In a judgement released this morning the Court of Justice of the European Union (CJEU), the EU’s highest court, has ruled that the Data Retention Directive is incompatible with fundamental principles of European law.
The CJEU has objected to the Directive on the grounds of proportionality, and because it fails to balance the requirement for data retention with requirements to safeguard the data retained. The Court also objects to the failure to require the data to be retained within the EU, the lack of specified criteria to justify retention periods longer than six months, and the failure to prescribe access criteria or procedures.
The CJEU ruling holds the Directive as invalid from the moment of inception, but does not preclude the EU passing new legislation on data retention on the future, nor does it preclude Member States from passing their own legislation. In theory, national legislation to implement the Directive might be invalid as a result of this move or might simply be redesignated as a purely national matter.
Update 16th April 2014: The Home Office has been in touch with LINX to say that the UK government considers that the Data Retention (EC Directive) Regulations 2009 are still in force. Communications providers in receipt of notices from the Secretary of State under those Regulations should, in the government’s opinion, continue to comply with the requirements set out in the notice. This is despite the fact that those Regulations were made under the powers conferred by the European Communities Act 1972 for the purpose of implementing EU law.