CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
25
objective of fighting against serious crime. It therefore entailed an
interference with the fundamental rights of practically the entire European
population, even to persons for whom there was no evidence capable of
suggesting that their conduct might have a link, even an indirect or remote
one, with serious crime. Furthermore, the directive did not contain
substantive and procedural conditions relating to the access of the
competent national authorities to the data and to their subsequent use. By
simply referring to serious crime, as defined by each member State in its
national law, the directive failed to lay down any objective criterion by
which to determine which offences might be considered to be sufficiently
serious to justify such an extensive interference with the rights enshrined in
Articles 7 and 8 of the Charter. Above all, the access by the competent
national authorities to the data retained was not made dependent on a prior
review carried out by a court or by an independent administrative body
whose decision sought to limit access to the data and their use to what was
strictly necessary for the purpose of attaining the objective pursued. The
CJEU concluded that the directive entailed a wide-ranging and particularly
serious interference with the rights in Articles 7 and 8 of the Charter,
without having laid down clear and precise rules governing the extent of the
interference and ensuring that it was actually limited to what was strictly
necessary. Moreover, the directive did not provide for sufficient safeguards,
by means of technical and organisational measures, to ensure effective
protection of the data retained against the risk of abuse and against any
unlawful access and use of those data.
80. In joined cases Tele2 Sverige AB v Post- och telestyrelsen and
Secretary of State for the Home Department v Tom Watson and Others
(cases C-203/15 and C-698/15, judgment of 21 December 2016), the CJEU
(Grand Chamber) dealt, firstly, with the issue of a provider of electronic
communications services having refused to retain data under Swedish
legislation that had given effect to the now invalid Directive 2006/24/EC.
The CJEU stated, inter alia, the following:
“107. National legislation such as that at issue in the main proceedings therefore
exceeds the limits of what is strictly necessary and cannot be considered to be
justified, within a democratic society, as required by Article 15(1) of Directive
2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter.
108. However, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8
and 11 and Article 52(1) of the Charter, does not prevent a Member State from
adopting legislation permitting, as a preventive measure, the targeted retention of
traffic and location data, for the purpose of fighting serious crime, provided that the
retention of data is limited, with respect to the categories of data to be retained, the
means of communication affected, the persons concerned and the retention period
adopted, to what is strictly necessary.
109. In order to satisfy the requirements set out in the preceding paragraph of the
present judgment, that national legislation must, first, lay down clear and precise rules
governing the scope and application of such a data retention measure and imposing