The EU Court of Justice (CJEU) said that the indiscriminate collection and retention of personal communications data for national security means violates citizens rights
France, Beligum, and the UK are among a number of European countries that currently require their telecoms operators to collect and store customers’ traffic and location data for intelligence purposes.
However, a ruling today handed down by the CJEU has deemed that such measures are illegal unless there is a direct threat to national or public security.
The case was brought before the court by three different NGOs: Privacy International, Quadrature du Net, and the association of lawyers in the UK, France, and Belgium, respectively.
"Today’s judgment reinforces the rule of law in the EU," said Caroline Wilson Palow, the legal director of Privacy International. "In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies."
Such privacy battles have been ongoing for many years now. In 2014, a year after data privacy hit mainstream news when whistle-blower Edward Snowden revealed Verizon was storing public information for use by the National Security Agency, the CJEU ruled against similar collection and retention methods in the EU.
Since then, however, many countries have continued to fight for the right for these emergency measures on the grounds of national security and sovereignty; at the core of their argument is that the jurisdiction of the EU’s ePrivacy Directive does not extend to matters of national security. However, today’s ruling says otherwise, arguing that the retention of personal data from citizens without due cause is disproportionate to the threat and infringes upon citizens’ rights.
The ePrivacy Directive “precludes national legislation requiring providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security," said the court in a press release.
Measures for the acquisition and retention of data still remain available for national governments in emergencies, however.