Validity challenge to the Data Retention Directive
The Directive and fundamental rights
On the 11th of August 2006 Digital Rights Ireland (hereinafter DRI) decided to challenge the validity of the Data Retention Directive (Directive 2006/24) and the transposing national law, in an Irish court. DRI challenged the Irish authorities’ measures concerning the retention of data from a mobile phone DRI had registered on the 3 of June 2006. At the same time in Austria Mr. Seitlinger and 11 129 other persons, in a group challenge in the Austrian court, brought action against the national law transposing the Data Retention Directive. Both the Irish and the Austrian courts’ decided to halt the proceedings and to refer the cases to the CJEU that ruled on the invalidity of the Directive on the 8th of April.
The purpose of the Data Retention Directive is to harmonize the retention of data so as to prevent and investigate organized crime and terrorist threats. The Directive establishes tools for national authorities to get access to all data of all communication done by all individuals by stipulating rules and obligations for how public communication networks must retain data of electronic communication. The Directive covers practically all electronic communication and it requires the retention of all traffic data concerning fixed telephony, mobile telephony, internet access, e-mail and internet telephony. It covers all subscribers and registered users and according to the Court of Justice of the European Union it entails an interference with the fundamental rights of practically the entire European population (p. 56).
“[The data the communication networks must retain] include data necessary to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment, and to identify the location of mobile communication equipment, data which consist, inter alia, of the name and address of the subscriber or registered user, the calling telephone number, the number called and an IP address for Internet services.” (p. 26)
In the joined challenge brought by the applicants the Court decided to assess the validity of the Directive in the light of the right to respect for private life art. 7 CFREU (the Charter) and the right to protection of personal data in art. 8 of the Charter. Furthermore, the Court held that since the Directive enables national authorities to make specific conclusions of individuals’ life, with the potential consequence of people feeling limited to communicate with technology covered by the Directive, it could also be an infringement of the freedom of expression and information as stipulated in art. 11 of the Charter.
On the compatibility of the Directive in the light of the respect for private life, the Court held that an obligation on communication networks to retain information about peoples’ communication is an infringement of the respect for private life per se. Likewise, the Court held that the way the Directive provides for the processing of data is in breach of the right to protection of personal data. In addition, the fact that information is retained and used without the concerned person’s knowledge and that national authorities have access to that information increases that infringement. Whether the Directive was infringing on rights established by the Charter was clearly not hard for the Court to answer but that in itself however, does not give effect for the annulment of the Directive.
Limitations and justification
Limitations on the rights established by the Charter can be made if those limitations genuinely meet the objectives of a general interest and the limitations are proportionate to that aim art 52(1) of the Charter.
The fight against serious terrorism in order to secure international peace and the fight against serious crime in order to secure public security is such a general interest (see to that effect Kadi and Al Barakaat, Tsakouridis). Since the purpose of the Directive is to ensure that data are available for the purpose of the investigation, detection and prosecution of serious crime, it fulfills a justification on the basis of that general interest.
Concluding that the limitations satisfies the requirement of a general interest, the Court applied its traditional proportionality test, assessing whether the limitations are appropriate to achieve the aim of the general interest and whether it is necessary to achieve that aim.
The Court argued that even though the limitations are appropriate to achieve the general interest they cannot be considered necessary. The Directive stipulates that all information should be retained, consequently affecting all people within the EU irrespectively of when, where or whether the person concerned actually has a connection to crime. Furthermore, the Directive does not entail any objective criteria for when it is necessary for national authorities to gain access to retained information and it does not provide for any minimum requirements concerning security or safeguards against abuse. Therefore, because of the Directives broad and general application and the absence of security and safeguarding provisions, the Court concluded that the Directive cannot be considered necessary in the sense that it provides for the least violating measures in order to achieve the aim of preventing and investigating serious crime. Since the infringements could not be considered proportionate to the aim of a general interest the Court declared the Directive invalid.
