The Court of Justice of the European Union has ruled in the case of Case C-140/20 Commissioner of An Garda Síochána and others.
In 2015, GD was sentenced to life imprisonment for murder. He appealed against his conviction, in particular contesting the use of traffic and location data relating to telephone calls as evidence.
The Irish Supreme Court referred the case to the CJEU and sought clarification about the requirements of EU law regarding the retention of data to combat serious crime and as to the necessary safeguards in respect of access to that data. It also had doubts about the scope and time period of a possible declaration of invalidity that it might make, because the Irish legislation had been adopted to transpose Directive 2006/24/EC which was declared invalid by the CJEU in 2014 in the case of Digital Rights Ireland and others.
The CJEU confirmed that EU case law precludes national legislative measures which provide, as a preventative measure, for the general and indiscriminate retention of traffic and location data relating to electronic communications, to combat serious crime.
It said that the Privacy and Electronic Communications Directive does not merely create a framework for access to such data through safeguards to prevent abuse, but enshrines the principle of the prohibition of the storage of traffic and location data. Therefore the retention of traffic and location data is a derogation from that prohibition. It is also an interference with the fundamental rights to the respect for private life and the protection of personal data, under Articles 7 and 8 of the Charter.
Although the Directive permits limitations on the exercise of those rights and obligations to combat crime, such limitations must be proportionate in relation to the objective pursued.
In addition, public authorities have various positive obligations under the Charter, consisting for example of the adoption of legal provisions to protect private and family life, home and communications, and also the protection of the individual’s physical and mental integrity and the prohibition of torture and inhuman and degrading treatment. It is necessary therefore for them to strike a balance between the various interests and rights in question.
Therefore, the court rejected the argument that particularly serious crime could be treated in the same way as a threat to national security.
However, the Court confirmed that EU law does not preclude legislative measures to combat serious crime and preventing serious threats to public security:
- the targeted retention of traffic and location data which is limited, according to the categories of persons concerned or using a geographical criterion;
- the general and indiscriminate retention of IP addresses assigned to the source of an internet connection;
- the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems; and
- the expedited retention (quick freeze) of traffic and location data in the possession of those service providers.
It said that Directive 2002/58 precludes national legislation under which the centralised processing of requests for access to data, which have been retained by providers of electronic communications services, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, who is assisted by a unit established within the police service which has a degree of autonomy in the exercise of its duties, and whose decisions may subsequently be subject to judicial review.
EU law also precludes a national court from limiting the times period for a declaration of invalidity which it is bound to make, under national law, with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data, owing to the incompatibility of that legislation with Directive 2002/58 as amended. The admissibility of such evidence is a matter for national law.
