The document summarizes a European Court of Justice judgment that invalidated the EU Data Retention Directive. The judgment found that the directive disproportionately interfered with privacy rights by requiring indiscriminate retention of communications metadata for all citizens, regardless of suspicion of criminal activity. National governments must now amend data retention laws to comply with the ruling by imposing stricter conditions like independent oversight of access to retained data and clearer definitions of the serious crimes that warrant retention. The implications for laws in countries like the UK that implemented the directive are currently unclear as governments and regulators determine next steps.

1. Data Retention –
dead or merely stunned?
Graham Smith
Bird & Bird LLP
26 June 2014

2. Digital Rights Ireland Ltd v Ireland
Kärntner Landesregierung v Austria
EU Court of Justice judgment, 8 April 2014

3. Data Protection Seminar 26 June 2014
Page 3
© Bird & Bird LLP 2014
Data Retention Directive
● Mandatory retention of traffic and location data, to the extent
generated by public CSPs in process of supplying
communications services, identifying:
• source and destination of communication
• date, time, duration
• type of communication
• users' equipment
• location of mobile equipment
● Content of communications excluded
● Retention period between 6 months and 2 years
● General provisions for data security, storage, destruction,
independent supervisory authority
● Available to authorities for investigation, detection and
prosecution of serious crimes, as defined by each Member
State.

4. Data Protection Seminar 26 June 2014
Page 4
© Bird & Bird LLP 2014
CJEU as European Constitutional Court
EU Charter of Fundamental Rights
● Article 7
• Everyone has the right to respect for his or her private and
family life, home and communications.
● Article 8
• Everyone has the right to the protection of personal data…
● Article 52
• Any limitation on the exercise of the rights and freedoms recognised by
this Charter must be provided for by law and respect the essence of those
rights and freedoms. Subject to the principle of proportionality,
limitations may be made only if they are necessary and genuinely meet
objectives of general interest recognised by the Union or the need to
protect the rights and freedoms of others.

5. Data Protection Seminar 26 June 2014
Page 5
© Bird & Bird LLP 2014
Charter v ECHR
Article 52 Charter Article 8 ECHR
1. Limitations permissible if Interference permissible if
2. Provided for by law In accordance with the law
3. Respect the essence of the right and
freedom
4. Necessary Necessary in a democratic society
5. And genuinely meet recognised
general interest objectives
in the interests of national security, public
safety or the economic well-being of the
country,
for the prevention of disorder or crime,
for the protection of health or morals,
Or the need to protect rights and
freedoms of others
or for the protection of the rights and
freedoms of others.
6. Proportionate Proportionate (caselaw)

6. Data Protection Seminar 26 June 2014
Page 6
© Bird & Bird LLP 2014
1. Is there an interference?
● The obligation to retain data is itself an interference [32] to [34]
● Access by authorities is a further interference [35]
● Wide-ranging and particularly serious [37]
● Likely to generate the feeling in the minds of subscribers and
users that their private lives are the subject of constant
surveillance [37]
● Cf. UK government position in TEMPORA litigation:
• "… accept that the interception under a s.8(4) warrant may
be regarded as giving rise to a technical interference [with
ECHR Art 8 rights] even if that communication is not and/or
cannot be read, looked at or listened to by any person."
● TEMPORA said to capture both content and metadata

7. Data Protection Seminar 26 June 2014
Page 7
© Bird & Bird LLP 2014
3. Adversely affect the essence of the right?
Essence of right – repugnant to human dignity?
● No, because the Directive does not permit acquisition of
knowledge of the content of the electronic communications as
such [39]

8. Data Protection Seminar 26 June 2014
Page 8
© Bird & Bird LLP 2014
5. Recognised general interest objective
Genuinely satisfies an objective of general interest?
● Yes. Electronic communications data are a particularly
important and therefore valuable tool in the prevention of
offences and the fight against crime, in particular organised
crime. [43]
● Retention of data contributes to fight against serious crime and
thus, ultimately, to public security. [42] to [44]

9. Data Protection Seminar 26 June 2014
Page 9
© Bird & Bird LLP 2014
4. Necessity
Is the interference limited to what is strictly necessary for the
achievement of the objective?
● Retention may be appropriate [49]
● But the utmost importance of the objective does not in itself
render the retention measures of the Directive necessary [51]
● Proportionality

10. Data Protection Seminar 26 June 2014
Page 10
© Bird & Bird LLP 2014
6. Proportionality – the failure point
Requirements
● Strict necessity [52], [56]
● Clear and precise rules governing scope and application [54]
● Minimum safeguards against risk of abuse, unlawful access and
abuse [54]