Conclusion
Firstly, it must be noted that the Court’s decision to declare the Directive invalid was not because it infringed of the right to private life and the right to protection of data, rather the annulment was made because those infringements were not considered necessary to the aim of preventing and investigating serious crime. That is an indication by the Court that the retention of data can be used by member states and justified in relation to fundamental rights granted by the Charter, if the measures are less general and provide for safeguards concerning the processing of the data.
Secondly, what is quite controversial about this judgment is that the Court identifies the ambition to prevent serious crime as the purpose of the Directive. This is contrary to a previous validity challenge brought by Ireland in 2009 (see to that effect C-301/06 Ireland v The Council and the Parliament). In that case the Irish government claimed that the Directive should have been enacted with another article than art. 114 TFEU as legal ground and to support their argument they held that the purpose of the Directive was to prevent serious crime. The court however, held that the purpose of the Directive was to harmonize how telecom providers retain information and consequently rejected the Irish claim. This raises question about how to define the purpose of a directive but also what the decision could have been if the Court’s proportionality test had been applied to the purpose defined by the Court in 2009.
Thirdly, from a Swedish perspective the judgment has had some interesting effects. Several swedish communication networks has stopped retaining data and Swedish Post and Telecom Authority, the authority responsible for enforcing the directive, has stopped with all actions based on the Data Retention Directive, despite that the transposing national law is still valid from a constitutional perspective. While that might be good from a human rights perspective it is also troubling since it precludes the possibility of challenging the validity of the Swedish law in relation to the Charter in a preliminary ruling.
Lastly, according to EU-commissioner Cecilia Malmström, the 3 million Euro that Sweden got in a fine in May last year (see to that effect case C-270/11), for not implementing the Data Retention Directive in time, will be repaid.
The Case C-293/12 and C-594/12 on the retention of data is probably one of the most interesting and
anticipated cases this year and I’ve been meaning to write about it since it was
published.The Data Retention Directive has been subject to a lot of political
debate and it raises questions about integrity, human rights and state control.
The fact the Court invalidated the Directive opens the door for those discussions
again and it might be a healthy injection in that debate
The Directive and fundamental rights
On the 11th of August 2006 Digital Rights Ireland (hereinafter DRI) decided to challenge the validity of the Data Retention Directive (Directive 2006/24) and the transposing national law, in an Irish court. DRI challenged the Irish authorities’ measures concerning the retention of data from a mobile phone DRI had registered on the 3 of June 2006. At the same time in Austria Mr. Seitlinger and 11 129 other persons, in a group challenge in the Austrian court, brought action against the national law transposing the Data Retention Directive. Both the Irish and the Austrian courts’ decided to halt the proceedings and to refer the cases to the CJEU that ruled on the invalidity of the Directive on the 8th of April.
The purpose of the Data Retention Directive is to harmonize the retention of data so as to prevent and investigate organized crime and terrorist threats. The Directive establishes tools for national authorities to get access to all data of all communication done by all individuals by stipulating rules and obligations for how public communication networks must retain data of electronic communication. The Directive covers practically all electronic communication and it requires the retention of all traffic data concerning fixed telephony, mobile telephony, internet access, e-mail and internet telephony. It covers all subscribers and registered users and according to the Court of Justice of the European Union it entails an interference with the fundamental rights of practically the entire European population (p. 56).
“[The data the communication networks must retain] include data necessary to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment, and to identify the location of mobile communication equipment, data which consist, inter alia, of the name and address of the subscriber or registered user, the calling telephone number, the number called and an IP address for Internet services.” (p. 26)
In the joined challenge brought by the applicants the Court decided to assess the validity of the Directive in the light of the right to respect for private life art. 7 CFREU (the Charter) and the right to protection of personal data in art. 8 of the Charter. Furthermore, the Court held that since the Directive enables national authorities to make specific conclusions of individuals’ life, with the potential consequence of people feeling limited to communicate with technology covered by the Directive, it could also be an infringement of the freedom of expression and information as stipulated in art. 11 of the Charter.
