This paper examines the challenges facing the EU regarding data retention, particularly after the judgment Digital Rights Ireland by the Court of Justice of the European Union (CJEU) of April 2014, which found the Data Retention Directive 2002/58 to be invalid. It first offers a brief historical account of the Data Retention Directive and then moves to a detailed assessment of what the judgment means for determining the lawfulness of data retention from the perspective of the EU Charter of Fundamental Rights: what is wrong with the Data Retention Directive and how would it need to be changed to comply with the right to respect for privacy?
The paper also looks at the responses to the judgment from the European institutions and elsewhere, and offers three main recommendations to EU policy-makers: first, to give priority to a full and independent evaluation of the value of the data retention directive; second, to assess the judgment’s implications for other large EU information systems and proposals that provide for the mass collection of metadata from innocent persons, in the EU; and third, to adopt without delay the proposal for Directive COM(2012)10 dealing with data protection in the fields of police and judicial cooperation in criminal matters.
Elspeth Guild is Jean Monnet Professor ad personam, Radboud University and Queen Mary London and Associate Senior Research Fellow CEPS. Sergio Carrera is Senior Research Fellow and Head of the Justice and Home Affairs Section at CEPS.