Equipo Nizkor - According to the Advocate General, Mr Cruz Villalon, the Data Retention Directive is incompatible with the Charter of Fundamental Rights.

Information
Bookshop \| Donate Derechos \| Equipo Nizkor

12Dec13

According to the Advocate General, Mr Cruz Villalon, the Data Retention Directive is incompatible with the Charter of Fundamental Rights

PRESS RELEASE No 157/13
Advocate General's Opinion in Joined Cases
C-293/12 Digital Rights Ireland
and C-594/12 Seitlinger and Others
He proposes, however, that the effects of the finding of invalidity should be suspended in order to enable the EU legislature to adopt, within a reasonable period, the measures necessary to remedythe invalidity found to exist
In his Opinion delivered today, Advocate General Pedro Cruz Villalon, takes the view that the Data Retention Directive |1| is as a whole incompatible with the requirement, laid down by the Charter of Fundamental Rights of the European Union, that any limitation on the exercise of a fundamental right must be provided for by law.
According to the Advocate General, the Directive constitutes a serious interference with the fundamental right of citizens to privacy, by laying down an obligation on the providers of telephone or electronic communications services to collect and retain traffic and location data for such communications |2|.
The Advocate General points out, in this regard, that the use of those data may make it possible to create a both faithful and exhaustive map of a large portion of a person's conduct strictly forming part of his private life, or even a complete and accurate picture of his private identity. There is, moreover, an increased risk that the retained data might be used for unlawful purposes which are potentially detrimental to privacy or, more broadly, fraudulent or even malicious. Indeed, the data are not retained by the public authorities, or even under their direct control, but by the providers of electronic communications services themselves. Nor does the Directive provide that the data must be retained in the territory of a Member State. They can therefore be accumulated at indeterminate locations in cyberspace.
In the light of that serious interference, the Directive should, first of all, have defined the fundamental principles which were to govern the determination of the minimum guarantees for access to the data collected and retained and their use. |3|
However, the Directive - which indeed regulates neither access to the data collected and retained nor their use - assigns the task of defining and establishing those guarantees to the Member States. Accordingly, the Directive does not comply with the requirement, laid down by the Charter, that any limitation on the exercise of a fundamental right must be provided for by law, as that requirement is more than just a purely formal one. Thus, when the European Union legislature adopts, as in the case of the Data Retention Directive |4|, an act imposing obligations which constitute serious interference with the fundamental rights of citizens of the Union, it must assume its share of responsibility by defining at the very least the principles which must govern the definition, establishment, application and review of observance of the necessary guarantees. It is this very regulation which makes it possible to assess the scope of what the interference with the fundamental right entails in practical terms and which may, therefore, determine whether or not the interference is constitutionally acceptable.
Advocate General Cruz Villalon finds, next, that the Data Retention Directive is incompatible with the principle of proportionality |5| in that it requires Member States to ensure that the data are retained for a period whose upper limit |6| is set at two years.
He considers that the Directive pursues an ultimate objective that is perfectly legitimate, that is to say, the objective of ensuring that the data collected and retained are available for the purpose of the investigation, detection and prosecution of serious crime, and may be regarded as appropriate and even, subject to the guarantees with which it should be coupled, as necessary for achieving that objective.
However, the Advocate General has not found, in the various views submitted to the Court of Justice defending the proportionality of the data retention period, any sufficient justification for not limiting the data retention period to be established by the Member States to less than one year.
So far as concerns the temporal effects of the finding of invalidity, the Advocate General proposes, after weighing up the various competing interests, that the effects of a finding that the Directive is invalid should be suspended pending adoption by the EU legislature of the measures necessary to remedy the invalidity found to exist, but such measures must be adopted within a reasonable period.
He observes, in this regard, that the relevance and even urgency of the ultimate objectives of the limitation on fundamental rights at issue are, on the one hand, not in doubt. The findings of invalidity, on the other hand, are of a very particular nature. First, the Directive is invalid as a result of the absence of sufficient regulation of the guarantees governing access to the data collected and retained and their use (quality of the law), an absence which nevertheless may have been corrected in the implementing measures adopted by the Member States. Secondly, the Member States have, in general, as is apparent from the information provided to the Court, exercised their powers with moderation with respect to the maximum period of data retention.
Today's Opinion is delivered in proceedings relating to two references for a preliminary ruling, made by the High Court of Ireland and the Verfassungsgerichtshof (Constitutional Court, Austria) respectively.
The High Court must decide a case between Digital Rights Ireland Ltd - a limited liability company whose statutes specify that its object is to promote and protect civil rights and human rights, in particular in the field of modern communication technologies - and the Irish authorities. In that case, Digital Rights, which states that it is the owner of a mobile phone, submits that the Irish authorities have unlawfully processed, retained and exercised control over data related to its communications.
The Verfassungsgerichtshof must decide three cases brought by the Province of Carinthia, Mr Michael Seitlinger and 11 130 applicants respectively, who submit that the Austrian Law on telecommunications is contrary to the Austrian Constitution.
NOTE: The Advocate General's Opinion is not binding on the Court of Justice. It is the role of the Advocates General to propose to the Court, in complete independence, a legal solution to the cases for which they are responsible. The Judges of the Court are now beginning their deliberations in this case. Judgment will be given at a later date.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court's decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
[Source: Court of Justice of the European Union, Press and Information, Luxembourg, 12Dec13]

Notes:
1. Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ 2006 L 105, p. 54). [Back]
2. But not, on the other hand, to collect and retain their content, that is to say, the information communicated itself. [Back]
3. Thus, the European Union legislature should, in particular, have provided a more precise description than 'serious crime' as an indication of the criminal activities which are capable of justifying access of the competent national authorities to the data collected and retained. The European Union legislature should have guided the Member States' regulation of authorisation to access the data collected and retained, by limiting access, if not solely to judicial authorities, at least to independent authorities, or, failing that, by making any request for access subject to review by the judicial authorities or independent authorities and it should have required a case-by-case examination of requests for access in order to limit the data provided to what is strictly necessary. Similarly, it could have been expected to lay down the principle that Member States may provide for exceptions preventing access to retained data in certain exceptional circumstances or may prescribe more stringent requirements for access in situations in which access may infringe fundamental rights guaranteed by the Charter, as in the context of the right to medical confidentiality. It should have established the principle that the authorities authorised to access the data are required, first, to erase them once their usefulness has been exhausted and, second, to notify the persons concerned of that access, at least retrospectively, after the elimination of any risk that such notification might undermine the effectiveness of the measures justifying the use of those data. [Back]
4. The Advocate General points out, in this regard, that the Data Retention Directive is not a directive which simply harmonises provisions invariably adopted by the majority of the Member States, but itself establishes a data retention obligation. [Back]
5. As laid down by the Charter. In addition, the Advocate General examines the Directive in the light of proportionality within the meaning of Article 5(4) of the Treaty on European Union. [Back]
6. The Directive also provides that the retention period may not in any event be less than six months. [Back]

Privacy and counterintelligence
This document has been published on 23Apr14 by the Equipo Nizkor and Derechos Human Rights. In accordance with Title 17 U.S.C. Section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes.