Passed as part of efforts to combat terrorism, the Data Retention Directive requires telecom service providers to collect and retain for up to two years traffic and location data on customer communications so that the data may be used in eventual criminal investigations. While the Advocate General was not opposed to the objectives of the directive, he found that it is too loosely defined, as it does not detail in what circumstances the data may be accessed or how it is to be retained. The latter are key requirements for any law that may violate fundamental rights. These details were left to the individual member states to define.
In terms of access to the data, the directive only mentions "serious crime" as a justification, and it does not set which public authorities may use the data. Access to the data should be restricted further, if not solely to judicial authorities, at least to independent authorities, or, failing that, by making any request for access subject to judicial or independent review, according to the opinion. The Advocate General would also like to see access restricted in exceptional cases where fundamental rights may be violated, such as medical confidentiality. In addition, public authorities should be required to notify people when their individual data is accessed, at least retroactively, and delete the data once its usefulness has been exhausted.
Furthermore, the data is not sufficiently protected, as it is maintained by the service providers rather than public bodies, and may be stored outside the country where the communications took place, exposing it to possible hacking. Finally, the Advocate General did not find any justification for retaining the data for up two years, calling this a violation of the EU principle of proportionality. He said a period of less than one year should be sufficient.
The Advocate General suggested the directive could be suspended until further legislation is passed to remedy its shortcomings, even if these may have already been provided for in national legislation. His opinion is not binding on the EU Court; it must still make a final ruling in the cases.
