The European Court of Justice (ECJ) has declared “invalid” the EU law requiring telecoms firms to store citizens’ communications data for up to two years.
The EU Data Retention Directive was adopted in 2006.
The EU’s top court says the directive violates two basic rights – respect for private life and protection of personal data.
The EU-wide ruling was prompted by Austrian and Irish complaints.
The 28-nation EU is currently drafting a new data protection law.
The ECJ ruling says the 2006 directive allows storage of data on a person’s identity, the time of that person’s communication, the place from which the communication took place and the frequency of that person’s communications.
“By requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data,” the court in Luxembourg ruled.
Austrian and Irish courts had asked the ECJ to decide whether the directive complied with the EU Charter of Fundamental Rights.
The judges acknowledged that data retention was justified in the fight against serious crime and to safeguard public security. But they argued that the directive was disproportionate.
They also said use of the data without an individual’s knowledge “is likely to generate in the persons concerned a feeling that their private lives are the subject of constant surveillance”.
The directive does not provide sufficient safeguards against possible abuse of personal data, the judges said.
And there was insufficient clarity concerning the basis for holding data for a minimum of six months or the maximum of two years, they argued.
The European Commission says it too is assessing the ruling. It said there had to be a proper balance between security and fundamental rights.
