The European Court of Justice has ruled that member states may not impose a general obligation to retain data on providers of electronic communications services. It said EU law precludes a general and indiscriminate retention of traffic data and location data. The ruling concerns two connected cases, one in Sweden and one in the UK.
The court was ruling on case C-203/15 brought by Tele2 Sweden against Swedish telecoms regulator PTS, and Case C-698/15 against rules brought in by the UK Home Secretary.
In the Digital Rights Ireland judgment of 2014, the Court of Justice had declared invalid the directive on the retention of data, on the grounds that a general obligation to retain traffic data and location data was not limited to what was strictly necessary.
The next day, Tele2 Sweden informed the Swedish Post and Telecom Authority (PTS) that it would no longer retain data, and that it intended to erase data already held. Swedish law requires e-communications service providers to retain all the traffic data and location data of all their subscribers and registered users, systematically and continuously, and with no exceptions.
The UK case was brought by Shadow Media Minister Tom Watson, Peter Brice and Geoffrey Lewis, challenging the law known as the 'snoopers charter' in UK court, which asked for an opinion from the EU bench. The Data Retention and Investigatory Powers Act forces telecoms operators to retain all communications data for up to one year, although the content of those communications is excluded.
It its new ruling, the court says it is open to member states to make provision for targeted retention or the purpose of fighting serious crime, but this must be limited to what is strictly necessary. Access by national authorities to the retained data must be subject to conditions, including prior review by an independent authority and the data being retained within the EU.
Commenting on the ruling, Tele2 Sweden said the European Court of Justice had backed its own stance on the matter. Since 2014, the company has been saying that the Swedish data retention system breaches the European Convention on Human Rights, as it said in the preliminary notification in summer 2016. It referred in particular to the requirement for a prior review with an independent organ, such as a court of law, which is currently not done in Sweden.
It also pointed out that the European court said data retention should only apply when there is a suspicion of a serious crime. It said Swedish law should ensure that law enforcement agencies can do their job without risking personal data integrity. Chief legal council Stefan Backman said the company assumes that Swedish law makers will immediately take the opportunity to find a balance.
In the UK, the case will return to the Court of Appeal, where the Home Office said it would be putting forward "robust arguments" to support its position, the BBC reports. The government said it would not make any changes until the Court of Appeal had ruled on the legal challenge to the legislation.
Telenor Sweden commented that it welcomed the ruling and that it would immediately discontinue retaining its customers' information, as did its Bredbandsbolaget subsidiary. AllTele said it, too, would now stop storing client data.
