The EU Court of Justice rules on the retention of traffic data

The contest the issue raised in was a murder trial ended in 2015 with a life sentence issued by an Irish court that based its judgement on traffic and location data relating to telephone calls.

The defendant had challenged the use of such an evidence, arguing that the Communications (Retention of Data) Act of 2011, regulating the retention of traffic and/or location, and that enabled the Authorities to access the mentioned data, violated the rights accorded by Union law (EU Directive 2022/58 / EC) concerning the processing of personal data and the protection of privacy in the electronic communications sector. Therefore, the Court of Justice of the European Union was consulted by way of a preliminary ruling.

The Court of Justice was therefore called upon to state on the compatibility between Article 15 of Directive 58/2002 and local law allowing Member States to use data relating to traffic or location for crime prevention and protection of public safety reasons and, if so, under what conditions.

The mentioned Article 15, in paragraph 1, states that “Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.”.

As a result of the preliminary ruling procedure, in the judgment final provisions, the Court clarified that article 15, paragraph 1, of Directive 58/2002 operates as a limit to the local legislative power for it denies the possibility to introduce preventive measures involving, for the purposes of fighting crime or protecting public security, the generalized and undifferentiated storage of traffic data and location data.

Conversely, the Court stated that are in compliance with European law provisions aimed at introducing, for the same purposes of preventing offenses and protecting public safety, measures providing:

The Court has in any case clarified that these provisions must necessarily guarantee, by means of clear and precise rules that the retention of the data in question is subject to compliance with the relevant substantive and procedural conditions and that the persons concerned have effective guarantees against the risk of abuse.

In the judgement the Court specified that the competent authorities can adopt rapid measures for the retention of traffic and location data even during the early stages of investigations, if public safety is at risk.

However, the Court continues, the processing cannot be entrusted to the police without the intervention of the judicial authority.

The intervention of the Court of Justice did not therefore exclude the possibility for Member States to adopt preventive measures on the use of these data, provided that certain conditions and guarantees are respected.