11. Data Protection Seminar 26 June 2014
Page 11
© Bird & Bird LLP 2014
Proportionality issues
Generality
● Applies to all means of electronic communication (use
widespread and of growing importance in people’s everyday
lives) [56]
● All subscribers and registered users [56]
● Interference with fundamental rights of practically the entire
European population [56]
● All persons, all means of electronic communication without any
differentiation, limitation or exception [57]

12. Data Protection Seminar 26 June 2014
Page 12
© Bird & Bird LLP 2014
Proportionality issues
Suspicionless
● Applies even to persons for whom no evidence capable of
suggesting a link, even indirect or remote, with serious crime
[58]
● No relationship required between data retained and a threat to
public security: not restricted to:
• data pertaining to:
- particular time period
- particular geographical zone
- circle of particular persons likely to be involved in serious
crime [59]
• persons whose data for other reasons could contribute to
prevention, detection or prosecution of serious offences [59]

13. Data Protection Seminar 26 June 2014
Page 13
© Bird & Bird LLP 2014
Proportionality issues
Specific rights
● Applies to persons whose communications are subject to
professional secrecy [58]

14. Data Protection Seminar 26 June 2014
Page 14
© Bird & Bird LLP 2014
Proportionality issues
Access and use
● No objective criterion to determine limits of access to data and
subsequent use for prevention, detection or prosecution of
sufficiently serious offences [60]
● Leaves serious crime definition to national law [60]
● No substantive and procedural conditions relating to access and
subsequent use
• Left to member States to define procedures and conditions
in accordance with necessity and proportionality [61]
• In particular no objective criteria re restriction of number of
persons authorised to access and subsequently use to that
strictly necessary [62]

15. Data Protection Seminar 26 June 2014
Page 15
© Bird & Bird LLP 2014
Proportionality issues
Independent supervision
● Above all, access not dependent on prior review by court or
independent administrative body following a reasoned request
• No obligation on MS to establish such limits [62]
● Stricter standard than ECtHR?

16. Data Protection Seminar 26 June 2014
Page 16
© Bird & Bird LLP 2014
Proportionality issues
Retention period
● No distinction between categories of data on basis of:
• possible usefulness
• persons concerned [63]
● No objective criteria limited to strict necessity on which to base
determination of retention period [64]

17. Data Protection Seminar 26 June 2014
Page 17
© Bird & Bird LLP 2014
Article 8 (data protection) issues
Economics
● Permits economic considerations to affect level of security of
data [67]
Data destruction
● Does not ensure irreversible destruction at end of data
retention period [67]
Cross-border data transfer
● Does not require data to be retained within EU
• So independent compliance control under Art 8(3) not fully
ensured [68]

18. Consequences for national legislation

19. Data Protection Seminar 26 June 2014
Page 19
© Bird & Bird LLP 2014
Consequences for national legislation
● Commission FAQ 8 April 2014:
• "National legislation needs to be amended only with regard to aspects that
become contrary to EU law after a judgment by the European Court of
Justice. Furthermore, a finding of invalidity of the Directive does not
cancel the ability for Member States under the e-Privacy Directive
(2002/58/EC) to oblige retention of data."; But:
- Article 15(1) constraints
- Pfleger (CJEU 30 April 2014): national legislation under a Directive's
exception is within scope of EU law and so has to comply with the
Charter
● Slovakia: Constitutional Court temporary invalidity declaration on
retention aspects
● Sweden: 4 operators have ceased retention; regulator decided not to
pursue

20. Data Protection Seminar 26 June 2014
Page 20
© Bird & Bird LLP 2014
Consequences for national legislation
● UK: Regulations made under European Communities Act specifically
to implement Directive; ultra vires?
• HC Home Affairs Committee 30 April 2014:
"174. It is essential that the legal position be resolved clearly and promptly. It is
currently unclear whether CSPs are obliged to store communications data as they
were previously, or indeed if they are allowed to, because of the Data Protection
Act. It is also unclear if the Home Office will continue to pay CSPs for their work on
communications data."
• Home Office: (PQ 16 June 2014):
"The Government continues to consider the judgment of the European Court, but
we consider that the UK Data Retention (EC Directive) Regulations 2009 remain in
force. Those in receipt of a notice under the regulations have been informed that
they should continue to observe their obligations as outlined in any notice."
• NGOs
- Individual data protection notification campaign to ISPs
• Judicial review?

21. Graham Smith
graham.smith@twobirds.com
@cyberleagle
Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses.
Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number OC340318 and is authorised and regulated by the
Solicitors Regulation Authority. Its registered office and principal place of business is at 15 Fetter Lane, London EC4A 1JP. A list of members of Bird & Bird LLP and
of any non-members who are designated as partners, and of their respective professional qualifications, is open to inspection at that address.
twobirds.com
Thank you