CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
C. Relevant case-law of the Court of Justice of the European Union
(“CJEU”)
1. Digital Rights Ireland Ltd v. Minister for Communications, Marine
and Natural Resources and Others and Kärntner Landesregierung
and Others (Cases C-293/12 and C-594/12; ECLI:EU:C:2014:238)
98. In a judgment of 8 April 2014 the CJEU declared invalid the Data
Retention Directive 2006/24/EC laying down the obligation on the
providers of publicly available electronic communication services or of
public communications networks to retain all traffic and location data for
periods from six months to two years, in order to ensure that the data were
available for the purpose of the investigation, detection and prosecution of
serious crime, as defined by each Member State in its national law. The
CJEU noted that, even though the directive did not permit the retention of
the content of the communication, the traffic and location data covered by it
might allow very precise conclusions to be drawn concerning the private
lives of the persons whose data had been retained. Accordingly, the
obligation to retain the data constituted in itself an interference with the
right to respect for private life and communications guaranteed by Article 7
of the Charter of Fundamental Rights of the EU and the right to protection
of personal data under Article 8 of the Charter.
99. The access of the competent national authorities to the data
constituted a further interference with those fundamental rights, which the
CJEU considered to be “particularly serious”. The fact that data were
retained and subsequently used without the subscriber or registered user
being informed was, according to the CJEU, likely to generate in the minds
of the persons concerned the feeling that their private lives were the subject
of constant surveillance. The interference satisfied an objective of general
interest, namely to contribute to the fight against serious crime and terrorism
and thus, ultimately, to public security. However, it failed to satisfy the
requirement of proportionality.
100. Firstly, the directive covered, in a generalised manner, all persons
and all means of electronic communication as well as all traffic data without
any differentiation, limitation or exception being made in the light of the
objective of fighting against serious crime. It therefore entailed an
interference with the fundamental rights of practically the entire European
population. It applied even to persons for whom there was no evidence
capable of suggesting that their conduct might have a link, even an indirect
or remote one, with serious crime.
101. Secondly, the directive did not contain substantive and procedural
conditions relating to the access of the competent national authorities to the
data and to their subsequent use. By simply referring, in a general manner,
to serious crime, as defined by each Member State in its national law, the
directive failed to lay down any objective criterion by which to determine
29