinion of 12 December 2013, Advocate General Villalón recommended that the Directive be declared invalid. The CJEU has now followed that recommendation.
In its judgment, the Court first considered whether the obligations under the Directive for certain entities to retain and, if necessary disclose, certain data listed within the Directive, engaged the fundamental rights protected by the Charter. Noting that "those data…may allow very precise conclusions to be drawn concerning the private lives of persons whose data has been retained", it held that the measures in question indeed raised questions as to the respect for private life and communications as protected by Article 7 of the Charter, the protection of personal data under Article 8, and freedom of expression under Article 11 (although the CJEU considered that it was ultimately unnecessary to rule on the Article 11 point).
The Court went on to hold that the Directive's measures amounted to an interference with those rights, and that that interference was "particularly serious". The Court pointed, among other things, to the fact that the retention and use of data without the subject's knowledge was "likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance".
Where there is an interference with Charter rights, Article 52(1) provides, among other things, that the interference must be proportionate to the objectives of general interest that the measures pursue. Notwithstanding its conclusion that the "material objective" of the Directive – essentially the prevention of crime – was genuinely one of "general interest", the Court found the interference with Articles 7 and 8 to be disproportionate. Highlighting the importance of respect for privacy and the protection of personal data, and the stricter standard of review that should be applied by the Court as a result, the Court adopted a two-stage assessment of proportionality.
The CJEU held that the retention of data was an appropriate means of attaining the crime prevention objective. However, the Court went on to note, among other things, that the measures in question affected everyone using electronic communications – "practically the entire EU population" – regardless of whether they were even indirectly involved in crime, and that the Directive contained insufficient safeguards for the protection of the data that was retained. These measures, it considered, went beyond what was strictly necessary, and were therefore disproportionate:
[the Directive] entails a wide-ranging and particularly serious interference with… fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary.
The Advocate General's opinion had already caused quite a stir, and the CJEU's endorsement of his recommendation is likely to provoke yet further discussion among practitioners as to the Court's willingness to strike down legislative measures.
Of particular interest in the Court's proportionality analysis was its focus on the material objective of the measure, rather than the "aim" which is actually stated within the legislation. The Court found that the provisions of the Directive were appropriate (albeit excessive) on the basis that they assisted crime prevention, rather than internal market harmonisation which was the stated aim of the Directive and the basis for its adoption.
Further, this decision should not be viewed as declaring open season on other EU legislation, even where there is a prima facie interference with Charter rights. In an era of ever-increasing public anxiety about data protection and privacy rights, the Court was clearly mindful of the perceived importance of those rights. However, in areas of a more socio-political nature, the margin of appreciation afforded to the legislature is likely to be greater.