Europe’s highest court clarifies data retention guidelines to tackle serious crimes

A decision by the European Union’s highest court has reaffirmed that national law cannot rely on an allegation of combating serious crime to deviate from the EU law prohibition on general collection and electronic communications data blind.

While the court pointed to some targeted exceptions, it suggests that it may be permitted to collect digital evidence en masse to combat serious crime, for example by targeting locations with high crime or large numbers of visitors (such as airports), or other locations. that house critical infrastructure.

The CJEU referral, which followed an appeal in a case linked to the use of mobile phone data to secure a murder conviction in Ireland, saw a long list of EU member states join Ireland to push for the court to adopt a broader interpretation of how law enforcement authorities can retain and use data, irish time reported earlier. But the bloc’s top court rejected any confusion between national security and serious crime – instead reiterating that EU law prohibits the blanket and indiscriminate retention of traffic and location data relating to electronic communications to purposes of combating serious crime.

“While the Directive on privacy and electronic communications allows Member States to impose limitations on the exercise of these rights and obligations for the purposes, inter alia, of combating crime, such limitations must respect the principle of proportionality,” says a CJEU press release on the judgment. “This principle requires compliance not only with the requirements of aptitude and necessity, but also that of the proportional nature of these measures in relation to the objective pursued.

“Thus, the Court has already ruled that the objective of combating serious crime, however fundamental it may be, does not justify, in itself, that a measure providing for the general and indiscriminate retention of all traffic data and location, such as that established by [EU] Directive 2006/24, must be considered necessary.

“In the same vein, even the positive obligations of the Member States relating to the establishment of rules capable of facilitating an effective fight against criminal offenses cannot have the effect of justifying an interference as serious as that resulting from a legislation providing for the maintenance of traffic and location data with the fundamental rights of almost the entire population, in circumstances where the data of the persons concerned are not likely to reveal a link, at least indirect, between these data and the objective pursued.

The widespread interest in the case indicates how many other national laws can operate on equally fragile ground when it comes to bulk data retention – whether in relation to serious crimes or national security.

On this last point, the CJEU has repeatedly made it clear that blanket, indiscriminate data retention regimes are not legal – although the court has allowed, in a decision in October 2020that when a Member State is faced with a pressing threat to national security, the temporary collection and storage of massive data, limited to “strictly necessary”, may be authorised.

The CJEU’s decision on the Irish referral today highlights the need for public authorities to strike a balance between the general/public interest in catching a criminal and the fundamental rights of individuals under EU law, which include the right to privacy and respect for personal data.

The court rejected member states’ proposals for a workaround that would have meant that a particularly serious crime could have been treated in the same way as a threat to national security “that is real and present or foreseeable. — and thus would allow blanket penalties and the indiscriminate retention of traffic and location data for crime-fighting purposes.

“Such a threat is distinguished, by its nature, its gravity and the specificity of the circumstances which constitute it, from the general and permanent risk of the occurrence of tensions or disturbances, even serious ones, affecting security, or that of serious criminal offenses committed”, indicates the press release on this subject.

The implication, then, is that member states that have insisted on this line of argument to try to circumvent EU law – and “legalize” their illegal bulk data collection schemes – face a stalemate.

In the judgment, the CJEU sought to provide stricter direction to public authorities on other avenues of action they can take to gather digital evidence – with the court stating that it upholds previous case law in finding that the EU law do not oppose legislative measures for the purpose of combating serious crime and preventing serious threats to public safety which provide for:

  • the targeted retention of traffic and location data which is limited according to the categories of persons concerned or according to a geographical criterion;

  • the general and indiscriminate retention of IP addresses assigned to the source of an Internet connection;

  • the generalized and indiscriminate retention of data relating to the civil identity of users of electronic communications systems;

  • expedited retention (quick freeze) of traffic and location data held by these service providers.

However, the decision also stresses that such measures are subject to the limits of what is strictly necessary.

Learn more about the exceptions cited in the decision:

“… a targeted measure for the retention of traffic and location data may, at the choice of the national legislator and in strict compliance with the principle of proportionality, also be set according to a geographical criterion when the competent national authorities consider, at least on the objective and non-discriminatory factors, whether there is, in one or more geographical areas, a situation characterized by a high risk of the preparation or commission of serious criminal offences. These areas may include places with a high incidence of serious crime , places particularly vulnerable to serious crime, such as places or infrastructures which regularly receive a very large number of visitors, or strategic places, such as airports, stations, seaports or toll areas (see , in this sense, judgment of October 6, 2020, La Quadrature du Net and othersC‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraphs 150 and the case-law cited).

“It should be recalled that, according to this case-law, the competent national authorities may adopt, for the areas referred to in the preceding paragraph, a targeted detention measure according to a geographical criterion, such as, inter alia, the average crime rate in a geographical area, without this authority necessarily having precise indications as to the preparation or the commission, in the areas concerned, of acts of serious crime, since a detention targeted according to this criterion is likely to concern, according to the serious criminal offenses in question and the specific situation of the respective Member States, both the areas marked by a high incidence of serious crime and the areas particularly vulnerable to the commission of such acts, it is not, in principle, likely to give give rise to discrimination, since the criterion based on the average rate of serious crime is totally unrelated to any discriminatory factors.

“Furthermore, and above all, a targeted retention measure relating to places or infrastructures that regularly receive a very large number of visitors, or strategic places, such as airports, train stations, seaports or toll areas, allows the competent authorities to collect traffic data and, in particular, the location data of all persons using, at a specific time, an electronic means of communication in one of these places. Thus, such a targeted conservation measure may allow these authorities to obtain, through access to the stored data, information on the presence of these persons in the places or geographical areas covered by this measure as well as their movements between these areas or within these areas and to draw, for the purposes of the fight against serious crime, conclusions as to their presence and activity in these places or geographical areas at a specific time in the period. e of conservation”.

The court rejected another workaround-type argument – which argued that serious crime authorities should be allowed to tap into mobile data that had been mass-collected, broadly and indiscriminately, to make in the face of a serious threat to national security that is genuine and present or foreseeable.

“This argument makes this access depend on factors unrelated to the objective of combating serious crime,” the CJEU’s statement noted. “Furthermore, according to this argument, access could be justified by an objective of lesser importance than that which justifies its maintenance, namely the safeguard of national security, which would be contrary to this hierarchy of objectives of general interest. in the context of which the proportionality of a detention measure must be assessed. Furthermore, allowing such access would render ineffective the prohibition against general and indiscriminate detention for the purpose of combating serious crime.”

The court further held that access to personal data such as traffic and location data by competent national authorities should be subject to prior review – carried out either by a court or by a body independent administrative authority – and that a control decision had to be preceded by the appropriate request procedure (i.e. “a reasoned request from these authorities submitted, inter alia, in the context of procedures for the prevention, detection or prosecution of offences”).

The CJEU also explicitly states that a police officer cannot replace the required court or independent body in this scenario. So basically approving data access by a police officer is not considered a valid decision review body and will not allow member states to achieve another quick and dirty circumvention of EU law (not legally anyway).

Nor can a national court escape its responsibility to strike down national legislation incompatible with the EU directive on privacy and electronic communications, the CJEU further ruled – which seems relevant for France where the government has sought to use national courts to do just that in recent years (via Politics).

On the specific point of the referral of the case – whether retained mobile traffic and location data should be allowed to serve as evidence in the murder case – the CJEU referred the case to the Irish courts, pointing out that a decision must comply witham on principles of equivalence and efficiency. So whether or not this evidence is dismissed remains to be seen.

Mary I. Bruner