Data retention and the future of large‐scale surveillance: The evolution and contestation of judicial benchmarks

• Published date: 01 January 2023
• Author: Valsamis Mitsilegas,Elspeth Guild,Elif Kuskonmaz,Niovi Vavoula
• Date: 01 January 2023
• DOI: http://doi.org/10.1111/eulj.12417

KALEIDOSCOPE: ORIGINAL ARTICLE

Data retention and the future of large-scale

surveillance: The evolution and contestation of

judicial benchmarks

Valsamis Mitsilegas | Elspeth Guild | Elif Kuskonmaz |

Niovi Vavoula

*

Abstract

Recent and upcoming judgments of the Court of Justice of the European Union (CJEU) have

resurfaced a much-debated topic on the legal limitations of law enforcement authorities and intelli-

gence services under EU law in implementing surveillance operations. In its decisions, the CJEU has

reinstated and at times remoulded its case-law on data retention, unearthing a variety of legal issues.

This article aims to critically analyse the legal limitations of (indiscriminate) surveillance measures,

the role of the private sector in the scheme, and the line between the competence of the Member

States and that of the EU on national security matters. It also aims to remark on the latest develop-

ments on the reception of the decisions by the Member States and the EU legislator, as well as on

the ongoing dialogue between the CJEU and the European Court of Human Rights (ECHR).

1|INTRODUCTION

The collection and analysis of telecommunications data by law enforcement authorities has been considered an

important security tool, with the interest of state authorities not being limited to data related to the content of

communications but extended also to the use of various types of telecommunications data—the so-called metadata.

As Schneier notes:

Telephone metadata alone reveals a lot about us. The timing, length and frequency of our

conversations reveal our relationships with others: our intimate friends, business associates and

* Valsamis Mitsilegas, Elspeth Guild and Niovi Vavoula are in the Department of Law, Queen Mary University of London. Elif Kuskonmaz is at the School

of Law, University of Portsmouth.

Received: 21 June 2021 Accepted: 3 March 2022

DOI: 10.1111/eulj.12417

This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which

permits use and distribution in any medium, provided the original work is properly cited, the use is non-commercial and no

modifications or adaptations are made.

© 2022 The Authors. European Law Journal published by John Wiley & Sons Ltd.

176 Eur Law J. 2023;29:176–211.

wileyonlinelibrary.com/journal/eulj

everyone in between. Phone metadata reveals what and who we are interested in and what is

important to us, no matter how private. It provides a window into our personalities. It yieldsa detailed

summary of what's happening to us at any point in time.

1

At the EU level, data retention obligations imposed on private providers were introduced in EU law via Directive

2006/24/EU (Data Retention Directive).

2

In the landmark judgment in Digital Rights Ireland,

3

the Court of Justice of

the European Union (CJEU) boldly annulled the Directive and rejected a model of mass surveillance based on general

and indiscriminate retention of telecommunications metadata. In the absence of EU legislation, several Member States

continued to apply national legislation on data retention. However, in Tele2 and Watson,

4

the Court examined those

national retention regimes within the remit of EU law, in particular its Directive 2002/58/EC concerning the

processing of personal data and the protection of privacy in the electronic communications sector (the e-Privacy

Directive), only to reiterate its findings and provide guidance to EU and national legislatures on permissible

surveillance.

5

However, the conflict between the CJEU's approach to mass surveillance of telecommunication metadata

and Member States' desire to maintain national retention schemes is far from resolved. More cases have

reached the Court on the compatibility of United Kingdom (UK), French and Belgian data retention laws with EU

law, and on 6 October 2020 two judgments were delivered. Privacy International concerned a preliminary

reference from the UK non-governmental organisation “Privacy International”that brought an action against the

British security and intelligence agencies, questioning the legality of the acquisition and use of bulk communica-

tion data by agencies such as the GCHQ, MI5 or MI6.

6

The referring court was unsure about the applicability of

EU law, given that, in accordance with Article 4 of the Treaty on European Union (TEU), national security falls

outside of the scope of EU law. As for La Quadrature du Net and Others,

7

the decision stemmed from preliminary

references from the French Council of State and Belgian Constitutional Court in disputes brought against

the French and Belgian governments, respectively, by numerous organisations that questioned the legality of

the respective national data retention regimes based on the EU Charter of Fundamental Rights, namely the

protections enshrined in its Article 7 on the right to privacy and its Article 8 on the right to protection of

personal data.

