Preventive retention of traffic and location data for the purpose of combating serious crime is incompatible with EU law
By way of judgement dated 17 November 2022 under case C-350/21, initiated as per the preliminary inquiry of the Bulgarian Specialized Criminal Court (now closed), the Court of Justice of the EU (ECJ) answered questions related to the Bulgarian legal framework regarding the storage of traffic data and location data of individuals, conducted by the companies providing public electronic communication networks and/or services for a period of 6 months and the access to this data by the criminal proceedings authorities.
According to the ECJ’s judgement, EU law does not allow:
- National legislation which provides preventively, for the purposes of combating serious crime and preventing serious threats to public security, general and indiscriminate retention of traffic data and location data, even if the said legislation limits in time this general and indiscriminate retention up to a period of six months and provides certain guarantees in the field of preservation and access to the relevant data;
- National legislation, which does not provide clearly and precisely that the access to the stored data is limited to what is strictly necessary to achieve the purpose pursued by this storage;
- National legislation which provides for access by national authorities competent in the field of criminal investigation to lawfully retained traffic data and location data without ensuring that the persons to whose data those national authorities had access, have been notified thereof to the extent provided for by Union law, and without the said persons having a legal remedy against unlawful access to such data.
With the judgement, the ECJ confirms its previous practice that the storage of traffic data is a serious interference in the private sphere of the individual, when based on the total data very accurate conclusions can be drawn regarding the personal life of the affected person - user of an electronic means of communication (for example: the habits of the persons in their daily life, the place of permanent or temporary residence, their daily or other journeys, the activities carried out, the social connections of these persons and the social circles in which they move, and in particular to establish the profile of the said persons).
According to the ECJ, such conclusions about the personal life of a user can be drawn even if the data is stored in a limited volume or for a short period of time. The ECJ has held that the authorization of access to stored traffic and location data issued by a national jurisdiction at the request of a national authority in the field of criminal investigation, is not in itself sufficient to ensure effective protection of the affected persons against risks from misuse and illegal access to data relating to them, without the relevant persons having been heard and without their possible objections being taken into account by the authorizing jurisdiction.