Law and Rights
By Steve Peers
Following the annulment of the EU?s data retention Directive by the CJEU, an obvious important question arises: are national data retention laws subject to the same ruling of the Court? The purpose of this post is to set out the reasons why they are.
The starting point for this analysis is Article 51 of the EU?s Charter of Fundamental Rights, which states that the Charter applies to the EU institutions and other EU bodies, but to the EU?s Member States ?only? when they are ?implementing? EU law. What does that mean?
On the narrowest interpretation, Member States ceased to be implementing EU law on data retention from the moment that the data retention Directive became invalid. After all, from that point, there was no EU data retention law to implement. However, it is arguable that Member States can still be regarded as ?implementing? EU law where their national legislation was introduced to implement an EU obligation. It?s a novel point, because it?s rare for the CJEU to annul EU laws on substantive grounds. And where the Court has done so, it has more often annulled only a small part of those EU laws (in the Test-Achats judgment, for instance).
But that is merely an alternative argument that the EU Charter continues to apply to national data retention law. The main argument is based on solidly established case law of the CJEU regarding the scope of EU human rights protection where Member States derogate from EU law.
EU human rights rules and national derogations from EU law
As far back as 1991, the CJEU ruled in the ERT case that where Member States derogate from EU internal market rules, they are still subject to EU human rights obligations (which then took the form only of the EU?s ?general principles of law?, since the Charter was not yet a gleam in anyone?s eye). This was confirmed in the Familiapress judgment, as regards exceptions from the internal market rules which are based on the CJEU?s ?rule of reason? case law, rather than the express exceptions in the Treaties.
Does the Charter take the same approach? While many assumed that the word ?implementing? in the text of Article 51 suggested a narrower interpretation than under the prior case law, in its judgment in Fransson the CJEU stated that its prior case law regarding the scope of the general principles applied equally to the Charter. While that judgment did not concern derogations from EU law, the CJEU should shortly be ruling on this point in the case of Pfleger (judgment due 30th April), where the Advocate-General?s opinion assumes as much. Pending the possible confirmation in that judgment, it should be assumed for the time being that the Charter does indeed apply to national derogations from EU law, given that the CJEU made no distinction in Fransson as regards the aspects of its prior case law which were still applicable.
In any event, even if the Charter does not apply to national derogations from EU law, the general principles still do, given that they have a continued existence independent from the Charter in Article 6(3) TEU.
Applying the case law
Two further issues arise. First of all, does EU human rights law apply where Member States are not derogating from EU internal market rules in the Treaty, but from other rules of EU law? In principle it should, given that the Treaties list other EU objectives besides the creation of an internal market. Why should EU human rights rules only apply as regards national derogations from EU rules in one particular area of EU law, but not as regards derogations from EU rules in other areas of law?
Anyway, the CJEU has in effect confirmed that Member States are bound by the Charter and the general principles even where the law in question does not concern the internal market. In EP v Council and the subsequent case of Chakroun, the CJEU ruled that national derogations from the EU?s family reunion Directive had to comply with human rights obligations, without suggesting any distinction in this regard between national derogations from EU internal market rules in the Treaty and national derogations from other EU rules set out in EU legislation.
Secondly, is there an EU law rule that Member States are derogating from when they continue to apply national data retention laws? Indeed, there is: Article 15(1) of the EU?s e-privacy Directive specifies that Member States may restrict the rights in that Directive relating to the confidentiality of communications, location and other traffic data and caller identification:
'when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.'
In fact, the CJEU has ruled repeatedly on the application of the Charter to cases where copyright holders have invoked this clause to justify planned restrictions upon Internet use (see most recently the Telekabel Wien judgment). There is no reason why the CJEU would not also apply the clause to data retention on crime-fighting grounds, given that the second sentence of Article 15(1) refers expressly to data retention and the first sentence refers expressly to criminal law.
