CURIA - Documents
44 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
possible for that data to be associated with information on the communications made, are capable of
being justified by the objective of preventing, investigating, detecting and prosecuting criminal
offences in general, to which the first sentence of Article 15(1) of Directive 2002/58 refers (see, to
that effect, judgment of 2 October 2018, Ministerio Fiscal, C‑207/16, EU:C:2018:788,
paragraph 62).
159
In those circumstances, having regard to the balance that must be struck between the rights and
interests at issue, and for the reasons set out in paragraphs 131 and 158 of the present judgment, it
must be held that, even in the absence of a connection between all users of electronic
communications systems and the objectives pursued, Article 15(1) of Directive 2002/58, read in the
light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not preclude a legislative measure
which requires providers of electronic communications services, without imposing a specific time
limit, to retain data relating to the civil identity of all users of electronic communications systems
for the purposes of preventing, investigating, detecting and prosecuting criminal offences and
safeguarding public security, there being no need for the criminal offences or the threats to or acts
having adverse effects on public security to be serious.
–
Legislative measures providing for the expedited retention of traffic and location data for the
purpose of combating serious crime
160
With regard to traffic and location data processed and stored by providers of electronic
communications services on the basis of Articles 5, 6 and 9 of Directive 2002/58 or on the basis of
legislative measures taken under Article 15(1) of that directive, as described in paragraphs 134 to
159 of the present judgment, it should be noted that that data must, in principle, be erased or made
anonymous, depending on the circumstances, at the end of the statutory periods within which that
data must be processed and stored in accordance with the national provisions transposing that
directive.
161
However, during that processing and storage, situations may arise in which it becomes necessary to
retain that data after those time periods have ended in order to shed light on serious criminal
offences or acts adversely affecting national security; this is the case both in situations where those
offences or acts having adverse effects have already been established and where, after an objective
examination of all of the relevant circumstances, such offences or acts having adverse effects may
reasonably be suspected.
162
In that regard, the Council of Europe’s Convention on Cybercrime of 23 November 2001
(European Treaty Series – No. 185), which was signed by the 27 Member States and ratified by 25
of them and has as its objective to facilitate the fight against criminal offences committed using
computer networks, provides, in Article 14, that the parties to the convention are to adopt, for the
purpose of specific criminal investigations or proceedings, certain measures concerning traffic data
already stored, such as the expedited preservation of that data. In particular, Article 16(1) of that
convention stipulates that the parties to that convention are to adopt such legislative measures as
may be necessary to enable their competent authorities to order or similarly obtain the expedited
preservation of traffic data that has been stored by means of a computer system, in particular where
there are grounds to believe that that data is particularly vulnerable to loss or modification.
163
In a situation such as the one described in paragraph 161 of the present judgment, in the light of the
balance that must be struck between the rights and interests at issue referred to in paragraph 130 of
the present judgment, it is permissible for Member States to provide, in legislation adopted pursuant
to Article 15(1) of Directive 2002/58, for the possibility of instructing, by means of a decision of
the competent authority which is subject to effective judicial review, providers of electronic
communications services to undertake the expedited retention of traffic and location data at their
disposal for a specified period of time.
164
To the extent that the purpose of such expedited retention no longer corresponds to the purpose for
2/15/2021, 4:58 PM