On the compatibility of the Directive in the light of the respect for private life, the Court held that an obligation on communication networks to retain information about peoples’ communication is an infringement of the respect for private life per se. Likewise, the Court held that the way the Directive provides for the processing of data is in breach of the right to protection of personal data. In addition, the fact that information is retained and used without the concerned person’s knowledge and that national authorities have access to that information increases that infringement. Whether the Directive was infringing on rights established by the Charter was clearly not hard for the Court to answer but that in itself however, does not give effect for the annulment of the Directive.
Limitations and justification
Limitations on the rights established by the Charter can be made if those limitations genuinely meet the objectives of a general interest and the limitations are proportionate to that aim art 52(1) of the Charter.
The fight against serious terrorism in order to secure international peace and the fight against serious crime in order to secure public security is such a general interest (see to that effect Kadi and Al Barakaat, Tsakouridis). Since the purpose of the Directive is to ensure that data are available for the purpose of the investigation, detection and prosecution of serious crime, it fulfills a justification on the basis of that general interest.
Concluding that the limitations satisfies the requirement of a general interest, the Court applied its traditional proportionality test, assessing whether the limitations are appropriate to achieve the aim of the general interest and whether it is necessary to achieve that aim.
The Court argued that even though the limitations are appropriate to achieve the general interest they cannot be considered necessary. The Directive stipulates that all information should be retained, consequently affecting all people within the EU irrespectively of when, where or whether the person concerned actually has a connection to crime. Furthermore, the Directive does not entail any objective criteria for when it is necessary for national authorities to gain access to retained information and it does not provide for any minimum requirements concerning security or safeguards against abuse. Therefore, because of the Directives broad and general application and the absence of security and safeguarding provisions, the Court concluded that the Directive cannot be considered necessary in the sense that it provides for the least violating measures in order to achieve the aim of preventing and investigating serious crime. Since the infringements could not be considered proportionate to the aim of a general interest the Court declared the Directive invalid.
Conclusion
Firstly, it must be noted that the Court’s decision to declare the Directive invalid was not because it infringed of the right to private life and the right to protection of data, rather the annulment was made because those infringements were not considered necessary to the aim of preventing and investigating serious crime. That is an indication by the Court that the retention of data can be used by member states and justified in relation to fundamental rights granted by the Charter, if the measures are less general and provide for safeguards concerning the processing of the data.
Secondly, what is quite controversial about this judgment is that the Court identifies the ambition to prevent serious crime as the purpose of the Directive. This is contrary to a previous validity challenge brought by Ireland in 2009 (see to that effect C-301/06 Ireland v The Council and the Parliament). In that case the Irish government claimed that the Directive should have been enacted with another article than art. 114 TFEU as legal ground and to support their argument they held that the purpose of the Directive was to prevent serious crime. The court however, held that the purpose of the Directive was to harmonize how telecom providers retain information and consequently rejected the Irish claim. This raises question about how to define the purpose of a directive but also what the decision could have been if the Court’s proportionality test had been applied to the purpose defined by the Court in 2009.
Thirdly, from a Swedish perspective the judgment has had some interesting effects. Several swedish communication networks has stopped retaining data and Swedish Post and Telecom Authority, the authority responsible for enforcing the directive, has stopped with all actions based on the Data Retention Directive, despite that the transposing national law is still valid from a constitutional perspective. While that might be good from a human rights perspective it is also troubling since it precludes the possibility of challenging the validity of the Swedish law in relation to the Charter in a preliminary ruling.
Lastly, according to EU-commissioner Cecilia Malmström, the 3 million Euro that Sweden got in a fine in May last year (see to that effect case C-270/11), for not implementing the Data Retention Directive in time, will be repaid.
No comments:
Post a Comment