Top European Court Rules that Unrestrained Mass Surveillance Violates Fundamental Privacy Rights

In cases brought by privacy advocates in the United Kingdom, France, and Belgium, the Court of Justice of the European Union (CJEU) ruled that the concerns of national security do not excuse the EU Member States from complying with the with general principles of EU law such as respect for fundamental rights to privacy and proportionality. Specifically, the Member States cannot require providers of electronic communications services to conduct general and indiscriminate transmission of traffic and location data to the security and intelligence agencies for the general purpose of safeguarding national security.  Furthermore, the European law precludes requiring providers of electronic communications services to carry out the general and indiscriminate retention of traffic data and location data as a preventive measure.

However, if a Member State is facing a present or foreseeable genuine and serious threat to national security, it may issue an order requiring general and indiscriminate retention of traffic and location data for a limited period of time as strictly necessary.  A Member State may also provide for the targeted retention of that data as well as its expedited retention if required to combat a serious crime and prevent serious threats to public security. Such orders must be subject to a binding review either by a court or by an independent administrative body in order to verify that one of the exceptional circumstances exists and that the conditions and safeguards required by the Court are observed.

The CJEU also allowed the collection and retention of IP addresses when it is “strictly necessary.”  Furthermore, national courts would not be permitted to consider information collected by authorities that fail to follow the principles articulated in the CJEU’s ruling.

Notably, the CJEU’s judgement potentially affects consideration of the United Kingdom’s data protection adequacy agreement from the European Commission as the UK’s Investigatory Powers Act gives government agencies broad powers to intercept and retain digital communications.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653