On 6 October 2020, the Court of Justice of the European Union (”CJEU”) issued its judgments in Case C-623/17, Privacy International, and in Joined Cases C-511/18, La Quadrature du Net and Others, C-512/18, French Data Network and Others, and C-520/18, Ordre des barreaux francophones et germanophone and Others.
In a nutshell, CJEU confirmed that EU law precludes national legislation requiring a provider of electronic communications services to carry out the general and indiscriminate transmission or retention of traffic data and location data for the purpose of combating crime in general or of safeguarding national security. However, CJEU held that where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable, that Member State may require providers of electronic communications services, by way of legislative measures, the general and indiscriminate retention of that data for a period that is limited in time to what is strictly necessary, but which may be extended if the threat persists.
The press release is available here, the judgment in Case C-623/17 here and the judgment in joint Cases C-511/18, C-512/18, C-520/18 may be accessed here.
