CURIA - Documents
48 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
particular, such legislation cannot be limited to requiring that the authorities’ access to such data
should correspond to the objective pursued by that legislation, but must also lay down the
substantive and procedural conditions governing that use (see, by analogy, Opinion 1/15 (EUCanada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 192 and the case-law cited).
177
In that regard, it should be noted that the particularly serious interference that is constituted by the
general and indiscriminate retention of traffic and location data, as referred to in the findings in
paragraphs 134 to 139 of the present judgment, and the particularly serious interference constituted
by the automated analysis of that data can meet the requirement of proportionality only in situations
in which a Member State is facing a serious threat to national security which is shown to be genuine
and present or foreseeable, and provided that the duration of that retention is limited to what is
strictly necessary.
178
In situations such as those referred to in the previous paragraph, the implementation of automated
analysis of the traffic and location data of all users of electronic communications systems, for a
strictly limited period, may be considered to be justified in the light of the requirements stemming
from Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1)
of the Charter.
179
That being said, in order to guarantee that such a measure is actually limited to what is strictly
necessary in order to protect national security and, more particularly, to prevent terrorism, in
accordance with what was held in paragraph 139 of the present judgment, it is essential that the
decision authorising automated analysis be subject to effective review, either by a court or by an
independent administrative body whose decision is binding, the aim of that review being to verify
that a situation justifying that measure exists and that the conditions and safeguards that must be
laid down are observed.
180
In that regard, it should be noted that the pre-established models and criteria on which that type of
data processing are based should be, first, specific and reliable, making it possible to achieve results
identifying individuals who might be under a reasonable suspicion of participation in terrorist
offences and, second, should be non-discriminatory (see, to that effect, Opinion 1/15 (EU-Canada
PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 172).
181
In addition, it must be noted that any automated analysis carried out on the basis of models and
criteria founded on the premiss that racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade-union membership, or information about a person’s health or sex life
could, in themselves and regardless of the individual conduct of that person, be relevant in order to
prevent terrorism would infringe the rights guaranteed in Articles 7 and 8 of the Charter, read in
conjunction with Article 21 thereof. Therefore, pre-established models and criteria for the purposes
of an automated analysis that has as its objective the prevention of terrorist activities that constitute
a serious threat to national security cannot be based on that sensitive data in isolation (see, to that
effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592,
paragraph 165).
182
Furthermore, since the automated analyses of traffic and location data necessarily involve some
margin of error, any positive result obtained following automated processing must be subject to an
individual re-examination by non-automated means before an individual measure adversely
affecting the persons concerned is adopted, such as the subsequent real-time collection of traffic and
location data, since such a measure cannot be based solely and decisively on the result of automated
processing. Similarly, in order to ensure that, in practice, the pre-established models and criteria, the
use that is made of them and the databases used are not discriminatory and are limited to that which
is strictly necessary in the light of the objective of preventing terrorist activities that constitute a
serious threat to national security, a regular re-examination should be undertaken to ensure that
those pre-established models and criteria and the databases used are reliable and up to date (see, to
that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592,
2/15/2021, 4:58 PM