The Tele2 Sverige AB ruling issued on Wednesday 21st December 2016 by the European Court of Justice (ECJ) is a landmark step forward in the fight led by the Exégètes Amateurs and numerous other European NGOs against general retention of metadata. This ruling will play a decisive role in the case [FR] brought by La Quadrature du Net, the FDN Federation and FDN before the Conseil d’Etat (France's highest administrative jurisdiction).
The Tele2 ruling rendered today strongly and unambiguously reaffirms the Digtal Rights Ireland case. In this decision of April 8th, 2014, the European Court of Justice invalidated the directive 2006/24 which made the retention of all users' traffic data1 mandatory for Internet and telecom operators. The directive was deemed incompatible with the Charter of Fundamental Rights of the European Union due to the disproportionate encroachment upon the rights to respect for private life and protection of personal data.
Since then, many Member States have repealed their own national blanket data retention framework, finding them incompatible with European law. France, whose national scheme for traffic data retention was instituted by the Parliament in 2001, was not one of them. Neither were the United Kingdom nor Sweden, two states whose legislation was directly questionned in the Tele2 case dealt with by the highest court of the European Union’s legal order.
This marked the Exégètes amateurs’ first action, as they lodged a complaint against the 2014-1576 decree of 24 December 2014 (implementing the 2014 Military Programming Act, the law providing for France's defense and military legal framework for 2014-2018 [FR], a milestone of France's data retention expansion laws) before the Conseil d’Etat, followed by a second action to obtain the repeal of the whole framework for traffic data retention [FR] in French law.
In these two cases, the Exégètes Amateurs relied heavily on the 2014 Digital Rights Ireland ECJ ruling and on the principles laid down by the Court, which have been strongly reaffirmed in Tele2. Nonetheless, on 12 February 2016, the Conseil d’État rejected the first case [FR] and did not even bother to assess the conformity of the challenged decree with European law (even though it had been considered inapplicable as such by the Conseil d’État’s public rapporteur) – all this, despite our formal request to refer the question to the Court of justice for a preliminary ruling. Unlike Swedish and English courts, the Conseil d’Etat has not been fair play.
The ECJ's Tele2 ruling directly challenges the core of the Conseil d’État case-law on the issue of generalised retention and administrative access to traffic data of all users of communication services (Internet, phone, etc.). Implications of this decision shall now be expected in the second case [FR] brought by the Exégètes Amateurs, currently pending before the Conseil d’État. Indeed, the highest court of the European Union stands against the logic of generalised suspicion, and has exposed three crystal clear principles for the protection of fundamental rights.
The retention of traffic data has to comply with the Charter of Fundamental Rights
Firs of all, in the Tele2 ruling, the Court reasserts that the EU Charter of Fundamental Rights does apply to any national legislation making blanket data retention mandatory, as was already argued by the Exégètes amateurs in their previous observations [FR]. To reach this conclusion, the Court finds that national measures imposing the retention of traffic data to telecom operators fall within the scope of directive 2002/58, also known as the “ePrivacy directive”. Indeed, the Court assesses that considering otherwise would deprive the first paragraph of Article 15 of the Directive of its essence.
As a reminder, article 15(1) of the directive 2002/58 allows member States to impose to operators to retain their users' traffic data “when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system”. Thus, this article introduces an exemption to other rights protected under the ePrivacy directive, such as the right to the confidentiality of communications, or erasure of traffic data. However, as the Court finds, this exemption is only authorised as an exception, and as such cannot become a general rule in domestic law.
Data retention can only be an exception, never the rule
As a second step, the Court lays down a strong rule prohibiting Member States from imposing blanket data retention to telecom operators. It states very clearly that Article 15 of Directive 2002/58 “[precludes] national legislation which, for the purpose of fighting crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication”.
Indeed, the Court rightly considers that Article 15(1) must be strictly interpreted, as notably being an exception to the principle of confidentiality of communications. Therefore, data retention can only be limited in time. This is a matter of respect of fundamental rights, namely the right to respect for private life, the right to data protection, but also freedom of speech. For, as the Court finds, in our daily lives paramount importance is held by traffic data:
“Those data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as everyday habits, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgment, paragraph 27). In particular, that data provides the means, as observed by the Advocate General in points 253, 254 and 257 to 259 of his Opinion, of establishing a profile of the individuals concerned, information that is no less sensitive, having regard to the right to privacy, than the actual content of communications.”
The infringement caused by retention goes so far as to undermine freedom of expression:
“The interference entailed by such legislation in the fundamental rights enshrined in Articles 7 and 8 of the Charter is very far-reaching and must be considered to be particularly serious. The fact that the data is retained without the subscriber or registered user being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgment, paragraph 37).”
“Even if such legislation does not permit retention of the content of a communication and is not, therefore, such as to affect adversely the essence of those rights (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgment, paragraph 39), the retention of traffic and location data could nonetheless have an effect on the use of means of electronic communication and, consequently, on the exercise by the users thereof of their freedom of expression, guaranteed in Article 11 of the Charter”.
In line with the laying down of a principle of non-retention of traffic data, the Court defines particularly strict conditions under which such retention may be imposed on operators:
Member States can only impose preventive retention of traffic data under very restrictive conditions, namely that this obligation must be:
- implemented for the purpose of fighting serious crime, and
- limited to what is strictly necessary with regards to the categories of data to be retained, the means of communication concerned, the persons concerned and the retention period chosen.
Access to retained data must follow a decision from a prior independent oversight body or review
Having settled the question of data retention, the Court then looks focuses on the question brought before it on the granting of access to retained data to authorities. Once again, the Court sweeps aside some domestic laws, such as the French one, on access to retained data: access to operators’ retained traffic data can only be granted by a decision taken after a priori review by an independent jurisdiction or independent body. This is not the case in France.
The Court thus clearly opposes itself to “access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review by a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union.”
The Tele2 ruling is a milestone for the protection of freedoms and privacy. As such, it shall require further analysis, concentrating on its different aspects. As of today, it already appears to be in accordance with the legal grounds on which the Exégètes based their reasoning before the Conseil d’Etat, for more than two years, in the course of their numerous proceedings. Tele2 ensures, in a very relevant manner, the protection of the rights to respect for private life and data protection, as well as the freedom of speech of all European citizens. It seems unlikely that the French law will be maintained as it stands. The Exégètes will henceforth undertake the drafting of a supplementary brief, in the context of the case concerning the repeal of the French law on traffic data retention, imposing a one-year long retention.
That is to say metadata related to electronic communications, included in the "traffic data" or “connection data” notion in French law.↩