8

The two judgments must be read together. Privacy International sets the stage by bringing retention of tele-

communications metadata for national security purposes within the scope of EU law, thus settling an issue that

was highly disputed, both politically and academically. La Quadrature du Net and Others sets out the limits which

apply to state use of the national security exception to the protection of fundamental rights set out in the EU

Charter. Read together, and in line with the existing case-law, they constitute a revised EU legal framework within

which security services of all Member States must operate and which must be fully respected by both the

1

B. Schneier, Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World (W.W. Norton and Co., 2015) 24, cited in V. Mitsilegas, ‘The

Privatisation of Surveillance in the Digital Age’, in V. Mitsilegas and N. Vavoula (eds.), Surveillance and Privacy in the Digital Age: European, Transatlantic and

Global Perspectives (Hart, 2021), 101.

2

Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection

with the provision of publicly available electronic communications services of public communications networks and amending Directive 2002/58/EC,OJ

L105/54, 13.4.2006 (Data Retention Directive).

3

Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others (C-293/12) and

Kärntner Landesregierung and Others (C-594/12) [2014] ECLI:EU:C:2014:238.

4

Joined Cases C-203/15 and C-689/15, Tele2 Sverige AB v. Post- och telestyrelsen (C-203/15) and Secretary of State for the Home Department v. Tom Watson

and Others (C-689/15) [2016] ECLI:EU:C:2016:970.

5

Directive 2009/136/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation

(EC) No. 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws, OJ L337/11, 18.12.2009

(e-Privacy Directive).

6

Case C-623/17, Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others ECLI:EU:C:2020:790.

7

Joined Cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and Others v. Premier Ministre and Others, ECLI:EU:C:2020:791.

8

European Union, Charter of Fundamental Rights of the European Union, 26 October 2012, 2012/C 326/02 (Charter).

MITSILEGAS ET AL.177

national and EU legislatures. This guidance is of key importance in view of the ongoing revision of the e-Privacy

Directive,

9

with a number of Member States resisting obedience to the Court's findings.

10

Privacy International

and La Quadrature du Net and Others form the latest episode of the evolution of the Court's case-law on (indis-

criminate) data retention, and the resistance from Member States to the Court's rulings highlights the political

struggle between EU institutions and Member States on the future of mass surveillance. Amidst these issues, the

next question is how the CJEU (potentially in dialogue with the ECtHR) will succeed in facing the complex

institutional conflicts.

The CJEU, in a way, has initiated a perilous pas de deux, trying to ensure fundamental rights protection through

the applicability of EU law while opening the back door to mass surveillance through 'fifty shades' of public interests.

The evolution of the Court's case-law highlights the intricate institutional architecture at play when it comes to

defining the future of mass surveillance and democracy in the digital era, with a complex part played by thejudiciary,

the legislative and the executive in a multi-level polity such as the EU. It remains to be seen whether the European

formal system of checks and balances will be met substantially through the conciliation of the highest level of

fundamental rights protection with the imperatives of national security safeguards.

Against this background, this contribution aims to critically draw four lessons for the EU and national legislatures

with regard to (i) the public–private partnership for surveillance activities (Section 2); (ii) the codification of lawful

data retention (Section 3); (iii) the permissibility of and applicable criteria for automated analysis of traffic and loca-

tion data (Section 4); and (iv) the oversight of decisions on data retention (Section 5). Whereas these four themes by

no means provide an exhaustive analysis of the judgments, they pick out and attempt to elucidate particularly

contentious issues. Taking stock of the multilevel political and legal framework in which EU law inscribes itself, this

article further links the CJEU's findings with the latest developments on national courts' reactions to Member States'

resistance (Section 6) and the legislative reform of the Directive 2002/58/EC (e-Privacy Directive) (Section 7). It also

aims to consider the recent decisions of the European Court of Human Rights (ECtHR) on the bulk interception

regime and the question of case-law alignment between the ECtHR and the CJEU on restraining public authorities'

power to collect and use personal data (Section 8). A conclusion summarises the main findings of the research and

the key legal questions that remain open (Section 9).

2|SURVEILLANCE AS A PUBLIC–PRIVATE PARTNERSHIP: THE

QUESTION OF THE APPLICABLE LAW

The adoption of EU legislation on data retention of telecommunication metadata has brought to the fore the role of

the private sector in being co-opted by the state into assuming tasks of generalised and indiscriminate surveillance.

11

As mentioned above, despite the annulment of the Data Retention Directive, EU Member States either continued to

apply domestic legislation on retention of telecommunications data or introduced new legislation, much of which

enabled the very forms of generalised surveillance found unlawful in Digital Rights Ireland. In this context, a key and

primary question for safeguarding fundamental rights is whether EU law applies in those cases where there is no

specific EU secondary legislation on data retention but retention is mandated by national law. In approaching this

question in a series of judgments, the CJEU has centred its analysis on the nature of this public–privatepartnership

in the field of surveillance and extended the reach of EU law by focusing on the key role of the private sector in

enabling a system of generalised surveillance under data retention duties.

9

See Section 7in this regard.

10

See Section 6in this regard.

11

Mitsilegas, above, n. 1.

178 MITSILEGAS ET AL.