Eurojust: No progress to comply with CJEU data retention judgements
A recently published Eurojust report on data retention in Europe confirms that EU Member States failed to make meaningful progress towards complying with fundamental rights standards, as clarified by the two Court of Justice of the European Union (CJEU) rulings banning blanket data retention.
The CJEU has delivered two rulings on mandatory data retention of traffic and location data (metadata) for electronic communications services. In the Digital Rights Ireland judgement of 8 April 2014 (joined cases C-293/12 and C-594/12), the Data Retention Directive 2006/24/EU was declared invalid. This was followed by the Tele2 judgement of 21 December 2016 (joined cases C-203/15 and C-698/15), where the CJEU ruled that Article 15(1) of the e-Privacy Directive, read in the light of the Charter of Fundamental Rights of the European Union, precludes national laws which require general and indiscriminate retention of metadata (blanket data retention). Only targeted data retention is allowed under EU law.
A month after the Tele2 ruling, the Council Legal Service sent an analysis of the judgement to Member States, where it concluded that ”a general and indiscriminate retention obligation for crime prevention and other security reasons would no more be possible at national level than it is at EU level, since it would violate just as much the fundamental requirements as demonstrated by the Court’s insistence in two judgements delivered in Grand Chamber”. This was a clear message to Member States who had hitherto claimed that the annulment of the Data Retention Directive in April 2014 did not affect their national data retention laws. When the analysis of the Legal Service was released to the public on 27 March 2017 (Council document 5884/17), the paragraph containing this critical sentence was redacted.
Despite the clear judgement in the Tele2 case, blanket data retention laws are still in place in most Member States. EDRi member Privacy International surveyed 21 national data retention laws and examined their compliance with fundamental rights standards. None of the 21 laws are currently in compliance with these standards, as interpreted by the CJEU judgements in Digital Rights Ireland and Tele2.
This conclusion is confirmed by a recent Eurojust report ”Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15” (Council document 10098/17, LIMITE) which was made publicly available by EDRi member Statewatch on 20 November 2017. The Eurojust report covers 25 EU Member States (as well as Norway and Switzerland), and is based on a detailed questionnaire sent to members of the European Judicial Cybercrime Network (EJCN) in March 2017.
According to the survey, five Member States (Austria, the Netherlands, Romania, Slovenia and Slovakia) do not currently have mandatory data retention, as their previous laws were invalidated by constitutional or high courts in accordance with the CJEU judgement on the Data Retention Directive. For the remaining Member States that responded to the survey, the Eurojust report concludes that “none of the countries have national legislation that obliges the targeted retention of data linked to specific persons or geographical locations”. In other words, their national data retention laws cover all subscribers, which is illegal under EU law.
Some respondents indicated that “they considered that their data retention regime is targeted by virtue of the limitations set with regard to retention periods and/or reason for the data retention”. However, this notion of “targeted” is rejected by the Eurojust report, as it is clearly not in line with the standards of the Tele2 judgement.
For access to the retained data, the majority of respondents state that a judicial review is required before access is granted. The replies also state that access is granted depending on the seriousness of the crime being investigated. The Eurojust questionnaire does not ask the respondents whether access to the retained data, as a general rule, can only be granted to “data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime”. This is a requirement in the Tele2 judgement (paragraph 119), except in terrorism cases.
Respondents of the Eurojust survey were also asked about the impact of the CJEU judgement in relation to the admissibility of evidence in court. Five countries reported on court rulings where the admissibility of evidence from data retention was evaluated by the court. So far the evidence has been deemed admissible by courts, although one of the five cases (in Ireland) is still pending on appeal. This part of the Eurojust report shows a clear concern that evidence obtained from illegal data retention could one day be ruled inadmissible by courts.
The legal uncertainty regarding the admissibility of evidence obtained from data retention is by no means surprising. Unless Member States quickly amend their data retention laws to bring them into compliance with the CJEU standards, it is reasonable to expect that there will be more challenges to the admissibility of the evidence. Even if national courts generally allow illegally obtained evidence in specific cases, the courts may eventually rule differently when prosecutors consistently submit evidence that is only available because of illegal data retention laws. The fundamental right to a fair trial may certainly be questioned if the state systematically relies on evidence that is obtained in violation of established human rights standards.
Finally, the Eurojust survey asks about initiatives at the national level to change the data retention legislation. In ten Member States, a review or assessment of the legislation is ongoing, and three Member States are in the process of drafting amendments. The Eurojust report also outlines the substantive legal changes being planned or considered by Member States. Most of these seem concerned with access to the retained data, such as limiting access to serious crime only. This would address a narrow reading of the 2014 Digital Rights Ireland ruling, whereby blanket data retention may be understood as theoretically possible if sufficient safeguards for access are put in place. With the 2016 Tele2 ruling that interpretation is clearly rejected by the CJEU. Only one Member State (Austria) specifically mentions the introduction of targeted data retention and quick freeze.
Informal remarks of the respondents show a clear preference for blanket data retention with arguments that it is impossible to determine in advance the individuals who will commit crimes and thus the data that needs to be retained. There are also claims that storing data indiscriminately for all citizens is more acceptable since the alternative, targeting specific persons or particular geographical locations, could result in criminal investigations that are considered discriminatory. Some respondents also indicated that the necessary balance is already guaranteed by the limitations placed on access to the retained data.
The last argument is particularly odd since the CJEU has clearly ruled in Tele2 that restrictions on access to the retained data are not sufficient. The retention of data must also meet objective criteria that establish a connection between the data to be retained and the objective pursued. In particular, such conditions must ensure that data is not retained on everyone (Tele2 paragraph 110). However, this does not mean that “the individuals who will commit crimes must be determined in advance”. The CJEU rulings in Digital Rights Ireland and Tele2 only require objective evidence to identify a public whose data is likely to reveal a link, at least an indirect one, with serious criminal offences (Tele2 paragraph 111).
There is also the possibility of retaining data on specific persons or a group of persons at an early stage of an investigation based on evidence or intelligence which does not currently meet the substantive requirements for access to metadata. If the police gathers further evidence to substantiate the suspicion for the person of interest and can make a reasoned request for access to data, retained metadata from the past of the suspected person will become available to the police. However, it will not be possible to “look into the past” of every possible citizen since this will require retention of data on everyone. The CJEU has ruled twice that this practice of mass surveillance is illegal.
Eurojust Report: Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15
http://statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf
Information note from the Council Legal Service on the judgement of the Court in joined cases C-203/15 and C-698/15, Council document 5884/17, unredacted version (01.02.2017)
https://netzpolitik.org/wp-upload/2017/05/rat_eu_legal_service_vds_20170201.pdf
National Data Retention Laws since the CJEU’s Tele-2/Watson judgement, Privacy International (06.09.2017)
https://privacyinternational.org/node/1511
Data retention regimes in Europe in light of the CJEU ruling of 21 December 2016 in Joined Cases C-203/15 and C-698/15, Eurojust, Council document 10098/17
http://statewatch.org/news/2017/nov/eu-eurojust-data-retention-MS-report-10098-17.pdf
(Contribution by Jesper Lund, EDRi member IT-Pol, Denmark)
