View source for CJEU - C‑293/12 and C‑594/12 - Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others

=== Holding ===
The Court had the task to examine the validity of the Data Retention Directive in light of Articles 7 and 8 of the Charter. It firstly acknowledged that this obligation constituted an interference with private life and the protection of personal data, thereby falling under the realm of both Article 7 and 8 of the Charter. The CJEU then had to determine whether the provision was a justified interference on these rights in accordance with Article 52(1) of the Charter. The Court held that the essence of both rights are not affected by the Directive as the contents of electronic communications are not retained and providers of such services/networks must still adhere to certain principles of data protection and security. It then determined that the Directive satisfies an objective of general interest, namely allowing national authorities to have (possible) access to such data to investigate, detect, and prosecute serious crime as prescribed in Article 1(1) thereof. The Court subsequently assessed the proportionality of the interference. It firstly argued that the retention of such data can be considered to be appropriate for attaining the objectives pursued as the intention of such data is a valuable tool for (criminal) investigations. In terms of necessity, the Court emphasized that the obligation under Article 3 of the Data Retention Directive requires the retention of all traffic data in a generalized manner—of all persons and all means of (electronic) communication without any distinction, limitation or excepting being made. It therefore also extended to individuals where no evidence suggested that they may be involved with a serious crime and persons whose communications were subject to the obligation of professional secrecy. The CJEU therefore held that due to the broad scope of data retention provided for, the Data Retention Directive went beyond what was strictly necessary for the aim of combating serious crime (and terrorism). The Court also assessed whether sufficient safeguards had been set in place to effectively protect the personal data of users against the risk of abuse and unlawful access and/or use of that data. It noted that the Directive failed to outline substantive and procedural conditions relating to the access of relevant national authorities to the data and use thereof. Thus, access would not be subject to a prior review by a court or an independent administrative body to be limited to what is strictly necessary. Moreover, there were no requirements for data access and/or retention to be based on objective criteria within the EU. Therefore, the CJEU found that the Data Retention Directive lacked safeguards to ensure the protection of retained data against unauthorized access and misuse by authorities. The Court rendered the Data Retention Directive invalid because it did not provide adequate safeguards and failed to strike a fair balance between the aim of combating serious crime and the fundamental rights of individuals, particularly the right to privacy and the protection of personal data.