CJEU - C-140/20 - Commissioner of the Garda Síochána and Others: Difference between revisions

From GDPRhub
No edit summary
(Added facts and holding after decision was issued)
Line 2: Line 2:


|Case_Number_Name= C-140/20  Commissioner of the Garda Síochána and Others
|Case_Number_Name= C-140/20  Commissioner of the Garda Síochána and Others
|ECLI=
|ECLI=ECLI:EU:C:2022:258


|Opinion_Link=
|Opinion_Link=
|Judgement_Link=https://curia.europa.eu/juris/liste.jsf?lgrec=fr&td=%3BALL&language=en&num=C-140/20&jur=C
|Judgement_Link=https://curia.europa.eu/juris/liste.jsf?lgrec=fr&td=%3BALL&language=en&num=C-140/20&jur=C


|Date_Decided=
|Date_Decided=05.04.2022
|Year=
|Year=




|EU_Law_Name_1=Article 15 Directive 2002/58/EC
|EU_Law_Name_1=Article 15 Directive 2002/58/EC
|EU_Law_Link_1=https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058
|EU_Law_Link_1=https://curia.europa.eu/juris/document/document.jsf?text=&docid=257242&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=4664691




Line 33: Line 33:
}}
}}


See Holding for questions referred.
The Court of Justice of the European Union (CJEU) confirmed its settled case-law that traffic and location data relating to electronic communications may not generally and indiscriminately be retained for the purposes of combating serious crime.


==English Summary==
==English Summary==


=== Facts ===
=== Facts ===
Facts pending CJEU decision.
In March 2015, the plaintiff was sentenced to life imprisonment for murder. He appealed his conviction before the Court of Appeal in Ireland, criticising in particular that the first-instance court had incorrectly admitted traffic and location data relating to telephone calls as evidence. He based that argument on the ground that his rights guaranteed by EU law were infringed by the 2011 Act governing the retention of such data, on which the police investigation had been based. That appeal is currently pending.
 
The plaintiff brought civil proceedings before the High Court in order to be able to contest the admissibility of that evidence. The High Court held that section 6(1)(a) of that act was indeed incompatible with Article 15(1) of Directive 2002/58 ("privacy and electronic communications directive" - in the following "Directive") when read in light of Articles 7, 8 and 52(1) of the Charter. Ireland appealed against that decision to the referring court, the Supreme Court.
 
The Supreme Court stayed the proceedings and referred six questions to the CJEU:
 
Questions 1, 2 and 4 asked whether "whether Article 15(1) of Directive [...], read in the light of Articles 7, 8, 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation that provides for the general and indiscriminate retention of traffic and location data for the purposes of combating serious crime."
 
By its question 3, the referring court essentially asked whether "Article 15(1) of Directive [...] must be interpreted as precluding national legislation pursuant to which the centralised processing of requests for access to retained data, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, assisted by a unit established within the police service which enjoys a degree of autonomy in the exercise of its duties and whose decisions may subsequently by [sic!] subject to judicial review."
 
Questions 5 and 6 concerned the issue "whether EU law must be interpreted as meaning that a national court may limit the temporal effects of a declaration of invalidity which it is required to make, under national law, with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data owing to the incompatibility of that legislation with Article 15(1) of Directive [...]."


=== Holding ===
=== Holding ===
'''Questions referred''':


1. Is a general/universal data retention regime — even subject to stringent restrictions on retention and access — per se contrary to the provisions of Article 15 of Directive 2002/58/EC, as interpreted in light of the Charter?
==== 1. Questions 1, 2 and 4 ====
First, the CJEU confirmed its settled case-law that traffic and location data relating to electronic communications may not generally and indiscriminately be retained for the purposes of combating serious crime. It laid out the purpose of the Directive as a framework to protect such data as well as enshrining the principle of the prohibition of the storage thereof. Retaining such data constitutes both a derogation from that general principle of prohibition and and interference with the fundamental rights of Articles 7 and 8 of the Charter
 
Member States that want to limit the exercise of those rights for the purpose of combating crime, which is generally allowed by the Directive, must comply with the principle of proportionality. The objective of combating serious crime does not, by itself, justify measures. Instead, a proper balancing exercise must be executed. 


