CURIA - Documents
50 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 119 and
the case-law cited).
189
In addition, a decision authorising the real-time collection of traffic and location data must be
based on objective criteria provided for in the national legislation. In particular, that legislation must
define, in accordance with the case-law cited in paragraph 176 of the present judgment, the
circumstances and conditions under which such collection may be authorised and must provide that,
as was pointed out in the previous paragraph, only persons with a link to the objective of preventing
terrorism may be subject to such collection. In addition, a decision authorising the real-time
collection of traffic and location data must be based on objective and non-discriminatory criteria
provided for in national legislation. In order to ensure, in practice, that those conditions are
observed, it is essential that the implementation of the measure authorising real-time collection be
subject to a prior review carried out either by a court or by an independent administrative body
whose decision is binding, with that court or body having to satisfy itself, inter alia, that such realtime collection is authorised only within the limits of what is strictly necessary (see, to that effect,
judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 120). In
cases of duly justified urgency, the review must take place within a short time.
Notification of persons whose data has been collected or analysed
190
The competent national authorities undertaking real-time collection of traffic and location data
must notify the persons concerned, in accordance with the applicable national procedures, to the
extent that and as soon as that notification is no longer liable to jeopardise the tasks for which those
authorities are responsible. That notification is, indeed, necessary to enable the persons affected to
exercise their rights under Articles 7 and 8 of the Charter to request access to their personal data
that has been the subject of those measures and, where appropriate, to have the latter rectified or
erased, as well as to avail themselves, in accordance with the first paragraph of Article 47 of the
Charter, of an effective remedy before a tribunal, that right indeed being explicitly guaranteed in
Article 15(2) of Directive 2002/58, read in conjunction with Article 79(1) of Regulation 2016/679
(see, to that effect, judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970,
paragraph 121 and the case-law cited, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July
2017, EU:C:2017:592, paragraphs 219 and 220).
191
With regard to the notification required in the context of automated analysis of traffic and location
data, the competent national authority is obliged to publish information of a general nature relating
to that analysis without having to notify the persons concerned individually. However, if the data
matches the parameters specified in the measure authorising automated analysis and that authority
identifies the person concerned in order to analyse in greater depth the data concerning him or her,
it is necessary to notify that person individually. That notification must, however, occur only to the
extent that and as soon as it is no longer liable to jeopardise the tasks for which those authorities are
responsible (see, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017,
EU:C:2017:592, paragraphs 222 and 224).
192
In the light of all the foregoing, the answer to questions 2 and 3 in Case C‑511/18 is that
Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the
Charter, must be interpreted as not precluding national rules which requires providers of electronic
communications services to have recourse, first, to the automated analysis and real-time collection,
inter alia, of traffic and location data and, second, to the real-time collection of technical data
concerning the location of the terminal equipment used, where:
–
recourse to automated analysis is limited to situations in which a Member State is facing a
serious threat to national security which is shown to be genuine and present or foreseeable,
and where recourse to such analysis may be the subject of an effective review, either by a
court or by an independent administrative body whose decision is binding, the aim of that
review being to verify that a situation justifying that measure exists and that the conditions
2/15/2021, 4:58 PM