Implications of invalidity of Data Retention Directive to telecom operators

Author:Darja Loncar Du Anovic
Position:Croatian Telecom
Pages:44-60
SUMMARY

Obligation for telecom operators to retain traffic and location data for combating crime purposes had been controversial ever since the adoption of the Data Retention Directive in 2006 because of its inherent negative impact on the fundamental right to privacy and personal data protection. However, the awaited judgment of the CJEU in April this year, which declared the Directive invalid, did not... (see full summary)

 
FREE EXCERPT
Implications of invalidity of Data Retention Directive
to telecom operators
LL.M. Darja LONČAR DUŠANOVIĆ1
Abstract
Obligation for telecom operators to retain traffic and location data for combating
crime purposes had been controversial ever since the adoption of the Data Retention
Directive in 2006 because of its inherent negative impact on the fundamental right to
privacy and personal data protection. However, the awaited judgment of the CJEU in April
this year, which declared the Directive invalid, did not so far resolve the ambiguity of the
issue. Namely, having in mind that half a year later, some countries did not amend their
national data retention legislations (yet) to comply with the aforementioned CJEU
judgment, telecom operators as addresses of this obligation are in uncertain legal situation
which could be called “lose-lose” situation. Also, the emphasis from the question of
proportionality between data privacy and public security is shifted to the question of
existence of valid legal basis for data processing (retaining data and providing them to
authorities) in the new legal environment in which national and EU law are still not in
compliance. In this paper the author examines the implications of the CJEU judgment to
national EU legislation, telecom operators and data subjects, providing comparative
analysis of national data retention legislation status in EU member states. The existence of
valid legal basis for data processing is examined within EU law sources, including within
proposed EU General Data Protection Regulation and opinions of the relevant data
protection bodies (e.g. Article 29 Working Party).
Keywords: data retention, Data Retention Directive, data protection, privacy,
legal bases.
JEL Classification: K30, K33
1. Introduction
Without intention to undermine the general positive impact of the Court of
Justice of the EU judgment invalidating Data Retention Directive (further in text:
CJEU judgment)2, which is righteously often referred to as historical or landmark
judgment, this paper focuses on three legal and factual problematic consequences
of this judgment which are inter-related. These are: 1) legal uncertainty, especially
for telecom operators3 as addressees of the data retention obligation with respect to

1 Darja Lončar Dušanović – Croatian Telecom Inc., darja.loncar@t.ht.hr
2 Digital Rights Ireland Ltd (C-293/12) v Minister for Communications, Marine and Natural
Resources and Others and Kärntner Landesregierung (C-594/12) and Others, 8.4.2014., Court of
Justice of EU, InfoCuria – Case-law of the Court of Justice, the document is available on-line at
http://curia.europa.eu/juris/liste.jsf?num=C-293/12# , last day accessed on 13.11. 2014
3 Telecom operators are joint term for providers of publicly available electronic communications
services or of public communications networks; Article (1) of the Directive 2006/24/EC of the
Juridical Tribune Volume 4, Issue 2, December 2014
45
this obligation (4.1.); inter alia, due to the unclear answer to the 2) question of
existence of legal bases for data retention (4.2.); and additional complexity of the
issue having in mind that 3) Data Retention Directive4 (further in text: DR
Directive) was declared invalid, thus with ex tunc effect (4.3.). After this
introductory part on the issue in question, this paper will provide brief overview
about DR Directive, including emergence and reasons for its enactment in 2006,
which will be followed by the presentation of the main conclusions and
argumentation of the CJEU judgment. This should lead to the central part of this
paper- three inter-related consequences of the invalidity of DR Directive as
mentioned ad.1)-3) above. Implications of the invalidity of DR Directive are
relevant to all EU member states and in particular those in which the national
legislation on data retention is still in place and was not (yet) assessed with respect
to its compliance with the CJEU judgment. Therefore, the issue in question shall be
primarily addressed on EU level, that is, scrutinized from EU law perspective and
not from particular national law perspective5. However, certain comparative
analysis of the status of current data retention regulation in EU member states
following CJEU judgment will be provided.
This paper doesn’t tend to provide final nor long lasting solution for
adequate data retention regulation, as this would be demanding task requiring
answers to complex question of supremacy between EU and EU member states
law, as well as question about justification of “special status” of national security
and combating crime purpose in relation to data privacy, which would go beyond
this paper and would require engagement and competences of experts in more
fields than in data privacy of electronic communications. However, this paper
(although tackling these questions) in its conclusion suggests possible “quick-win”
for faster alignment of national data retention legislation with EU law. The novelty
of this paper is less in pointing out to the legal uncertainty of telecom operators and
data subjects (ad.1) above), as this has been with more or less details mentioned
continuously ever since the CJEU judgment, but more in setting the question about
legal bases for data retention in general (ad.2) above), which can be useful in
particular for telecom operators in assessing their legal position with respect to data
retention issue and which can be useful as bases for reaching comprehensive and
long(er)lasting solution for data retention regulation on EU and national level.

European Parliament and of the Council of 15 March 2006 on the retention of data generated or
processed in connection with the provision of publicly available electronic communications
services or of public communications networks and amending Directive 2002/58/EC, Official
Journal of the European Union L 195, 13.4.2006.
4 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the
retention of data generated or processed in connection with the provision of publicly available
electronic communications services or of public communications networks and amending Directive
2002/58/EC, Official Journal of the European Union L 105, 13.4.2006., pp. 54-63
5 This point of addressing the issue is, however, possible only to certain extant as Member States’
national laws and EU law are inter-related.

To continue reading

REQUEST YOUR TRIAL