An important ruling was issued yesterday by the Court of Justice of the European Union (CJEU) on two joined cases, one from Sweden and one from the UK. In a 2014 ruling, the CJEU declared the 2006 EU Data Retention Directive invalid on the grounds that the general obligation to retain communications and location data imposed by that directive went beyond what was strictly necessary for its purposes and was in breach of citizens’ rights with respect to privacy and the protection of personal data. Following that judgment, two references were made to the CJEU in relation to the general obligation imposed in Sweden and in the UK on providers of electronic communications services to retain similar data to that which had been required to be retained in the EU Directive. The case in the UK concerned the UK Data Retention and Investigative Powers Act (DRIPA). The case was referred to the CJEU by the UK Court of Appeal for clarification on whether an EU ruling which prohibits indiscriminate data retention has to be respected in domestic law. Yesterday’s ruling says that indeed it should be. The matter will now revert back to the UK Court of Appeal.
The ruling and CJEU’s press release can be accessed by clicking on the below link.