You are here:

Cyprus / Supreme Court of Cyprus, Appeal Jurisdiction / Civil Appeal No. 26/2017

Re. the Application of Artemis Kkolos for the issue of a certiorari order

Policy area:
Information society
Deciding Body type:
National Court/Tribunal
Deciding Body:
Supreme Court of Cyprus, Appeal Jurisdiction
Decision date:

Key facts of the case:

 In 2017 the appellant applied to the Supreme Court seeking to annul an order issued by the first instance court which had granted access to his IP address. At the first instance trial, the applicant had argued that the issue of the order for access to his IP address infringed his right to privacy and confidentiality of communication; articles 7, 8, 11 and 52 of the EU Charter; and Council Directive 2002/58/EC as interpreted by the CJEU in Tele2 Sveridge AB.[1] The first instance court rejected his application on the ground that Tele2 Sveridge AB did not affect national provisions of data retention for combating crime. One of the reasons cited by the first instance court for the non-applicability of the Tele2 Sveridge ruling in the case at hand was that the CJEU ruling was issued after the court order had granted access to the applicant’s IP address and could not be taken into consideration for being post-dated. As additional reason for rejecting the applicant’s claim, the lower court had found that the ruling in Tele2 Sveridge was not intended to have an impact on actions intended to combat crime.

[1] Court of Justice of the European Union (CJEU), C‑203/15 and C‑698/15, Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department,  21 December 2016, available at

Key legal question raised by the Court:
Whether there were sufficient grounds in order to reverse the trial court decision which had granted access to the applicant’s telecommunication data, in light of the interpretation Directive 2002/58/EC given by the CJEU in the Tele2 Sveridge.
Outcome of the case:

The appeal court found that, given the supremacy of the EU acquis over the Constitution, the timing of the ruling in Tele2 Sveridge and the fact that it was issued after the challenged court order could not legitimise an order which, by virtue of a CJEU ruling, does not comply with the EU Charter. The interpretation of the Directive by the CJEU in the protection of rights protected by the EU Charter must be seen as existing since the adoption of Directive 2002/58/EC.

The Supreme Court concluded there is a prima facie that the CJEU ruling in Tele2 Sveridge affects the legality of a court order granting access to telecommunication data retained under a law that may potentially infringe the Charter.[1] The Court refrained from conclusively deciding on the compliance of the national data retention law with the Charter at the current stage and decided only to allow the appeal and set aside the trial court decision which had authorised access to the applicant’s data.

The Court did not consider the question of the applicability of the Charter in light of the fact that the national data retention law is, strictly speaking, not transposing the EU acquis.

[1] Cyprus, Law on the Retention of Telecommunications Data for the purpose of investigating serious crimes (Ο περί Διατήρησης Τηλεπικοινωνιακών Δεδομένων με Σκοπό τη Διερεύνηση Σοβαρών Ποινικών Αδικημάτων Νόμος του 2007) N.183(I)/2007. Available at