On 21 December 2016, the Court of Justice of the European Union (“CJEU”) issued a new ruling interpreting national laws in the UK and Sweden which obligate telecommunications operators to engage in the bulk collection of metadata associated with various forms of data communications transmissions.  The issues were referred to the CJEU by the UK and Swedish courts, seeking a preliminary ruling on the interpretation of Article 15(1) of the e-Privacy Directive, read in light of the Charter of Fundamental Rights.  Article 15(1) allows EU Member States to adopt measures that restrict the privacy rights granted to users of electronic communications services under the e-Privacy Directive when such restrictions are a “necessary, appropriate and proportionate measure…to safeguard national security”.

The CJEU decided that the “general and indiscriminate retention of all traffic and location data” for the purpose of fighting crime is incompatible with EU law. The CJEU also decided that it is contrary to EU law to allow competent national authorities to access the retained data where such access is not oncerned should be retained within the EU.limited solely to fighting serious crime. Any such access should in any event be subject to prior review by a court or an independent administrative authority, and subject to a requirement that the data c

The CJEU determined that the e-Privacy Directive does not prevent a Member State from the targeted retention of traffic and location data, for the purpose of fighting serious crime, so long as the retention of such data is limited to what is strictly necessary in respect of the following:

1. Categories of data to be retained;

2. Means of communication affected;

3. Persons concerned; and

4. Retention period adopted.

The UK Court of Appeal must now decide the case in light of the decision of the CJEU.  Although the legislation at issue – the Data Retention and Investigatory Powers Act 2014 (“DRIPA”) – is due to be replaced by the Investigatory Powers Act 2016 (“IPA”) at the end of this year, the Court’s reasoning calls into question the validity under EU law of the wide powers of surveillance and data retention allowed under the IPA.

Matt Buckwell co-authored this article.