updated 12:52 pm EDT, Tue April 8, 2014
European directive forcing storage of metadata infringes right of privacy
A directive requiring telecommunications companies in European Union countries to store metadata about users of its services for up to two years has been declared invalid by the European Court of Justice. The Data Retention Directive was found by the court to interfere with the "fundamental rights to respect for private life and to the protection of personal data."
The directive was first introduced in 2006 as a counter-terrorism measure two years after the Madrid bombings, reports ZDNet. Communication services were required to retain traffic, location data, and subscriber data for a period ranging between six months and two years, though much like the NSA's activities, the stored data consisted of metadata rather than the contents of messages. The system in theory allows government agencies and law enforcement to request data relating to individuals, in order to track other potential suspects.
European Court of Justice
The High Court of Ireland and the Constitutional Court of Austria asked for the European Court of Justice to examine the directive's validity, and its relation to the Charter of Fundamental Rights of the EU. Both the Austrian and Irish courts have cases that rely on the EU Court of Justice's decision, with the Austrian case specifically seeking the annulment of a national provision enacting the directive into Austrian law.
While the ruling notes that the retention of data "genuinely satisfies an objective of general interest" in helping fight serious crime and helping public security, the EU legislature has "exceeded the limits imposed by compliance with the principle of proportionality." The directive may be appropriate in terms of counter-terrorism, but the "wide-ranging and particularly serious interference of the directive with the fundamental rights at issue is not sufficiently circumscribed to ensure that that interference is actually limited to what is strictly necessary."
The court also considers the data retention period to be an issue, in that it does not distinct between various categories of data based on individuals of interest nor in its potential usefulness in relation to what the directive is pursuing. Lastly, the court notes that the directive does not specify that data collected under it must be stored within the EU, and so does not ensure the protection of citizen data.
The ruling by the European Court of Justice does not directly change the law in individual member states. The governments of each country will need to adjust their laws to match, or domestic courts can rule the laws invalid.
Cecilia Malmström, European Commissioner for Home Affairs, states the European Commission "will now carefully assess the verdict and its impacts."