Fundamental rights in CJEU data retention case law: A refined regime in response to Member States’ concerns, or compensating for the lack of legislative intervention in the digital age?
Keywords:
Court of Justice of the European Union (CJEU), data retention, access to data retained, fundamental rights, national security, combatting (serious) crime, e-Privacy Directive, e-Privacy Regulation, digital governanceAbstract
Data retention laws in the EU Member States entered a state of flux following Digital Rights Ireland and the annulment of Directive 2006/24/EC as a violation of the fundamental rights to respect for private life and to the protection of personal data. For many Member States, it remained unclear what impact the invalidation of the directive should have on domestic data retention regimes. In subsequent case law, the CJEU sought to clarify the requirements deriving from EU law for national data retention legislation. While the CJEU has ruled that EU law in principle precludes national rules that prescribe a general and indiscriminate retention of traffic and location data by providers of electronic communications services and networks, it has also carved out exceptions that may justify interference with fundamental rights. Relevant cases have attracted much attention, with many national governments reaching out to the CJEU through observations submitted on what is admittedly a particularly complex and sensitive field of law. This article studies CJEU data retention case law and its evolution, examining the ways in which the CJEU has positioned itself vis-à-vis Member States’ arguments on the balance to strike between fundamental rights’ protection on the one hand and safeguarding national security and fighting (serious) crime on the other. The analysis shows how the CJEU has progressively refined and recalibrated its jurisprudence to acquiesce in part with Member States’ demands. It also attests to the important role played by the CJEU in digital governance and the protection of fundamental rights in the absence of legislative intervention that addresses the particularities of the digital realm: the CJEU interprets the existing norms afresh, shapingthe fundamental rights requirements applicable to Member States’ data retention regimes.