The Court of Justice of the European Union ruled yesterday that “general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication” by governments is prohibited by EU law. The ruling is especially significant for the United Kingdom’s new Investigatory Powers Act, which could face new legal challenges as a result.
In its ruling, the Court concluded that “general and indiscriminate retention” was a “very far-reaching” and “particularly serious” interference with Articles 7 and 8 of the EU Charter of Fundamental Rights. The Court also concluded that such retention must be restricted to “fighting serious crime.” It said access to retained data should be “subject to prior review by a court or an independent administrative authority” except in cases of “validly established urgency,” and the affected persons should be notified that access has been given to their retained data “as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities” and the relevant data “should be retained within the European Union.”
The full case write-up can be read here. And please stay tuned to Just Security as we continue to cover the judgment and what it means for national surveillance legislation across Europe.