In a ruling cheered by privacy advocates, the European Union's highest court on Tuesday struck down an online data collection directive saying the law trampled on "the fundamental rights to respect for private life and to the protection of personal data."
The decision by EU Court of Justice invalidates the controversial 2006 Data Retention Directive, which required telecommunications companies to keep EU citizens' data for between six months and two years "[b]ecause retention of data has proved to be such a necessary and effective investigative tool for law enforcement in several Member States, and in particular concerning serious matters such as organized crime and terrorism, it is necessary to ensure that retained data are made available to law enforcement authorities for a certain period."
In its decision, the Court states that "the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data," and that the fact that the surveilled user may not even be aware of the surveillance could give "the persons concerned a feeling that their private lives are the subject of constant surveillance."
In addition, the bulk collection nature of the directive cannot assure that the surveillance "is actually limited to what is strictly necessary."
London-based group Privacy International said, "It is right and overdue that this terrible directive was struck down."
"What the Snowden revelations have showed us over the past year is that the international surveillance apparatus set up by intelligence agencies is in direct conflict with human rights," the group continued. "If the Data Retention Directive fails to meet the requirements of human rights law, then the mass surveillance programs operated by the US and UK governments must equally be in conflict with the right to privacy."
"What the Snowden revelations have showed us over the past year is that the international surveillance apparatus set up by intelligence agencies is in direct conflict with human rights."
—Privacy InternationalDigital rights group La Quadrature du Net also hailed the ruling, calling it an "important step towards regaining our fundamental right to respect for private life and to the protection of personal data."
"This landmark decision is a victory for all defenders of privacy who have been fighting mandatory data retention across Europe since 2006 against the bulk retention of communications," stated Félix Tréguer, co-founder of the Paris-based group.
"Following a year of intense debate on mass surveillance, the EU Court of Justice makes clear that laws adopted in the name of the war on terror have led to unacceptable violations of privacy. This ruling is an invitation for everyone to continue the fight against surveillance by all appropriate means, be they technical, political or legal. One legislative step at a time, our governments had drifted away from the rule of law and now is the time to remind them that fundamental rights are the cornerstones of our democracies and non-negotiable," Tréguer added.
The challenge to the directive had been brought forth by Digital Rights Ireland, which welcomed the Court's decision.
La Quadrature explains that the ruling "extends to all European countries thus obliging some member states to reform their national legislation in order to ensure that it complies with today's ruling.