Judgment of the Court Grand Chamber of 5 April 2022, Commissioner of the Garda Síochána and Others, C-140/20

• Date: 05 April 2022
• Year: 2022

13

V. APPROXIMATION OF LAWS: PROTECTION OF PERSONAL DATA

Judgment of the Court (Grand Chamber) of 5 April 2022, Commissioner of the Garda

Síochána and Others, C-140/20

Link to the complete text of the judgment

Reference for a preliminary ruling – Processing of personal data in the electronic communications sector –

Confidentiality of the communications – Providers of electronic communications services – General and

indiscriminate retention of traffic and location data – Access to data – Subsequent court supervision –

Directive 2002/58/EC – Article 15(1) – Charter of Fundamental Rights of the European Union – Articles 7, 8

and 11 and Article 52(1) – Possibility for a national court to restrict the temporal effect of a declaration of

the invalidity of national legislation that is incompatible with EU law – Excluded

In recent years, the Court of Justice has ruled, in several judgments, on the retention of and access to

personal data in the field of electronic communications.

22

In particular, by two judgments of the Grand Chamber, of 6 October 2020,

23

the Court confirmed its

case-law resulting from the judgment in Tele2 Sverige as to the disproportionate nature of the general

and indiscriminate retention of traffic and location data. It also clarified inter alia the extent of the

powers that the Directive on privacy and electronic communications recognises Member States have

in respect of the retention of those data for the purposes of safeguarding of national security and

combating crime.

In this case, the request for a preliminary ruling was submitted by the Supreme Court (Ireland) in the

context of civil proceedings brought by a person sentenced to life imprisonment for a murder

committed in Ireland. That person challenged the compatibility with EU law of certain provisions of

national law on the retention of data generated in the context of electronic communications.

24

Pursuant to that law,

25

traffic and location data relating to the telephone calls of the person charged

had been retained by providers of electronic communications services and made accessible to the

police authorities. The referring court’s doubts related in particular to the compatibility with the

22

Thus, in the judgment of 8 April 2014, Digital Rights Ireland and Others (C-293/12 and C-594/12, EU:C:2014:238), the Court declared Directive

2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection

with the provision of publicly available electronic communications services or of public communications networks and amending Directive

2002/58/EC (OJ 2006 L 105, p. 54) invalid on the ground that the interference with the rights to respect for private life and to the protection

of personal data, recognised by the Charter of Fundamental Rights of the European Union (‘the Charter’), which resulted from the general

obligation to retain traffic and location data laid down by that directive was no t limited to what was strictly necessary. Next, in the judgment

of 21 December 2016, Tele2 Sverige and Watson and Others (C-203/15 and C-698/15, EU:C:2016:970), the Court held that Article 15(1) of

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the

protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37)

(‘the Directive on privacy and electronic communications’), as amended by Directive 2009/136/EC of the European Parliament and of the

Council of 25 November 2009 ( OJ 2009 L 337, p. 11), precludes national legislation providing for the general and indiscriminate retention of

traffic and location data for the purposes of combating crime. Lastly, in the judgment of 2 October 2018, Ministerio Fiscal (C-207/16,

EU:C:2018:788), the Court interpreted the same Article 15(1) in a case which concerned public authorities’ access to data relating to the civil

identity of users of means of electronic communication.

23

Judgments of 6 October 2020, Privacy International (C-623/17, EU:C:2020:790), and of 6 October 2020, La Quadrature du Net and Others

(C-511/18, C-512/18 and C-520/18, EU:C:2020:791).

24

Communications (Retention of Data) Act 2011. That law was adopted in order to transpose into Irish law Directive 2006/24.

25

The law permits, for reasons going beyond those inherent to the protection of national security, the preventative, general and indiscriminate

retention of traffic and location data of all subscribers for a period of two years.