Finally, while some forms of data retention might fall outside the scope of the e-privacy Directive, which in principle applies to telecommunications service providers (not, for instance, to social networks or search engines), those other forms of data retention would anyway fall within the scope of the similar Article 13 of the main data protection Directive, given that they would clearly constitute the processing of personal data within the scope of that Directive. Neither the ?household exception? to that Directive nor the exception for processing in the field of criminal law would apply ? since the data retention would be taking place in the context of a commercial activity (since the judgment on the legal base of the data retention Directive by analogy).
Barnard & Peers: chapter 6, chapter 9
- Data Protection Rights And Administrative Proceedings
Steve Peers What rights do asylum-seekers have as regards data protection law? This issue was clarified in today?s CJEU judgment in YS and M and S, which could also have broader relevance for any case which involves access to documents in the context...
- Does The Uk?s New Data Retention Bill Violate The Eu Charter Of Fundamental Rights?
Steve Peers Following the judgment of the Court of Justice of the European Union (CJEU) from April this year, invalidating the EU?s data retention directive, several Member States? courts have declared their national law invalid. However, the...
- Europe V Facebook: The Beginning Of The End For Nsa Spying On Eu Citizens?
Steve Peers Since the revelations about the extent of spying by the American National Security Agency (NSA) revealed by Edward Snowden, doubts have increased about the adequacy of the data protection regime in the United States, in particular as regards...
- The Data Retention Judgment: The Cjeu Prohibits Mass Surveillance
Steve Peers On July 7, 2005 a relative of mine started her journey to work on a London tube train. Within half an hour, bombs on that train left by terrorists exploded, in conjunction with three other bombs across London. Dozens of people died (although...
- The Eu?s Data Retention Directive: Fighting Back Against Mass Surveillance In The Eu?s Court Of Justice
Steve Peers I?m writing this post on ?The Day We Fight Back? against mass surveillance. So it seems a suitable day to comment (a bit belatedly) on the Advocate-General?s opinion from last December on the validity of the EU?s data retention Directive...
Law and Rights
Are national data retention laws within the scope of the Charter?
By Steve Peers
Following the annulment of the EU?s data retention Directive by the CJEU, an obvious important question arises: are national data retention laws subject to the same ruling of the Court? The purpose of this post is to set out the reasons why they are.
The starting point for this analysis is Article 51 of the EU?s Charter of Fundamental Rights, which states that the Charter applies to the EU institutions and other EU bodies, but to the EU?s Member States ?only? when they are ?implementing? EU law. What does that mean?
On the narrowest interpretation, Member States ceased to be implementing EU law on data retention from the moment that the data retention Directive became invalid. After all, from that point, there was no EU data retention law to implement. However, it is arguable that Member States can still be regarded as ?implementing? EU law where their national legislation was introduced to implement an EU obligation. It?s a novel point, because it?s rare for the CJEU to annul EU laws on substantive grounds. And where the Court has done so, it has more often annulled only a small part of those EU laws (in the Test-Achats judgment, for instance).
But that is merely an alternative argument that the EU Charter continues to apply to national data retention law. The main argument is based on solidly established case law of the CJEU regarding the scope of EU human rights protection where Member States derogate from EU law.
EU human rights rules and national derogations from EU law
As far back as 1991, the CJEU ruled in the ERT case that where Member States derogate from EU internal market rules, they are still subject to EU human rights obligations (which then took the form only of the EU?s ?general principles of law?, since the Charter was not yet a gleam in anyone?s eye). This was confirmed in the Familiapress judgment, as regards exceptions from the internal market rules which are based on the CJEU?s ?rule of reason? case law, rather than the express exceptions in the Treaties.
Does the Charter take the same approach? While many assumed that the word ?implementing? in the text of Article 51 suggested a narrower interpretation than under the prior case law, in its judgment in Fransson the CJEU stated that its prior case law regarding the scope of the general principles applied equally to the Charter. While that judgment did not concern derogations from EU law, the CJEU should shortly be ruling on this point in the case of Pfleger (judgment due 30th April), where the Advocate-General?s opinion assumes as much. Pending the possible confirmation in that judgment, it should be assumed for the time being that the Charter does indeed apply to national derogations from EU law, given that the CJEU made no distinction in Fransson as regards the aspects of its prior case law which were still applicable.
