La Quadrature du Net et al. v. Premier ministre et al., Cases reunited C- 511/18, C‑512/18 and C-520/18, CJEU (Grand Chamber), 6 October 2020

Data protection in counter-balance with the protection of national security.

Directive 2002/58 of the European Union and the Council of 12 July 2012 on the protection of personal data and private life in the sector of electronic communication (directive on the right to private life and electronic communications).

Article 15, paragraph 1, of the directive 2002/58/CE of the European Parliament and the Council, of 12 July 2002, processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by directive 2009/136/CE of the European Parliament and the Council, of 25 November 2009, read in light of articles 7, 8, 11 and 52, para 1, of the EUCFR, should be interpreted in the sense that it does not allow legislative measures that require preventatively a generalized and undifferentiated retention of data about the traffic and location of the user.  It does not preclude, however, legislative measures that permit, in order to preserve national security, the recurrence to an injunction that imposes to the service providers to retain, generally and indiscriminately, traffic and location data in situations where the Member State concerned is condronted with a serious threat to national security that is shown to be genuine and present or foreseeable, where the decision imposing such an instruction is subject to effective review, either by a court or by an independent administrative body whose decision is binding, the aim of that review being to verify that one of those situations exists and that the conditions and safeguards which must be laid down are observed, and where that instruction may be given only for a period that is limited in time to what is strictly necessary, but which may be extended if that threat persists; provide, for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security, for the targeted retention of traffic and location data which is limited, on the basis of objective and non-discriminatory factors, according to the categories of persons concerned or using a geographical criterion, for a period that is limited in time to what is strictly necessary, but which may be extended; provide for the general and indiscriminate retention of IP addresses assigned to the source of an Internet connection for a period that is limited in time to what is strictly necessary and for the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems; allow, for the purposes of combating serious crime and, a fortiori, safeguarding national security, recourse to an instruction requiring providers of electronic communications services, by means of a decision of the competent authority that is subject to effective judicial review, to undertake, for a specified period of time, the expedited retention of traffic and location data in the possession of those service providers, provided that those measures ensure, by means of clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.
Furthermore, it does not preclude national rules that require providers of electronic communications services to have recourse to the automated analysis and real-time collection, inter alia, of traffic and location data and to the real-time collection of technical data concerning the location of the terminal equipment used, where this is limited to situations in which a Member State is facing a serious threat to national security which is shown to be genuine and present or foreseeable, and where recourse to such analysis may be the subject of an effective review, either by a court or by an independent administrative body whose decision is binding, the aim of that review being to verify that a situation justifying that measure exists and that the conditions and safeguards that must be laid down are observed; and where recourse to the real-time collection of traffic and location data is limited to persons in respect of whom there is a valid reason to suspect that they are involved in one way or another in terrorist activities and is subject to a prior review carried out either by a court or by an independent administrative body whose decision is binding in order to ensure that such real-time collection is authorized only within the limits of what is strictly necessary. In cases of duly justified urgency, the review must take place within a short time.
A national criminal courts should disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law, in the context of criminal proceedings against persons suspected of having committed criminal offences, where those persons are not in a position to comment effectively on that information and that evidence and they pertain to a field of which the judges have no knowledge and are likely to have a preponderant influence on the findings of fact.
 

C-623/17