La Quadrature du Net – CJEU Judgment (France, 2020)

In France, multiple NGOs lodged actions for annulment of national regulation which required electronic communication providers and operators to massively and automatically store and process data in order to detect terrorist threats. They considered that these regulations were not compliant with (among others) Directive 2022/58. The Conseil d’Etat stayed the proceedings and referred three questions to the CJEU for a preliminary ruling: (1) Is the general and indiscriminate retention obligation imposed on providers on the basis of the implementing provisions of Article 15(1) of [Directive 2002/58] to be regarded, against a background of serious and persistent threats to national security, and in particular the terrorist threat, as interference justified by the right to security guaranteed in Article 6 of the [Charter] and the requirements of national security, responsibility for which falls to the Member States alone pursuant to Article 4 [TEU]? (2) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as authorising legislative measures, such as the measures for the real-time collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data? (3) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as meaning that it is a prerequisite for the lawfulness of the procedures for the collection of connection data that the data subjects are informed whenever their being so informed is no longer liable to jeopardise the investigations being undertaken by the competent authorities, or may such procedures be regarded as lawful taking into account all the other existing procedural safeguards where those safeguards ensure that the right to a remedy is effective?’ The Court joined the multiple cases. In short, it held that according to its caselaw, UE regulation precludes national legislative measures providing for the general and indiscriminate retention of traffic and location data. However, a national indiscriminate retention regulation is possible provided that: * The member state is facing a serious threat for national security that is shown to be present or forseeable; * The retention is limited to targeted groups or geographic regions; * Recourse to real-time collection of traffic and location data is limited to data subjects suspected to be involved in terrorist activities; and * These processing activities must be limited in time to what is necessary.