## Facts

- An EU directive required providers of publicly available electronic communications services to retain specified traffic and location data (excluding content) for 6 to 24 months.
- The stated purpose of retention was to support the investigation, detection, and prosecution of serious crime and protect public security.
- Digital Rights Ireland challenged the directive’s validity before the Irish High Court.
- Austrian applicants challenged national implementing measures; the Austrian Constitutional Court referred questions concerning the directive’s validity.
- Both national courts requested a preliminary ruling on whether the directive complied with fundamental rights to privacy and personal data protection and proportionality requirements.
- The retention obligation applied broadly to all subscribers and registered users and to multiple categories of communications (fixed, mobile, and internet-related services).

## Issues

1. Whether mandatory retention of traffic and location data constitutes an interference with the rights to respect for private life and protection of personal data.
2. If so, whether the interference is justified as necessary and proportionate to an objective of general interest, given the directive’s scope, access rules, retention period, and safeguards.

## Decision

- The court held that the directive entailed a wide-ranging and particularly serious interference with rights to private life and personal data protection.
- The court accepted that combating serious crime and protecting public security are legitimate objectives of general interest.
- The court ruled the directive was not limited to what was strictly necessary and failed proportionality review.
- The directive was declared invalid in its entirety, with effect from its adoption.

## Legal Principles

- Retention of traffic and location data (even without content) can seriously interfere with privacy and data protection because it enables detailed inferences about a person’s private life.
- A measure limiting fundamental rights must be provided by law, respect the essence of the rights, and be necessary and proportionate to the legitimate aim.
- General and indiscriminate retention covering all persons, all communications, and all traffic data—without differentiation, limitation, or exception tied to fighting serious crime—exceeds what is strictly necessary.
- Access and use of retained data must be governed by clear substantive and procedural conditions, including objective criteria and, in principle, prior review by a court or an independent body (subject to limited urgency exceptions).
- Retention periods must be tailored; an undifferentiated 6–24 month window applied across categories of data and persons, without linkage to investigative value, fails necessity and proportionality.
- Effective safeguards are required to protect retained data against abuse and unlawful access, including strong security, confidentiality, and independent oversight; allowing providers to reduce safeguards based on cost is inconsistent with serious rights interferences.
- Not requiring retention within the relevant jurisdiction can weaken effective independent control over compliance with data protection requirements.

## Conclusion

The court invalidated the EU-wide data retention regime because it imposed indiscriminate retention of communications metadata and lacked targeted limits, strict access conditions, tailored retention periods, and robust security and oversight safeguards necessary to make the interference proportionate to the objective of combating serious crime.


Digital Rights Ir. Ltd. v. Minister for Commc’ns, Marine & Nat. Res., Joined Cases C-293/12 & C-594/12 (C.J.E.U. 2014)