Acceso usuarios
Jürgen Kühling, Sonja Heitzer
In the joined cases of Digital Rights Ireland (C-293/12) and Kärntner Landesregierung (C-594/12), the ECJ declared the Data Retention Directive 2006/241 entirely invalid on April 8, 2014. The Court thereby laid down strict requirements regarding retention measures in respect of fundamental rights and particularly art.8 (Protection of personal data) of the EU Charter. This article examines the consequences for both the national and the EU legislators in terms of future data retention law. The ECJ considers the retention of data an appropriate measure for fighting international terrorism and other serious crimes. Provided the ECJ criteria developed in Digital Rights Ireland and Kärntner Landesregierung are observed, new approaches to data retention are permitted - and have already been made. With the UK passing the Data Retention and Investigatory Powers Act 2014 (DRIP) in July 2014 by way of emergency legislation, a Member State tried to apply the strict requirements set out by the ECJ to guarantee an uninterrupted practice of data retention within its territory. This article scrutinises the compliance of DRIP with EU fundamental rights and thereby considers the question of whether DRIP is a suitable model for other legislators. The relevance of this question is shown by assessing the situation in other EU Member States. Such Member States can be divided into three groups: the UK has applied the criteria set up by the ECJ; unaltered implementation law is still effective and even enforced by authorities in a second group of Member States; and other countries do not currently practise data retention, but are partly considering national approaches.
