for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 [of that directive]’ (judgment of
21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 71).
38
Article 15(1) of Directive 2002/58 necessarily presupposes that the national legislative measures
referred to therein fall within the scope of that directive, since it expressly authorises the Member
States to adopt them only if the conditions laid down in the directive are met. Further, such measures
regulate, for the purposes mentioned in that provision, the activity of providers of electronic
communications services (judgment of 2 October 2018, Ministerio Fiscal, C‑207/16, EU:C:2018:788,
paragraph 34 and the case-law cited).
39
It is in the light of, inter alia, those considerations that the Court has held that Article 15(1) of
Directive 2002/58, read in conjunction with Article 3 thereof, must be interpreted as meaning that the
scope of that directive extends not only to a legislative measure that requires providers of electronic
communications services to retain traffic data and location data, but also to a legislative measure
requiring them to grant the competent national authorities access to that data. Such legislative measures
necessarily involve the processing, by those providers, of the data and cannot, to the extent that they
regulate the activities of those providers, be regarded as activities characteristic of States, referred to in
Article 1(3) of Directive 2002/58 (see, to that effect, judgment of 2 October 2018, Ministerio Fiscal,
C‑207/16, EU:C:2018:788, paragraphs 35 and 37 and the case-law cited).
40
Concerning a legislative measure such as section 94 of the 1984 Act, on the basis of which the
competent authority may give the providers of electronic communications services a direction to
disclose bulk data to the security and intelligence agencies by transmission, it should be noted that,
pursuant to the definition provided in Article 4(2) of Regulation 2016/679, which, according to
Article 2 of Directive 2002/58, read in conjunction with Article 94(2) of that regulation, is applicable,
the concept of ‘the processing of personal data’ designates ‘any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not by automated means, such as
collection, … storage, … consultation, use, disclosure by transmission, dissemination or otherwise
making available …’.
41
It follows that the disclosure of personal data by transmission, like the storage or otherwise making
available of data, constitutes processing for the purposes of Article 3 of Directive 2002/58 and,
accordingly, falls within the scope of that directive (see, to that effect, judgment of 29 January 2008,
Promusicae, C‑275/06, EU:C:2008:54, paragraph 45).
42
In addition, having regard to the considerations set out in paragraph 38 above and the general scheme
of Directive 2002/58, an interpretation of that directive under which the legislative measures referred
to in Article 15(1) thereof were excluded from the scope of that directive because the objectives which
such measures must pursue overlap substantially with the objectives pursued by the activities referred
to in Article 1(3) of that same directive would deprive Article 15(1) thereof of any practical effect (see,
to that effect, judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970,
paragraphs 72 and 73).
43
The concept of ‘activities’ referred to in Article 1(3) of Directive 2002/58 cannot therefore, as was
noted, in essence, by the Advocate General in point 75 of his Opinion in Joined Cases La Quadrature
du Net and Others (C‑511/18 and C‑512/18, EU:C:2020:6), to which he makes reference in point 24 of
his Opinion in the present case, be interpreted as covering the legislative measures referred to in
Article 15(1) of that directive.
44
Article 4(2) TEU, to which the governments listed in paragraph 32 above have made reference, cannot
invalidate that conclusion. Indeed, according to the settled case-law of the Court, although it is for the
Member States to define their essential security interests and to adopt appropriate measures to ensure
their internal and external security, the mere fact that a national measure has been taken for the purpose
of protecting national security cannot render EU law inapplicable and exempt the Member States from
their obligation to comply with that law (see, to that effect, judgments of 4 June 2013, ZZ, C‑300/11,
EU:C:2013:363, paragraph 38 and the case-law cited; of 20 March 2018, Commission v Austria (State
printing office), C‑187/16, EU:C:2018:194, paragraphs 75 and 76; and of 2 April 2020, Commission v
Poland, Hungary and Czech Republic (Temporary mechanism for the relocation of applicants for