4.2 The Grounds of Invalidation of the Directive 2006/24/CE
and the Outcome at National Level
The Data Retention Directive required the providers of publicly available electronic
communications services or public communications networks to retain traffic and
location data belonging to individuals or legal entities. Such data included the calling
telephone number and name and address of the subscriber or registered user, user
IDs, Internet Protocol addresses, the numbers dialled, and call forwarding or call
transfer records. The retention period could last for a minimum period of six months
and up to two years, and the sole purpose of processing and storing the data was to
prevent, investigate, detect, and prosecute serious crimes, such as organized crime
and terrorism.
26 The content of the communications of individuals was not retained.
The case arose before the CJEU as preliminary questions from the High Court of
Ireland and the Constitutional Court of Austria. In its preliminary ruling, the ECJ
stated that the retention of data in order to allow access by the competent national
authorities constitutes processing of data and therefore affects two basic rights of the
Charter of Fundamental Rights: (a) the right to private life guaranteed by article
7, and (b) the protection of personal data guaranteed by article 8.
27
Furthermore, article 52(1) of the Charter requires that any limitation on the
exercise of rights guaranteed by the Charter must be provided by law and must
respect the essence of such rights.
28 Any limitations are subject to a proportionality
test and can be imposed only if they are necessary and meet the objectives of general
interest as recognized by the EU or the need to protect the rights and freedoms of
others.
The CJEU then proceeded to examine whether the interference by national
authorities was proportionate to the objective pursued. In this regard, according to
the settled case law, the standards to be met are that of being “appropriate” and
“necessary” in order to achieve the objectives. The Court went on to state that the
way too broad application of the Directive, since retention of data affects not only
persons whose data may contribute to the initiation of legal proceedings, but also
those for whom there is not a shred of evidence to suggest that their conduct might be
connected to a serious crime. It also observed that no one is exempted from this rule;
it even applies to those whose communications are subject to professional secrecy,
according to national rules. As far as the period of retention, which runs from six
months up to two years, the CJEU noted that the Directive did not set any objective
criteria to determine the appropriate period of retention “to what is strictly
necessary”.
29
26 See art. 5 of Directive 2006/24/EC.
27 https://ec.europa.eu/info/sites/info/files/edri_2017_en.pdf.
28 https://www.loc.gov/law/help/eu-data-retention-directive/eu.php.
29 Ibidem.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
303
and the Outcome at National Level
The Data Retention Directive required the providers of publicly available electronic
communications services or public communications networks to retain traffic and
location data belonging to individuals or legal entities. Such data included the calling
telephone number and name and address of the subscriber or registered user, user
IDs, Internet Protocol addresses, the numbers dialled, and call forwarding or call
transfer records. The retention period could last for a minimum period of six months
and up to two years, and the sole purpose of processing and storing the data was to
prevent, investigate, detect, and prosecute serious crimes, such as organized crime
and terrorism.
26 The content of the communications of individuals was not retained.
The case arose before the CJEU as preliminary questions from the High Court of
Ireland and the Constitutional Court of Austria. In its preliminary ruling, the ECJ
stated that the retention of data in order to allow access by the competent national
authorities constitutes processing of data and therefore affects two basic rights of the
Charter of Fundamental Rights: (a) the right to private life guaranteed by article
7, and (b) the protection of personal data guaranteed by article 8.
27
Furthermore, article 52(1) of the Charter requires that any limitation on the
exercise of rights guaranteed by the Charter must be provided by law and must
respect the essence of such rights.
28 Any limitations are subject to a proportionality
test and can be imposed only if they are necessary and meet the objectives of general
interest as recognized by the EU or the need to protect the rights and freedoms of
others.
The CJEU then proceeded to examine whether the interference by national
authorities was proportionate to the objective pursued. In this regard, according to
the settled case law, the standards to be met are that of being “appropriate” and
“necessary” in order to achieve the objectives. The Court went on to state that the
way too broad application of the Directive, since retention of data affects not only
persons whose data may contribute to the initiation of legal proceedings, but also
those for whom there is not a shred of evidence to suggest that their conduct might be
connected to a serious crime. It also observed that no one is exempted from this rule;
it even applies to those whose communications are subject to professional secrecy,
according to national rules. As far as the period of retention, which runs from six
months up to two years, the CJEU noted that the Directive did not set any objective
criteria to determine the appropriate period of retention “to what is strictly
necessary”.
29
26 See art. 5 of Directive 2006/24/EC.
27 https://ec.europa.eu/info/sites/info/files/edri_2017_en.pdf.
28 https://www.loc.gov/law/help/eu-data-retention-directive/eu.php.
29 Ibidem.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
303