CJEU - C-511/18 - La Quadrature du Net

From GDPRhub
CJEU - C-511/18 La Quadrature du Net
Court: CJEU
Jurisdiction: European Union
Relevant Law:
Directive 2002/58
Decided: 06.10.2020
Parties: La Quadrature du Net
Case Number/Name: C-511/18 La Quadrature du Net
European Case Law Identifier: ECLI:EU:C:2020:791
Reference from: CE (France)
Language: 24 EU Languages
Original Source: AG Opinion
Initial Contributor: n/a

The CJEU held that national provisions which provide for general and indiscriminate retention of traffic and location data for national security purposes are generally precluded except in certain circumstances.

English Summary


In France, multiple NGOs lodged actions for annulment of national regulation which required electronic communication providers and operators to massively and automatically store and process data in order to detect terrorist threats. They considered that these regulations were not compliant with (among others) Directive 2022/58.

The Conseil d’Etat stayed the proceedings and referred three questions to the CJEU for a preliminary ruling:

(1) Is the general and indiscriminate retention obligation imposed on providers on the basis of the implementing provisions of Article 15(1) of [Directive 2002/58] to be regarded, against a background of serious and persistent threats to national security, and in particular the terrorist threat, as interference justified by the right to security guaranteed in Article 6 of the [Charter] and the requirements of national security, responsibility for which falls to the Member States alone pursuant to Article 4 [TEU]?

(2) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as authorising legislative measures, such as the measures for the real-time collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data?

(3) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as meaning that it is a prerequisite for the lawfulness of the procedures for the collection of connection data that the data subjects are informed whenever their being so informed is no longer liable to jeopardise the investigations being undertaken by the competent authorities, or may such procedures be regarded as lawful taking into account all the other existing procedural safeguards where those safeguards ensure that the right to a remedy is effective?


The Court joined the multiple cases.

In short, it held that according to its caselaw, UE regulation precludes national legislative measures providing for the general and indiscriminate retention of traffic and location data. However, a national indiscriminate retention regulation is possible provided that:

  • The member state is facing a serious threat for national security that is shown to be present or forseeable;
  • The retention is limited to targeted groups or geographic regions;
  • Recourse to real-time collection of traffic and location data is limited to data subjects suspected to be involved in terrorist activities; and
  • These processing activities must be limited in time to what is necessary.


Share your comments here!

Further Resources

Share blogs or news articles here!