• Home /
• News /
• 2020 /
• October /
• Bulk data interception/retention judgments of the CJEU – A victory and a defeat for privacy

Bulk data interception/retention judgments of the CJEU – A victory and a defeat for privacy

Topic

Country/Region

27 October 2020

Juraj Sajfert argues that a recent CJEU decision on national bulk data retention and collection practices is "a complex victory for the law enforcement community and a major step back in the Court’s data retention jurisprudence."

The article examines the recently-handed down judgments in the cases C-623/17 (Privacy International) and 511/18, 512/18 and 520/18 (La Quadrature du Net and others, Ordre des barreaux francophones et germanophone and others). For an overview, see: Mass, suspicionless surveillance regimes are illegal, court confirms (15 October 2020)

Bulk data interception/retention judgments of the CJEU – A victory and a defeat for privacy (European Law Blog, link, emphasis in original) by Juraj Sajfert:

"Both judgments continue the long line of case-law on the secondary use of personal data by intelligence services and law enforcement agencies, in particular traffic and location data initially collected by service providers for commercial purposes...

While the Court in both judgments decides on landmark cases, which have a number of commonalities, and were heard in a joint hearing in 2019, their nature and outcome are quite different. On one hand, Privacy International is an easy victory for the right to privacy and data protection. The Court unequivocally confirms that the state authorities are not allowed to intercept personal data, originating from commercial operators, in bulk. La Quadrature du Net and Others on the other hand, is a complex victory for the law enforcement community and a major step back in the Court’s data retention jurisprudence.

(...)

Three wins for the law enforcement community

...La Quadrature du Net and Others is a far more complicated text, composed of a series of rather political compromises than judicial decisions, and face-saving exercises. A deeper reading of the judgment turns the Tele 2 principle into a mirage.

The greatest victory for the law enforcement community, and the most important exception to the Tele 2 principle, may be found in paragraphs 136-139 of La Quadrature du Net and Others. In my view, this is where the Court implicitly overrules its previous case-law. All of a sudden, the general and indiscriminate retention of traffic and location data is allowed, in case there is a ‘serious threat to national security’. Although such retention should be ‘limited in time to strictly necessary’, subject to safeguards and conditions and ‘not systematic in nature’, it may be renewed due to an ‘ongoing nature of the threat’. As a consequence, the Court opened the doors for Member States to reform their national data retention laws, while preserving the essence of what was clearly illegal after Tele 2.  For example, Member States might start issuing time-limited, but renewable general and indiscriminate data retention warrants, with the objective of safeguarding national security, under an ongoing specific threat.

(...)

The second law enforcement victory may be found after the Court moves beyond its previous data retention case-law and opens a discussion about additional types of personal data other than traffic and location data (paras 152-159). We thus learn about the less sensitive types of data, necessitating only a lower threshold of protection.

(...)

Finally, the law enforcement community can rest assured that, even if national data retention laws were violating the EU law, national courts would not have many difficulties in accepting such retained data as evidence in criminal proceedings. From paragraphs 223-228, it transpires that the admissibility of evidence will largely depend on the national procedural rules. In some Member States, a number of convictions were already re-examined, and prisoners were released after the reliability of location data was seriously brought into question. But this remains a national matter and, according to the Court, there is nothing in EU law that would trigger a violation of the right to a fair trial in criminal proceedings as a direct and automatic consequence of the violation of the right of privacy and data protection."