76
However, in order to satisfy the requirement of proportionality referred to in paragraph 67 above,
according to which derogations from and limitations on the protection of personal data must apply only
in so far as is strictly necessary, national legislation entailing interference with the fundamental rights
enshrined in Articles 7 and 8 of the Charter must meet the requirements stemming from the case-law
cited in paragraphs 65, 67 and 68 above.
77
In particular, as regards an authority’s access to personal data, legislation cannot confine itself to
requiring that authorities’ access to the data be consistent with the objective pursued by that legislation,
but must also lay down the substantive and procedural conditions governing that use (see, by analogy,
Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 192 and the
case-law cited).
78
Accordingly, and since general access to all retained data, regardless of whether there is any link, at
least indirect, with the aim pursued, cannot be regarded as being limited to what is strictly necessary,
national legislation governing access to traffic data and location data must rely on objective criteria in
order to define the circumstances and conditions under which the competent national authorities are to
be granted access to the data at issue (see, to that effect, judgment of 21 December 2016, Tele2,
C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 119 and the case-law cited).
79
Those requirements apply, a fortiori, to a legislative measure, such as that at issue in the main
proceedings, on the basis of which the competent national authority may require providers of electronic
communications services to disclose traffic data and location data to the security and intelligence
agencies by means of general and indiscriminate transmission. Such transmission has the effect of
making that data available to the public authorities (see, by analogy, Opinion 1/15 (EU-Canada PNR
Agreement) of 26 July 2017, EU:C:2017:592, paragraph 212).
80
Given that the transmission of traffic data and location data is carried out in a general and
indiscriminate way, it is comprehensive in that it affects all persons using electronic communications
services. It therefore applies even to persons for whom there is no evidence to suggest that their
conduct might have a link, even an indirect or remote one, with the objective of safeguarding national
security and, in particular, without any relationship being established between the data which is to be
transmitted and a threat to national security (see, to that effect, judgments of 8 April 2014, Digital
Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraphs 57 and 58, and of
21 December 2016, Tele2, C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 105). Having regard to
the fact that the transmission of such data to public authorities is equivalent, in accordance with the
finding in paragraph 79 above, to access, it must be held that legislation which permits the general and
indiscriminate transmission of data to public authorities entails general access.
81
It follows that national legislation requiring providers of electronic communications services to
disclose traffic data and location data to the security and intelligence agencies by means of general and
indiscriminate transmission exceeds the limits of what is strictly necessary and cannot be considered to
be justified, within a democratic society, as required by Article 15(1) of Directive 2002/58, read in the
light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter.
82
In the light of all the foregoing considerations, the answer to the second question is that Article 15(1)
of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of
the Charter, must be interpreted as precluding national legislation enabling a State authority to require
providers of electronic communications services to carry out the general and indiscriminate
transmission of traffic data and location data to the security and intelligence agencies for the purpose of
safeguarding national security.
Costs
83
Since these proceedings are, for the parties to the main proceedings, a step in the action pending
before the national court, the decision on costs is a matter for that court. Costs incurred in submitting
observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules: