SZABÓ AND VISSY v. HUNGARY JUDGMENT
19
IV. OTHER RELEVANT INTERNATIONAL TEXTS
22. Several elements of international law, relevant in this context, are
outlined in the judgment Dragojević v. Croatia (no. 68955/11, §§ 62 to 66,
15 January 2015).
23. In Digital Rights Ireland v Minister for Communications & Others,
(cases C-293/12 and C-594/12, 8 April 2014), the Court of Justice of the
European Union held as follows:
“26. In that regard, it should be observed that the data which providers of publicly
available electronic communications services or of public communications networks
must retain, pursuant to Articles 3 and 5 of Directive 2006/24, include data necessary
to trace and identify the source of a communication and its destination, to identify the
date, time, duration and type of a communication, to identify users’ communication
equipment, and to identify the location of mobile communication equipment, data
which consist, inter alia, of the name and address of the subscriber or registered user,
the calling telephone number, the number called and an IP address for Internet
services. Those data make it possible, in particular, to know the identity of the person
with whom a subscriber or registered user has communicated and by what means, and
to identify the time of the communication as well as the place from which that
communication took place. They also make it possible to know the frequency of the
communications of the subscriber or registered user with certain persons during a
given period.
27. Those data, taken as a whole, may allow very precise conclusions to be drawn
concerning the private lives of the persons whose data has been retained, such as the
habits of everyday life, permanent or temporary places of residence, daily or other
movements, the activities carried out, the social relationships of those persons and the
social environments frequented by them.
...
52. So far as concerns the right to respect for private life, the protection of that
fundamental right requires, according to the Court’s settled case-law, in any event,
that derogations and limitations in relation to the protection of personal data must
apply only in so far as is strictly necessary (Case C-473/12 IPI EU:C: 2013:715,
paragraph 39 and the case-law cited).
...
62. In particular, Directive 2006/24 does not lay down any objective criterion by
which the number of persons authorised to access and subsequently use the data
retained is limited to what is strictly necessary in the light of the objective pursued.
Above all, the access by the competent national authorities to the data retained is not
made dependent on a prior review carried out by a court or by an independent
administrative body whose decision seeks to limit access to the data and their use to
what is strictly necessary for the purpose of attaining the objective pursued and which
intervenes following a reasoned request of those authorities submitted within the
framework of procedures of prevention, detection or criminal prosecutions. Nor does
it lay down a specific obligation on Member States designed to establish such limits.”
24. The 2013 Report of the United Nations Special Rapporteur on the
promotion and protection of the right to freedom of opinion and expression,
Frank La Rue, contains the following conclusions and recommendations: