Key facts of the case:
Directive 2006/24/CE on data retention was transposed in Belgium by the data retention law of 30 July 2013, which entered into force on the 2nd of September 2013. In February 2014, two actions for annulment of the law of 30 July 2013 were lodged respectively by the Belgian, French and German speaking bar associations and by the two Belgian League of Human Rights associations (‘Liga voor Mensenrechten/Ligue des Droits de l’Homme’).
The bar associations requested the annulment of Article 5 of the law which comprises most of the content of the law and regulates the retention of data itself whereas the two League of Human Rights associations requested the annulment of the entire law. Both parties invoked the violation of a number of fundamental rights provisions as grounds for the annulment, but mainly Articles 10 and 11 of the Belgian Constitution which guarantee equality and non-discrimination, Articles 6 and 8 of the European Convention of Human Rights and Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union.
As for the two League of Human Rights associations, referring to the opinion of the Advocate General at the Court of Justice of the European Union , they claimed that the time limits provided by the law breach the principle of legality and the principle of proportionality. Secondly, they invoke multiple grounds of violations: the nature and scale of the collected data breach the right to privacy; that there are no distinct rules between the laws transposing Directive 2002/58/CE and Directive 2006/24/CE; that there would be situations where legal certainty and the prohibition of arbitrary action would be compromised but also where interference with privacy, freedom of speech, freedom of the press and the right to freedom of assembly would be disproportionate; the lack of precision on whom is the competent authority and on the discretionary power of the intelligence services; the law does not provide sufficient judicial control to safeguard against abuse; the notion of criminal offence used in the law does not respect the principle of legality and is in any case disproportionate; the lack of a definition of the data that is to be retained by type of service and the lack of requirements by which these data must abide; finally, the duration of the retention period is criticised.
Outcome of the case:
The Court decided that Article 5 of the law was unconstitutional and due to the interlinked nature of the other provisions of the law with Article 5, it repealed it all.
The Court ruled that the limitations provided for by the law to the principles of privacy and protection of personal data were disproportionate with regard to Articles 10 and 11 of the Constitution and Articles 7, 8 and 52.1 of the Charter of Fundamental Rights of the European Union.
B.9. ”As the Court of Justice of the European Union has ruled in its ruling of 8 April 2014 (paragraph 34), the obligation imposed by Articles 3 and 6 of the Directive 2006/24/CE to the telecom providers to retain during a certain amount of time data related to the privacy of a person and his communication, such as those referred to under Article 5 of the Directive, constitutes in itself an interference with the rights protected by Article 7 of the Charter.
The Court of Justice also ruled in paragraph 35 of its judgment that ‘the access of the competent national authorities to the data constitutes a further interference with that fundamental right (see, as regards Article 8 of the ECHR, Eur. Court H.R., Leander v. Sweden, 26 March 1987, § 48, Series A no 116; Rotaru v. Romania [GC], no. 28341/95, § 46, ECHR 2000-V; and Weber and Saravia v. Germany (dec.), no. 54934/00, § 79, ECHR 2006-XI). Accordingly, Articles 4 and 8 of Directive 2006/24 laying down rules relating to the access of the competent national authorities to the data also constitute an interference with the rights guaranteed by Article 7 of the Charter.’
This interference with the Directive was considered as being particularly serious (paragraph 37), even though the Directive does not allow for someone to have knowledge of the content as such of the electronic communication retained (paragraph 39). In order to control the proportionality of the observed interference, the Court of Justice concluded the following: (…)”
B.10.1. “As the Court of Justice pointed out in paragraphs 56 and 57 of its judgment, the Directive imposes an obligation for the retention of all data related to communications concerning fixed telephone, mobile telephone, internet access, electronic mail by internet as well as telephone by internet, covering in a general way all persons and all means of electronic communications without distinctions relating to the objective of the fight against serious crimes that the legislator of the Union intended to pursue.
The law on data retention does not distinguish itself from the Directive on this matter. Indeed, as it was said in B.8., the categories of data that must be retained are identical to those enumerated in the Directive whereas no distinctions are made with regard to the persons concerned or concerning the particular rules provided for in relation to the objective of the fight against the infractions described in article 126§2 of the law of 13 June 2005 which was replaced by the lawon data retention. Just like the Court of Justice established for the Directive (paragraph 58), the law also applies to persons where no clues exist which would indicate their involvement, even indirect or remote, to the infractions enumerated by the law. Furthermore, the law also applies without exception to persons whose communications are subject to professional secrecy.”
B.10.2. “Just like it is the case for the DirectiveArticle 5 does not require a link between the data whose retention is provided for and a threat to public security. Article 5 also does not limit the retention of data to a temporal period nor a determined geographical zone nor a group of persons likely to be involved in one of the infractions concerned by the law or who could contribute by the data retention to prevent, detect or pursue those infractions.”
B.10.3. “If the competent authorities who have access to the retained data concerned are enumerated by Article 126§5, 3° of the law of 13 June 2005 as replaced by article 5 of the law on data retention, no material nor procedural conditions are defined by the law regarding their access.
B.10.4. “Finally, concerning the duration of the retention of data, the law makes no distinction between the categories of data according to their potential use to the end objective pursued or the persons concerned.”
B.11. “For the same reasons as those that led the Court of Justice of the European Union to declare the data retention Directive invalid, by the adoption of Article 5 of the challenged law, the legislature has exceeded the limits imposed by the principle of proportionality with regard to Articles 7, 8 and 52.1 of the Charter of Fundamental Rights of the European Union.”