2. In considering whether to grant a declaration of inconsistency of a national measure implemented pursuant to Directive 2006/24/EC, and making provision for a general data retention regime (subject to the necessary stringent controls on retention and/or in relation to access), and in particular in assessing the proportionality of any such regime, is a national court entitled to have regard to the fact that data may be retained lawfully by service providers for their own commercial purposes, and may be required to be retained for reasons of national security excluded from the provisions of Directive 2002/58/EC?
However, the CJEU named several legislative measures that are not precluded by EU law. First, "the targeted retention of traffic and location data which is limited, according to the categories of persons concerned or using a geographical criterion". Second, "the general and indiscriminate retention of IP addresses assigned to the source of an internet connection". Third, "the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems". And fourth, the expedited retention of traffic and location data in the possession of those service providers. The central requirement for the legality of such measures is that they provide "clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse."


3. In assessing, in the context of determining the compatibility with European Union law and in particular with Charter Rights of a national measure for access to retained data, what criteria should a national court apply in considering whether any such access regime provides the required independent prior scrutiny as determined by the Court of Justice in its case law? In that context can a national court, in making such an assessment, have any regard to the existence of ex post judicial or independent scrutiny?
==== 2. Question 3 ====
Then, the CJEU held that EU law precludes national legislation "pursuant to which the centralised processing of requests for access to data, which have been retained by providers of electronic communications services, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, who is assisted by a unit established within the police service which has a degree of autonomy in the exercise of its duties, and whose decisions may subsequently be subject to judicial review." 


4. In any event, is a national court obliged to declare the inconsistency of a national measure with the provisions of Article 15 of the Directive 2002/58/EC, if the national measure makes provision for a general data retention regime for the purpose of combating serious crime, and where the national court has concluded, on all the evidence available, that such retention is both essential and strictly necessary to the achievement of the objective of combating serious crime?
The court clarified that national legislation must, in order to satisfy the propotionality requirements, clearly and precisely govern the scope and application of the measure in question as well as minimum safeguards which sufficiently guarantee the protection of those data. In order to ensure compliance with the strict conditions, national authorities that want to access such data must be subject to prior review carried out by either a court or an independent administrative body. A police officer does not constitute such administrative body since they are not subject to the same guarantees of independence and impartiality. 


5. If a national court is obliged to conclude that a national measure is inconsistent with the provisions of Article 15 of Directive 2002/58/EC, as interpreted in the light of the Charter, is it entitled to limit the temporal effect of any such declaration, if satisfied that a failure to do so would lead to ‘resultant chaos and damage to the public interest’ (in line with the approach taken, for example, in R (National Council for Civil Liberties) v Secretary of State for Home Department and Secretary of State for Foreign Affairs [2018] EWHC 975, at para. 46)?
==== 3. Questions 5 and 6 ====
Finally, the CJEU held that EU law precludes a national court from limiting the temporal effects of a declaration of invalidity that it is required to make under national law "with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data".  


6. May a national court invited to declare the inconsistency of national legislation with Article 15 of the Directive 2002/58/EC, and/or to disapply this legislation, and/or to declare that the application of such legislation had breached the rights of an individual, either in the context of proceedings commenced in order to facilitate an argument in respect of the admissibility of evidence in criminal proceedings or otherwise, be permitted to refuse such relief in respect of data retained pursuant to the national provision enacted pursuant to the obligation under Article 288 TFEU to faithfully introduce into national law the provisions of a directive, or to limit any such declaration to the period after the declaration of invalidity of the Directive 2006/24/EC issued by the CJEU on the 8th day of April, 2014?
In this context, the court also clarified that, considering the principle of procedural autonomy of the Member States, the admissibility of evidence obtained by means of such retention is a matter of national law.


== Comment ==
== Comment ==

Revision as of 11:55, 12 April 2022

CJEU - C-140/20 Commissioner of the Garda Síochána and Others
Cjeulogo.png
Court: CJEU
Jurisdiction: European Union
Relevant Law:
Article 15 Directive 2002/58/EC
Decided: 05.04.2022
Parties: Commissioner of the Garda Síochána
G.D.
Minister for Communications, Energy and Natural Resources
Attorney General
Case Number/Name: C-140/20 Commissioner of the Garda Síochána and Others
European Case Law Identifier: ECLI:EU:C:2022:258
Reference from: Supreme Court (Ireland)
Language: 24 EU Languages
Original Source: Judgement
Initial Contributor: FA

The Court of Justice of the European Union (CJEU) confirmed its settled case-law that traffic and location data relating to electronic communications may not generally and indiscriminately be retained for the purposes of combating serious crime.

