## Facts

- An EU-wide data-retention directive requiring retention of traffic and location data was annulled after being found to impose a serious, unjustified interference with privacy and data-protection rights.
- In Sweden, an electronic communications provider stopped retaining traffic and location data; the national telecom authority ordered it to resume retention under Swedish law, and the provider challenged that order.
- In the United Kingdom, individuals challenged a statute authorizing the government to require communications operators to retain communications data for up to 12 months; a national court found the statute inconsistent with EU law, and the government appealed.
- The Swedish and UK courts referred questions to the Court of Justice of the European Union (Grand Chamber) concerning whether national retention and access regimes were compatible with the e-Privacy Directive and EU Charter rights.
- The cases were joined because both concerned national regimes imposing provider retention of communications metadata and state access for crime-fighting and public-security purposes.

## Issues

1. Whether national laws requiring providers to retain traffic and location data for crime-fighting/public-security purposes fall within the scope of the e-Privacy Directive, including its derogation clause.
2. Whether EU law permits general and indiscriminate retention of all traffic and location data of all users across all means of electronic communication.
3. What minimum conditions EU law requires for governmental access to retained data, including thresholds, oversight, notice, storage, and security safeguards.
4. Whether the Charter-based limits articulated in prior EU case law govern Member State retention/access regimes adopted under the e-Privacy Directive.

## Decision

- The Court held that the e-Privacy Directive applies to national measures that require providers to retain communications metadata and that regulate access to such data for crime-fighting/public-security objectives.
- The Court held that EU law precludes national legislation that, for the purpose of fighting crime, imposes general and indiscriminate retention of all traffic and location data of all subscribers and registered users.
- The Court stated that only targeted retention, limited to what is strictly necessary and aimed solely at fighting serious crime, may be compatible with EU law.
- The Court required that access to retained data be limited to fighting serious crime and generally subject to prior review by a court or an independent administrative authority, with limited urgency exceptions.
- The Court required safeguards including post-access notice when it no longer jeopardizes investigations, EU-based storage, and strong security measures with destruction at the end of the retention period.
- As a preliminary ruling, the judgment bound the referring courts to apply these standards to the Swedish and UK regimes.

## Legal Principles

- National measures restricting confidentiality of communications under the e-Privacy Directive must be interpreted strictly and must comply with the EU Charter’s proportionality requirement.
- Retention of traffic and location data enabling detailed inferences about private life constitutes a particularly serious interference with the rights to private life and protection of personal data.
- General, indiscriminate retention of all users’ traffic and location data exceeds what is strictly necessary and is not justified under the e-Privacy Directive as limited by the Charter.
- Targeted retention may be permissible only when limited by objective criteria (such as persons, geography, time, and categories of data), confined to serious crime, and limited in duration to what is strictly necessary.
- Access to retained data must be governed by objective criteria, restricted to serious crime, and ordinarily conditioned on prior independent authorization; affected persons should receive delayed notice when feasible.
- Effective oversight requires secure handling, EU-based retention to enable supervision by data-protection authorities, and irreversible destruction at the end of the retention period.

## Conclusion

The Court barred blanket communications metadata retention under EU law and permitted only strictly necessary, targeted retention for serious crime, coupled with independent prior authorization for access and robust safeguards for storage, security, oversight, and delayed notice.


Tele2 Sverige AB v. Post-och telestyrelsen & Sec'y of State for the Home Dep't v. Watson (Joined Cases C-203/15 & C-698/15) (CJEU 2016)