The European Court of Justice (ECJ) has ruled that a “general and indiscriminate retention” of data is against EU law and can only be done under certain conditions and “solely for the purpose of fighting serious crime”.
The ruling declares that countries are not allowed to impose laws requiring internet service providers to retain all their customers’ data, restricting the practice to specific cases of a “serious crime”.
The European Court of Justice already declared the European Directive 2006/24/EC for data retention as invalid in 2014. At that time the court argued that a general surveillance of the public would violate fundamental rights.
A win for our right to privacy
This week the ECJ once more states that our right to privacy is a basic human right. A general surveillance of all citizens is against European law. The court dealt a significant blow to governments and organizations who have recently been pushing for stronger surveillance and more data collection.
The Court’s ruling calls into question several European laws such as the UK Snooper’s Charter, which allows authorities to hack devices and services en masse and requires ISPs to retain 12 months of website access logs on all users.
The ruling also undermines a recently passed data retention law in Germany. In this law politicians explicitly excluded email to convince courts - such as the German Federal Constitutional Court, which is known for protecting people’s privacy - that the new law would not infringe our right to privacy. The recent European ruling shows that this calculation of German politicians will very likely not add up.
German retention law will be declared unconstitutional
The European ruling reassures us that the German data retention law will be declared as unconstitutional as well. While we as a secure email provider are happy that email is not included in the German surveillance law, we reject any data retention law as it undermines our right to privacy.
The European high court stated in its ruling “that EU law precludes national legislation that prescribes general and indiscriminate retention of data. The interference by national legislation that provides for the retention of traffic data and location data with that right must therefore be considered to be particularly serious. The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance. Consequently, only the objective of fighting serious crime is capable of justifying such interference.”
This ruling reassures us that everyone has the right to live their personal lives without being spied on. This truly is a victory for privacy.