Legal Service Opinion on CJEU Data Retention ruling

The European Parliament (EP) legal services last week presented an opinion on the Court of Justice of the EU’s (CJEU) ruling on the Data Retention Directive (DRD) and its implications. The opinion, after restating the principles that are essential to permit any interference on fundamental rights (proportionality, justification and necessity), answered specific questions raised by the Civil Liberties, Justice and Home Affairs.

On the issue of existing mass surveillance mechanisms such as on Passenger Name Records (PNR) and the Terrorist Financing Tracking Programme Agreement (TFTP), the opinion states that the only directly affected legal norm is the Data Retention Directive itself. Other norms covering similar data retention schemes will have a “presumption of legality” that could be repealed “on a case-by-case basis in the light of the particular circumstances of each case”. This rebuttal could be made either via national courts that refer them to the CJEU in accordance with Article 267 TFEU, or via asking the Commission about the legality of existing EU acts.

In relation to similar legislative proposals that require mass data storage, the opinion states that EU law must respect the red lines set by the CJEU in this judgment. Thus, EU PNR and Entry/Exit System will fall clearly under the category of acts that need to be assessed in the light of this ruling and need to respect the principles of proportionality and necessity. International agreements that have similar consequences on personal data would also fall under this category, and the CJEU could be asked if such agreement is in line with EU law. This procedure was used last December in relation to the EU Canada PNR agreement.

As for the enacted national laws applying the Directive, the opinion says that the judgment produces a twofold effect: On one hand, Member States have no obligation to retain data by service providers and therefore they can repeal existing laws without breaking EU law. On the other hand, if a Member State decides to keep the legislation, “all national measures providing for data retention in connectionwith the provision of publicly available electronic communications services” would now be covered under Art.15(1) of the e-Privacy Directive. These measures will need to frespect Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and the principles of proportionality and necessity.

Lastly, the legal opinion mentions the situation of some of the national laws implementing the Directive. In Bulgaria, Romania, Germany, Cyprus, Czech Republic these laws were declared invalid even before the CJEU gave its judgment. In some other Member States they were declared invalid after the judgment, as in the case of Austria and Slovenia and partially in Poland.

The European Parliament has provided clear guidance on why the DRD was annulled and the effects of the judgment on national and European law as well as on international agreements established by the EU. The opinion covers the jurisprudence of both the CJEU and the European Court of Human Rights (ECtHR) on the existing safeguards with regard to surveillance and how principles of necessity and proportionality need to be met for such an interferences on fundamental rights. However, Member States appear to think, exploiting every available atrocity, that international courts, national courts and EU institutions got it all wrong..

In a joint statement, several EU Ministers of Interior called for the new measures: “Partnership” of Internet Service Providers (ISPs) regarding content that should be removed (a.k.a. “privatised law enforcement”) and “stepping up the detection and screening of travel movements by European nationals crossing the European Union’s external borders”. Companies like Facebook, that previously threatened to block Charlie Hebdo’s Facebook page would be used to enforce more censorship.

Tthe joint statement says that this time they need the “constructive approach” of the European Parliament, for the adoption of PNR measures, for which no evidence of necessity or proportionality has been provided.

For those attending the Privacy Camp “Data Retention and PNR” workshop next week (https://privacycampbrussels.wordpress.com/), we will need to be ready with concrete actions to stop this new attack on fundamental rights and freedoms.

European Parliament Opinion on the Court of Justice of the EU’s ruling on the Data Retention Directive (07.01.2015)
https://s3.amazonaws.com/access.3cdn.net/27bd1765fade54d896_l2m6i61fe.pdf

Joint Statement by Minister of Interior after the attack on Charlie Hebdo Offices (11.01.2015)
https://eu2015.lv/images/news/2015_01_11_Joint_statement_of_ministers_for_interrior.pdf

(Contribution by Diego Naranjo, EDRi)