English Summary

Facts

In March 2015, the plaintiff was sentenced to life imprisonment for murder. He appealed his conviction before the Court of Appeal in Ireland, criticising in particular that the first-instance court had incorrectly admitted traffic and location data relating to telephone calls as evidence. He based that argument on the ground that his rights guaranteed by EU law were infringed by the 2011 Act governing the retention of such data, on which the police investigation had been based. That appeal is currently pending.

The plaintiff brought civil proceedings before the High Court in order to be able to contest the admissibility of that evidence. The High Court held that section 6(1)(a) of that act was indeed incompatible with Article 15(1) of Directive 2002/58 ("privacy and electronic communications directive" - in the following "Directive") when read in light of Articles 7, 8 and 52(1) of the Charter. Ireland appealed against that decision to the referring court, the Supreme Court.

The Supreme Court stayed the proceedings and referred six questions to the CJEU:

Questions 1, 2 and 4 asked whether "whether Article 15(1) of Directive [...], read in the light of Articles 7, 8, 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation that provides for the general and indiscriminate retention of traffic and location data for the purposes of combating serious crime."

By its question 3, the referring court essentially asked whether "Article 15(1) of Directive [...] must be interpreted as precluding national legislation pursuant to which the centralised processing of requests for access to retained data, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, assisted by a unit established within the police service which enjoys a degree of autonomy in the exercise of its duties and whose decisions may subsequently by [sic!] subject to judicial review."

Questions 5 and 6 concerned the issue "whether EU law must be interpreted as meaning that a national court may limit the temporal effects of a declaration of invalidity which it is required to make, under national law, with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data owing to the incompatibility of that legislation with Article 15(1) of Directive [...]."

Holding

1. Questions 1, 2 and 4

First, the CJEU confirmed its settled case-law that traffic and location data relating to electronic communications may not generally and indiscriminately be retained for the purposes of combating serious crime. It laid out the purpose of the Directive as a framework to protect such data as well as enshrining the principle of the prohibition of the storage thereof. Retaining such data constitutes both a derogation from that general principle of prohibition and and interference with the fundamental rights of Articles 7 and 8 of the Charter.

Member States that want to limit the exercise of those rights for the purpose of combating crime, which is generally allowed by the Directive, must comply with the principle of proportionality. The objective of combating serious crime does not, by itself, justify measures. Instead, a proper balancing exercise must be executed.

However, the CJEU named several legislative measures that are not precluded by EU law. First, "the targeted retention of traffic and location data which is limited, according to the categories of persons concerned or using a geographical criterion". Second, "the general and indiscriminate retention of IP addresses assigned to the source of an internet connection". Third, "the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems". And fourth, the expedited retention of traffic and location data in the possession of those service providers. The central requirement for the legality of such measures is that they provide "clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse."

2. Question 3

Then, the CJEU held that EU law precludes national legislation "pursuant to which the centralised processing of requests for access to data, which have been retained by providers of electronic communications services, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, who is assisted by a unit established within the police service which has a degree of autonomy in the exercise of its duties, and whose decisions may subsequently be subject to judicial review."

The court clarified that national legislation must, in order to satisfy the propotionality requirements, clearly and precisely govern the scope and application of the measure in question as well as minimum safeguards which sufficiently guarantee the protection of those data. In order to ensure compliance with the strict conditions, national authorities that want to access such data must be subject to prior review carried out by either a court or an independent administrative body. A police officer does not constitute such administrative body since they are not subject to the same guarantees of independence and impartiality.

3. Questions 5 and 6

Finally, the CJEU held that EU law precludes a national court from limiting the temporal effects of a declaration of invalidity that it is required to make under national law "with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data".

In this context, the court also clarified that, considering the principle of procedural autonomy of the Member States, the admissibility of evidence obtained by means of such retention is a matter of national law.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!