The European Court of Justice (ECJ) today declared that the EU’s Data Retention Directive is null and void, proclaiming that the collection of Internet data on a mass scale in Europe occasioned “wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data”. The Directive directed European Member States to obliged Internet Service Providers (ISPs) to capture data records relating to their users’ activity, to retain such data for up to two years, and to provide access to such records to the police and security services. The ECJ joined the United Nations’ Human Rights Committee, which last month petitioned the United States to desist from requiring binding data retention by third parties.

The ECJ decision is clearly an important milestone for human rights and privacy advocacy groups that have had to fight hard to defeat the original Europe-wide law. Digital Rights Ireland, was the first to legally challenge the Irish Government on its implementation of the Directive.  AK Vorrat Austria, followed suit to engineer the rejection of the Data Retention Directive in Austria, in the face of resolute opposition from Austria’s government officials.

While the ECJ decision rejects the current directive in its entirety, some Member States may still try to retain their laws, whereas others could become champions of their citizens’ privacy. Krista Kiuru, the Finnish Minister of Communications, has already avowed a comprehensive review of Finnish law in the light of the decision, declaring that “Finnish legislation has to respect the fundamental rights and rule of law”. The German and Romanian national constitutional courts have already declared their data retention laws unlawful. Governments supporting retention like, for instance, the UK Government, may challenge the ECJ ruling arguing that they can still keep their national data retention laws. There may also be an attempt, in line with past European Commission actions, to introduce an entirely new data retention directive to comply with the ECJ’s decision. The European Commission has, in fact, tried this course of action, many a time successfully in the past.

However, one thing is for sure. The demise of the data retention regime in Europe sets an important precedent for other countries who are treading the same path as the EU. This includes countries like Brazil and the United States, where the issue is particularly sensitive following the NSA spying scandal and Snowden’s revelations. In this regard, the ECJ’s decision unequivocally makes a case for the classification of indiscriminate recording and storage of every aspect of innocent civilians’ online activities as a mockery of human rights, irrespectively of how the collected data is stored.

Equinox Advisory provides its clients with assistance in ICT law and regulation. Please contact us on here for assistance.