Published on :
European justice on Tuesday opposed the national directives of certain EU states, such as France, Belgium or the United Kingdom, on the “generalized and undifferentiated” collection of connection and location data. A practice, which according to the Court, goes against the respect for the private life of citizens.
European states ordered to end “generalized and undifferentiated” data collection by telecom operators. On Tuesday October 6, European justice opposed the massive collection carried out by telecom operators on behalf of states. The Court of Justice of the EU (CJEU) has thus established safeguards for targeted or time-limited collection in the event of a “serious threat to national security”.
Asked by courts in France, Belgium and the United Kingdom, the Luxembourg-based Court of Justice confirmed that EU law precludes national regulations requiring access providers to “generalized transmission or retention and undifferentiated “metadata of Internet connections and telephone conversations, according to the text of the judgment.
Concretely, the metadata of these connections and conversations, which do not relate to the content of the messages but the conditions under which they were exchanged (identity, location, date, duration, etc.), cannot be kept indefinitely and uniformly by the operators.
However, the CJEU admits framed exemptions in the event that a state faces “a serious threat to national security, real and current or foreseeable”, which may lead it to impose, by “legislative measures”, a “generalized and undifferentiated” data “for a period of time limited to what is strictly necessary”.
Derogations under legal control
Likewise, in the “fight against serious crime” and “the prevention of serious threats to public security”, a Member State may also “provide for the targeted retention of data as well as their rapid retention”.
However, “such an interference with fundamental rights must be accompanied by effective guarantees and controlled by a judge or an independent administrative authority”, insists the Court.
In a 2016 judgment called “Tele2”, the CJEU ruled that member states could not impose on providers a “generalized and undifferentiated obligation” to collect and store traffic data and location data.
But several EU states continue to require such collection so that police, magistrates or intelligence services can access this data. They are based on the EU Treaty, according to which national security “remains the sole responsibility of each member state”.