In any event, even if the Charter does not apply to national derogations from EU law, the general principles still do, given that they have a continued existence independent from the Charter in Article 6(3) TEU.
Applying the case law
Two further issues arise. First of all, does EU human rights law apply where Member States are not derogating from EU internal market rules in the Treaty, but from other rules of EU law? In principle it should, given that the Treaties list other EU objectives besides the creation of an internal market. Why should EU human rights rules only apply as regards national derogations from EU rules in one particular area of EU law, but not as regards derogations from EU rules in other areas of law?
Anyway, the CJEU has in effect confirmed that Member States are bound by the Charter and the general principles even where the law in question does not concern the internal market. In EP v Council and the subsequent case of Chakroun, the CJEU ruled that national derogations from the EU?s family reunion Directive had to comply with human rights obligations, without suggesting any distinction in this regard between national derogations from EU internal market rules in the Treaty and national derogations from other EU rules set out in EU legislation.
Secondly, is there an EU law rule that Member States are derogating from when they continue to apply national data retention laws? Indeed, there is: Article 15(1) of the EU?s e-privacy Directive specifies that Member States may restrict the rights in that Directive relating to the confidentiality of communications, location and other traffic data and caller identification:
'when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.'
In fact, the CJEU has ruled repeatedly on the application of the Charter to cases where copyright holders have invoked this clause to justify planned restrictions upon Internet use (see most recently the Telekabel Wien judgment). There is no reason why the CJEU would not also apply the clause to data retention on crime-fighting grounds, given that the second sentence of Article 15(1) refers expressly to data retention and the first sentence refers expressly to criminal law.
Finally, while some forms of data retention might fall outside the scope of the e-privacy Directive, which in principle applies to telecommunications service providers (not, for instance, to social networks or search engines), those other forms of data retention would anyway fall within the scope of the similar Article 13 of the main data protection Directive, given that they would clearly constitute the processing of personal data within the scope of that Directive. Neither the ?household exception? to that Directive nor the exception for processing in the field of criminal law would apply ? since the data retention would be taking place in the context of a commercial activity (since the judgment on the legal base of the data retention Directive by analogy).
Barnard & Peers: chapter 6, chapter 9
- Data Protection Rights And Administrative Proceedings
Steve Peers What rights do asylum-seekers have as regards data protection law? This issue was clarified in today?s CJEU judgment in YS and M and S, which could also have broader relevance for any case which involves access to documents in the context...
- Does The Uk?s New Data Retention Bill Violate The Eu Charter Of Fundamental Rights?
Steve Peers Following the judgment of the Court of Justice of the European Union (CJEU) from April this year, invalidating the EU?s data retention directive, several Member States? courts have declared their national law invalid. However, the...
- Europe V Facebook: The Beginning Of The End For Nsa Spying On Eu Citizens?
Steve Peers Since the revelations about the extent of spying by the American National Security Agency (NSA) revealed by Edward Snowden, doubts have increased about the adequacy of the data protection regime in the United States, in particular as regards...
- The Data Retention Judgment: The Cjeu Prohibits Mass Surveillance
Steve Peers On July 7, 2005 a relative of mine started her journey to work on a London tube train. Within half an hour, bombs on that train left by terrorists exploded, in conjunction with three other bombs across London. Dozens of people died (although...
- The Eu?s Data Retention Directive: Fighting Back Against Mass Surveillance In The Eu?s Court Of Justice
Steve Peers I?m writing this post on ?The Day We Fight Back? against mass surveillance. So it seems a suitable day to comment (a bit belatedly) on the Advocate-General?s opinion from last December on the validity of the EU?s data retention Directive...