28.
After discussion by the Court of both statutes in the light of its conclusions on
the scope of the Directive, the part of its Judgment containing the Watson
Requirements is in paragraphs 119 to 125:
“119. Accordingly, and since general access to all retained
data, regardless of whether there is any link, at least indirect,
with the intended purpose, cannot be regarded as limited to
what is strictly necessary, the national legislation concerned
must be based on objective criteria in order to define the
circumstances and conditions under which the competent
national authorities are to be granted access to the data of
subscribers or registered users. In that regard, access can, as a
general rule, be granted, in relation to the objective of fighting
crime, only to the data of individuals suspected of planning,
committing or having committed a serious crime or of being
implicated in one way or another in such a crime (see, by
analogy, ECtHR, 4 December 2015,Zakharov v. Russia,
CE:ECHR:2015:1204JUD0047143 06, § 260). However, in
particular situations, where for example vital national security,
defence or public security interests are threatened by terrorist
activities, access to the data of other persons might also be
granted where there is objective evidence from which it can be
deduced that that data might, in a specific case, make an
effective contribution to combating such activities.
120. In order to ensure, in practice, that those conditions are
fully respected, it is essential that access of the competent
national authorities to retained data should, as a general rule,
except in cases of validly established urgency, be subject to a
prior review carried out either by a court or by an independent
administrative body, and that the decision of that court or body
should be made following a reasoned request by those
authorities submitted, inter alia, within the framework of
procedures for the prevention, detection or prosecution of
crime (see, by analogy, in relation to Directive 2006/24, the
Digital Rights judgment, paragraph 62; see also, by analogy,
in relation to Article 8 of the ECHR, ECtHR, 12 January 2016,
Szabó and Vissy v. Hungary, CE:ECHR:2016:0112JUD0037
13814, §§ 77 and 80).
121. Likewise, the competent national authorities to whom
access to the retained data has been granted must notify the
persons affected, under the applicable national procedures, as
soon as that notification is no longer liable to jeopardise the
investigations being undertaken by those authorities. That
notification is, in fact, necessary to enable the persons affected
to exercise, inter alia, their right to a legal remedy, expressly
Page 28