56
The prohibition on the interception of communications and data relating thereto laid down in
Article 5(1) of Directive 2002/58 therefore encompasses any instance of providers of electronic
communications services making traffic data and location data available to public authorities, such as
the security and intelligence agencies, as well as the retention of that data by those authorities,
regardless of how that data is subsequently used.
57
Thus, in adopting that directive, the EU legislature gave concrete expression to the rights enshrined in
Articles 7 and 8 of the Charter, so that the users of electronic communications services are entitled to
expect, in principle, that their communications and data relating thereto will remain anonymous and
may not be recorded, unless they have agreed otherwise (judgment of 6 October 2020, La Quadrature
du Net and Others, C‑511/18, C‑512/18 and C‑520/18, paragraph 109).
58
However, Article 15(1) of Directive 2002/58 enables the Member States to introduce an exception to
the obligation of principle, laid down in Article 5(1) of that directive, to ensure the confidentiality of
personal data, and to the corresponding obligations, referred to, inter alia, in Articles 6 and 9 of that
directive, where this constitutes a necessary, appropriate and proportionate measure within a
democratic society to safeguard national security, defence and public security, and the prevention,
investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic
communication system. To that end, Member States may, inter alia, adopt legislative measures
providing for the retention of data for a limited period justified on one of those grounds.
59
That being said, the option to derogate from the rights and obligations laid down in Articles 5, 6 and 9
of Directive 2002/58 cannot permit the exception to the obligation of principle to ensure the
confidentiality of electronic communications and data relating thereto and, in particular, to the
prohibition on storage of that data, explicitly laid down in Article 5 of that directive, to become the rule
(see judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraphs 89
and 104, and judgment of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and
C‑520/18, paragraph 111).
60
In addition, it is apparent from the third sentence of Article 15(1) of Directive 2002/58 that the
Member States are not permitted to adopt legislative measures to restrict the scope of the rights and
obligations provided for in Articles 5, 6 and 9 of that directive unless they do so in accordance with the
general principles of EU law, including the principle of proportionality, and with the fundamental
rights guaranteed in the Charter. In that regard, the Court has previously held that the obligation
imposed on providers of electronic communications services by a Member State by way of national
legislation to retain traffic data for the purpose of making it available, if necessary, to the competent
national authorities raises issues relating to compatibility not only with Articles 7 and 8 of the Charter,
relating to the protection of privacy and to the protection of personal data, respectively, but also with
Article 11 of the Charter, relating to the freedom of expression (see, to that effect, judgments of 8 April
2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraphs 25 and
70, and of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraphs 91 and 92
and the case-law cited).
61
Those same issues also arise for other types of data processing, such as the transmission of that data to
persons other than users or access to that data with a view to its use (see, by analogy, Opinion 1/15
(EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraphs 122 and 123 and the caselaw cited).
62
Thus, the interpretation of Article 15(1) of Directive 2002/58 must take account of the importance
both of the right to privacy, guaranteed in Article 7 of the Charter, and of the right to protection of
personal data, guaranteed in Article 8 thereof, as derived from the case-law of the Court, as well as the
importance of the right to freedom of expression, given that that fundamental right, guaranteed in
Article 11 of the Charter, constitutes one of the essential foundations of a pluralist, democratic society,
and is one of the values on which, under Article 2 TEU, the Union is founded (see, to that effect,
judgments of 6 March 2001, Connolly v Commission, C‑274/99 P, EU:C:2001:127, paragraph 39, and
of 21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 93 and the case-law
cited).