The EU Court of Justice has again struck down national laws requiring mass data collection and retention by telecom operators for law enforcement purposes. Ruling on cases brought in the UK, France and Belgium, the court said the EU's ePrivacy directive prohibits the indiscriminate retention of massive amounts of personal communications data, even in the name of national security or prevention.
The cases were brought by the NGOs Privacy International and Quadrature du Net in respectively the UK and France, and the association of lawyers in Belgium. The EU court's general advocate already found in an opinion issued in January that the national legislation on data retention in all three countries was too broad and indiscriminate, violating fundamental rights of EU citizens.
The court's final ruling upholds that opinion and is line with its previous rulings striking down data retention legislation in 2016 and 2014. While numerous countries have tried since then to pass similar laws, the court clarified in the latest ruling that the EU states' exclusive right to handle national security did not absolve their obligations under the ePrivacy directive to preserve the confidentiality of personal communications.
Even if that confidentiality may be breached at times in the name of a serious, genuine threat to national security, that exception cannot become the rule, where retention of all personal data becomes standard practice. The EU states must still uphold the principle of proportionality under the EU's charter of fundamental rights, meaning data retention is subject to review by a court or other independent authority and is of a limited duration.
