Implications of invalidity of Data Retention Directive to telecom operators

• Author: Darja Loncar Du Anovic
• Position: Croatian Telecom
• Pages: 44-60

Implications of invalidity of Data Retention Directive

to telecom operators

LL.M. Darja LONČAR DUŠANOVIĆ1

Abstract

Obligation for telecom operators to retain traffic and location data for combating

crime purposes had been controversial ever since the adoption of the Data Retention

Directive in 2006 because of its inherent negative impact on the fundamental right to

privacy and personal data protection. However, the awaited judgment of the CJEU in April

this year, which declared the Directive invalid, did not so far resolve the ambiguity of the

issue. Namely, having in mind that half a year later, some countries did not amend their

national data retention legislations (yet) to comply with the aforementioned CJEU

judgment, telecom operators as addresses of this obligation are in uncertain legal situation

which could be called “lose-lose” situation. Also, the emphasis from the question of

proportionality between data privacy and public security is shifted to the question of

existence of valid legal basis for data processing (retaining data and providing them to

authorities) in the new legal environment in which national and EU law are still not in

compliance. In this paper the author examines the implications of the CJEU judgment to

national EU legislation, telecom operators and data subjects, providing comparative

analysis of national data retention legislation status in EU member states. The existence of

valid legal basis for data processing is examined within EU law sources, including within

proposed EU General Data Protection Regulation and opinions of the relevant data

protection bodies (e.g. Article 29 Working Party).

Keywords: data retention, Data Retention Directive, data protection, privacy,

legal bases.

JEL Classification: K30, K33

1. Introduction

Without intention to undermine the general positive impact of the Court of

Justice of the EU judgment invalidating Data Retention Directive (further in text:

CJEU judgment)2, which is righteously often referred to as historical or landmark

judgment, this paper focuses on three legal and factual problematic consequences

of this judgment which are inter-related. These are: 1) legal uncertainty, especially

for telecom operators3 as addressees of the data retention obligation with respect to





1 Darja Lončar Dušanović – Croatian Telecom Inc., darja.loncar@t.ht.hr

2 Digital Rights Ireland Ltd (C-293/12) v Minister for Communications, Marine and Natural

Resources and Others and Kärntner Landesregierung (C-594/12) and Others, 8.4.2014., Court of

Justice of EU, InfoCuria – Case-law of the Court of Justice, the document is available on-line at

http://curia.europa.eu/juris/liste.jsf?num=C-293/12# , last day accessed on 13.11. 2014

3 Telecom operators are joint term for providers of publicly available electronic communications

services or of public communications networks; Article (1) of the Directive 2006/24/EC of the

Juridical Tribune Volume 4, Issue 2, December 2014

45

this obligation (4.1.); inter alia, due to the unclear answer to the 2) question of

existence of legal bases for data retention (4.2.); and additional complexity of the

issue having in mind that 3) Data Retention Directive4 (further in text: DR

Directive) was declared invalid, thus with ex tunc effect (4.3.). After this

introductory part on the issue in question, this paper will provide brief overview

about DR Directive, including emergence and reasons for its enactment in 2006,

which will be followed by the presentation of the main conclusions and

argumentation of the CJEU judgment. This should lead to the central part of this

paper- three inter-related consequences of the invalidity of DR Directive as

mentioned ad.1)-3) above. Implications of the invalidity of DR Directive are

relevant to all EU member states and in particular those in which the national

legislation on data retention is still in place and was not (yet) assessed with respect

to its compliance with the CJEU judgment. Therefore, the issue in question shall be

primarily addressed on EU level, that is, scrutinized from EU law perspective and

not from particular national law perspective5. However, certain comparative

analysis of the status of current data retention regulation in EU member states

following CJEU judgment will be provided.

This paper doesn’t tend to provide final nor long lasting solution for

adequate data retention regulation, as this would be demanding task requiring

answers to complex question of supremacy between EU and EU member states

law, as well as question about justification of “special status” of national security

and combating crime purpose in relation to data privacy, which would go beyond

this paper and would require engagement and competences of experts in more

fields than in data privacy of electronic communications. However, this paper

(although tackling these questions) in its conclusion suggests possible “quick-win”

for faster alignment of national data retention legislation with EU law. The novelty

of this paper is less in pointing out to the legal uncertainty of telecom operators and

data subjects (ad.1) above), as this has been with more or less details mentioned

continuously ever since the CJEU judgment, but more in setting the question about

legal bases for data retention in general (ad.2) above), which can be useful in

particular for telecom operators in assessing their legal position with respect to data

retention issue and which can be useful as bases for reaching comprehensive and

long(er)lasting solution for data retention regulation on EU and national level.





European Parliament and of the Council of 15 March 2006 on the retention of data generated or

processed in connection with the provision of publicly available electronic communications

services or of public communications networks and amending Directive 2002/58/EC, Official

Journal of the European Union L 195, 13.4.2006.

4 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the

retention of data generated or processed in connection with the provision of publicly available

electronic communications services or of public communications networks and amending Directive

2002/58/EC, Official Journal of the European Union L 105, 13.4.2006., pp. 54-63

5 This point of addressing the issue is, however, possible only to certain extant as Member States’

national laws and EU law are inter-related.