legislation must, first, lay down clear and precise rules
governing the scope and application of such a data retention
measure and imposing minimum safeguards, so that the
persons whose data has been retained have sufficient
guarantees of the effective protection of their personal data
against the risk of misuse. That legislation must, in particular,
indicate in what circumstances and under which conditions a
data retention measure may, as a preventive measure, be
adopted, thereby ensuring that such a measure is limited to
what is strictly necessary (see, by analogy, in relation to
Directive 2006/24, the Digital Rights judgment, paragraph 54
and the case-law cited).
110. Second, as regards the substantive conditions which must
be satisfied by national legislation that authorises, in the
context of fighting crime, the retention, as a preventive
measure, of traffic and location data, if it is to be ensured that
data retention is limited to what is strictly necessary, it must be
observed that, while those conditions may vary according to the
nature of the measures taken for the purposes of prevention,
investigation, detection and prosecution of serious crime, the
retention of data must continue nonetheless to meet objective
criteria, that establish a connection between the data to be
retained and the objective pursued. In particular, such
conditions must be shown to be such as actually to
circumscribe, in practice, the extent of that measure and, thus,
the public affected.
111. As regard the setting of limits on such a measure with
respect to the public and the situations that may potentially be
affected, the national legislation must be based on objective
evidence which makes it possible to identify a public whose
data is likely to reveal a link, at least an indirect one, with
serious criminal offences, and to contribute in one way or
another to fighting serious crime or to preventing a serious risk
to public security. Such limits may be set by using a
geographical criterion where the competent national
authorities consider, on the basis of objective evidence, that
there exists, in one or more geographical areas, a high risk of
preparation for or commission of such offences.
112. Having regard to all of the foregoing, the answer to the
first question referred in Case C-203/15 is that Article 15(1) of
Directive 2002/58, read in the light of Articles 7, 8 and 11 and
Article 52(1) of the Charter, must be interpreted as precluding
national legislation which, for the purpose of fighting crime,
provides for the general and indiscriminate retention of all
traffic and location data of all subscribers and registered users
relating to all means of electronic communication.”
Page 27