CURIA - Documents
45 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
which that data was initially collected and retained and since any processing of data must, under
Article 8(2) of the Charter, be consistent with specified purposes, Member States must make clear,
in their legislation, for what purpose the expedited retention of data may occur. In the light of the
serious nature of the interference with the fundamental rights enshrined in Articles 7 and 8 of the
Charter which such retention may entail, only action to combat serious crime and, a fortiori, the
safeguarding of national security are such as to justify such interference. Moreover, in order to
ensure that the interference entailed by a measure of that kind is limited to what is strictly
necessary, first, the retention obligation must relate only to traffic and location data that may shed
light on the serious criminal offences or the acts adversely affecting national security concerned.
Second, the duration for which such data is retained must be limited to what is strictly necessary,
although that duration can be extended where the circumstances and the objective pursued by that
measure justify doing so.
165
In that regard, such expedited retention need not be limited to the data of persons specifically
suspected of having committed a criminal offence or acts adversely affecting national security.
While it must comply with the framework established by Article 15(1) of Directive 2002/58, read in
the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, and taking into account the
findings in paragraph 133 above, such a measure may, at the choice of the legislature and subject to
the limits of what is strictly necessary, be extended to traffic and location data relating to persons
other than those who are suspected of having planned or committed a serious criminal offence or
acts adversely affecting national security, provided that that data can, on the basis of objective and
non-discriminatory factors, shed light on such an offence or acts adversely affecting national
security, such as data concerning the victim thereof, his or her social or professional circle, or even
specified geographical areas, such as the place where the offence or act adversely affecting national
security at issue was committed or prepared. Additionally, the competent authorities must be given
access to the data thus retained in observance of the conditions that emerge from the case-law on
how Directive 2002/58 is to be interpreted (see, to that effect, judgment of 21 December 2016,
Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraphs 118 to 121 and the case-law cited).
166
It should also be added that, as is clear, in particular, from paragraphs 115 and 133 above, access to
traffic and location data retained by providers in accordance with a measure taken under
Article 15(1) of Directive 2002/58 may, in principle, be justified only by the public interest
objective for which those providers were ordered to retain that data. It follows, in particular, that
access to such data for the purpose of prosecuting and punishing an ordinary criminal offence may
in no event be granted where the retention of such data has been justified by the objective of
combating serious crime or, a fortiori, by the objective of safeguarding national security. However,
in accordance with the principle of proportionality, as mentioned in paragraph 131 above, access to
data retained for the purpose of combating serious crime may, provided that the substantive and
procedural conditions associated with such access referred to in the previous paragraph are
observed, be justified by the objective of safeguarding national security.
167
In that regard, it is permissible for Member States to specify in their legislation that access to traffic
and location data may, subject to those same substantive and procedural conditions, be permitted for
the purpose of combating serious crime or safeguarding national security where that data is retained
by a provider in a manner that is consistent with Articles 5, 6 and 9 or Article 15(1) of Directive
2002/58.
168
In the light of all of the above considerations, the answer to question 1 in Cases C‑511/18 and
C‑512/18 and questions 1 and 2 in Case C‑520/18 is that Article 15(1) of Directive 2002/58, read in
the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding
legislative measures which, for the purposes laid down in Article 15(1), provide, as a preventive
measure, for the general and indiscriminate retention of traffic and location data. By contrast,
Article 15(1), read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not
preclude legislative measures that:
2/15/2021, 4:58 PM