3.4 Digital Forensics
The ePrivacy Regulation contains provisions on the protection of electronic communications of natural and legal persons and of information stored in their terminal
equipment. Such provisions include rules on the confidentiality of electronic communications data, permitted processing of electronic communications data, and
storage and erasure of electronic communications data and protection of information
stored in and related to end-users’ terminal equipment. However, the ePrivacy
Regulation does not apply to the activities of competent authorities for the purposes
of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, including the safeguarding against and the prevention of threats to public security [Art. 2(2)(d)].
The ePrivacy Regulation does not include any specific provisions in the field of
data retention. In line with Article 23 of the GDPR, Article 11 of the ePrivacy
Regulation provides for the possibility for the Union or Member States under
specific conditions to restrict by law certain obligations and rights to safeguard
specific public interests, including national security, defence, public security and
the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and other important objectives of general public
interest, or a monitoring, inspection or regulatory function connected to the exercise
of official authority for such interests. In sum, the ePrivacy Regulation does not
affect the ability of Member States to create national data retention frameworks and
to carry out lawful interception of electronic communications, in accordance with the
Charter
29 and the ECHR.
30
29 See Judgment of the CJEU of 8 April 2014, Digital Rights Ireland and Seitlinger, Joined Cases
C-293/12 and C-594/12, ECLI:EU:C:2014:238, on the invalidity of Directive 2006/24/EC of the
European Parliament and of the Council of 15 March 2006 on the retention of data generated or
processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC. Additionally, see
Judgment of the CJEU of 21 December 2016, joined cases C-203/15 and C-698/15, Tele2 Sverige
AB v. Secretary of State for the Home Department, ECLI:EU:C:2016:970. For instance, the latter
considered that the equivalent to Article 11 in the previous version of the ePrivacy Regulation (Art.
15 of Directive 2002/58) read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter,
precluded national legislation which, for the purpose of fighting crime, provides for general and
indiscriminate retention of all traffic and location data of all subscribers and registered users relating
to all means of electronic communication. Additionally, the Court established that those provisions
precluded national legislation governed access of the national authorities to the retained data, where
the objective pursued by that access, in the context of fighting crime, is not restricted solely to
fighting serious crime, where access is not subject to prior review by a court or an independent
administrative authority, and where there is no requirement that the data concerned should be
retained within the European Union.
30 See Judgment of the ECtHR of 13 September 2018, Big Brother Watch and Others v. The United
Kingdom (Apps. nos. 58170/13, 62322/14 and 24960/15).
Data Protection in the Internet: A European Union Perspective
471
The ePrivacy Regulation contains provisions on the protection of electronic communications of natural and legal persons and of information stored in their terminal
equipment. Such provisions include rules on the confidentiality of electronic communications data, permitted processing of electronic communications data, and
storage and erasure of electronic communications data and protection of information
stored in and related to end-users’ terminal equipment. However, the ePrivacy
Regulation does not apply to the activities of competent authorities for the purposes
of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, including the safeguarding against and the prevention of threats to public security [Art. 2(2)(d)].
The ePrivacy Regulation does not include any specific provisions in the field of
data retention. In line with Article 23 of the GDPR, Article 11 of the ePrivacy
Regulation provides for the possibility for the Union or Member States under
specific conditions to restrict by law certain obligations and rights to safeguard
specific public interests, including national security, defence, public security and
the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and other important objectives of general public
interest, or a monitoring, inspection or regulatory function connected to the exercise
of official authority for such interests. In sum, the ePrivacy Regulation does not
affect the ability of Member States to create national data retention frameworks and
to carry out lawful interception of electronic communications, in accordance with the
Charter
29 and the ECHR.
30
29 See Judgment of the CJEU of 8 April 2014, Digital Rights Ireland and Seitlinger, Joined Cases
C-293/12 and C-594/12, ECLI:EU:C:2014:238, on the invalidity of Directive 2006/24/EC of the
European Parliament and of the Council of 15 March 2006 on the retention of data generated or
processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC. Additionally, see
Judgment of the CJEU of 21 December 2016, joined cases C-203/15 and C-698/15, Tele2 Sverige
AB v. Secretary of State for the Home Department, ECLI:EU:C:2016:970. For instance, the latter
considered that the equivalent to Article 11 in the previous version of the ePrivacy Regulation (Art.
15 of Directive 2002/58) read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter,
precluded national legislation which, for the purpose of fighting crime, provides for general and
indiscriminate retention of all traffic and location data of all subscribers and registered users relating
to all means of electronic communication. Additionally, the Court established that those provisions
precluded national legislation governed access of the national authorities to the retained data, where
the objective pursued by that access, in the context of fighting crime, is not restricted solely to
fighting serious crime, where access is not subject to prior review by a court or an independent
administrative authority, and where there is no requirement that the data concerned should be
retained within the European Union.
30 See Judgment of the ECtHR of 13 September 2018, Big Brother Watch and Others v. The United
Kingdom (Apps. nos. 58170/13, 62322/14 and 24960/15).
Data Protection in the Internet: A European Union Perspective
471