EU Data Retention: Death of a Directive?

The Data Retention Directive was adopted in the aftermath of the public transport attacks in London in July 2005. It requires telecommunications service providers to retain user traffic data for all telecommunications users for a period of six months to two years. The Directive has been highly criticised for requiring generalised data surveillance within the EU and thus infringing privacy of EU citizens.

Since its adoption, the Directive has been challenged in several Member States. The German Administrative Court of Wiesbaden, Supreme Administrative Court of Bulgaria and Romanian Constitutional Court had all found some or all of the measure to be unlawful. Furthermore, Sweden has been on the receiving end of an enforcement action by the Commission for its failure to implement the measure. The Swedish Government continues to equivocate as the matter is likely to be contentious in the upcoming General Election there. However, as widely reported (Irish Times, Financial Times), the German Federal Constitutional Court has now dealt what may be the death blow to the measure.

The German Court held that the national law implementing the Directive was repugnant to the German Constitution. The grounds for the decision are not yet available in English, but the FT summarises:

The judges ruled that the German legislation putting the EU directive into effect violated a constitutional guarantee of privacy. Although it did not outlaw data storage, the ruling requires the purpose of such storage be defined, its use sanctioned by a court of law, and justified on the grounds of serious crime.

This reasoning is largely similar to that of the Romanian Constitutional Court in its decision of October last year. However, coming from the German Court – probably the most influential national court in the EU – it represents a much bigger threat to the Directive. Two particular similarities between the Romanian and German decisions are worth pointing out: first, both Courts express their dissatisfaction with the general scheme of the data retention programme – not simply specific issues that might be rectified by better transposition; second, both judgments are targeted at the national implementing law rather than the Directive itself. This sleight of hand offers merely the smallest of fig leafs to decisions that challenge the supremacy of EU law on the basis of incompatibility with national constitutional law.

Turning to the Irish situation, the decision of the German Federal Constitutional Court casts new doubt on the Retention of Data Bill 2009. Ireland opposed the adoption of the Data Retention Directive under the first pillar – believing it to be more appropriately based in the (now defunct) third pillar. At the time this would have required unanimity in the adoption of the measure. Following the adoption of the measure under the first pillar, Ireland, supported by Slovakia, challenged the measure before the European Court of Justice on grounds of incorrect competence. However, in a decision that is difficult to reconcile with its earlier decision in the PNR case, the Court of Justice found that the measure was correctly based on Article 95 EC (for a critique, see Murphy, forthcoming in 16(2) European Public Law). However, the Irish Government did not raise human rights objections to the Data Retention Directive. Digital Rights Ireland have challenged existing Irish law in this area, and an application for reference to the European Court of Justice remains before the High Court. However, the Retention of Directive Bill 2009 has continued through the Oireachtas until the German Court cast doubt on the entire regime.

Those of us without sufficient legal Deutsch will have to wait until the decision is offered in translation to get our teeth into it. In the meantime, the cumulative effect of these decisions may have heralded the death of the Directive. However, we should remember that unless the Court of Justice itself finds the Directive unlawful, then it will remain valid law in Member States that have implemented it. Opponents of the Irish Bill – and implementing legislation across Europe – should take the chance to act.

CORRECTION (21/04/2010): This blog post originally implied that the Irish High Court had made the reference to the European Court of Justice, when in fact at the time of writing the application for a reference was still before the Court. HRinI will keep you informed as to the progress of the application.