On 8 April 2014, the Court of Justice of the European Union threw out the EU’s Data Retention Directive. The case was brought by Digital Rights Ireland against the Irish authorities and others, and the court’s reasoning was short: blanket collection of data violated the EU Charter of Fundamental Rights, in particular the right to privacy in Article 8(1).
The directive, Directive 2006/24/EC, had been passed on 15 March 2006. It required member states to keep telecommunications data on all citizens, covering phone and internet connections, for at least six months and at most twenty-four. Police were entitled to request it.
The data included IP addresses and the time of use for every email, phone call and text message sent or received. Nothing in the directive said a court had to approve access.
How it was made
The route to the law started in September 2005, when the UK held the presidency of the European Council. A plenary session on retaining telecommunications data was chaired by the UK’s Home Secretary. The Council reached an agreement at its meeting on 1 and 2 December, and the directive was adopted in March 2006 under the Austrian presidency.
Opposition came from a wide range of people. Physicians, journalists, privacy and human rights groups, unions, IT security firms and legal experts all raised serious concerns.
Romania pushes back
Each member state had to write the directive into its own law. Romania’s first attempt was Law 298/2008. In 2009 the Constitutional Court of Romania struck it down, holding that it violated the constitutional rights to privacy, confidentiality of communications and free speech.
The European Commission responded in 2011 by suing Romania for failing to implement the directive, and threatened a fine of 30,000 euros a day.
Parliament passed a replacement in 2012, and President Traian Basescu signed it in June. Law 82/2012 became known as “the Big Brother law”, a name used by Romanian non-governmental organisations opposed to it and by the Romanian media. On 8 July 2014, three months after the EU court’s ruling, the Constitutional Court declared that law unconstitutional too.
After the ruling
The Council’s Legal Services reportedly said in closed session that paragraph 59 of the court’s judgment “suggests that general and blanket data retention is no longer possible.”
A legal opinion funded by the Greens-European Free Alliance in the European Parliament went further. It found that blanket retention of data on people who are not suspected of anything generally violates the Charter, for national retention laws and for comparable EU schemes alike.
