Netherlands / District Court The Hague / C/09/480009 / KG ZA 14/1575 Foundation Privacy First and others v The Netherlands (Ministries of Economic Affairs and Security and Justice)

Key facts of the case:

This case is about objections to the Act on the Retention of Telecommunication Data. As the European Court of Justice has found the Directive on Data Retention invalid on the basis of the Charter, among other instruments, according to the claimants,the Dutch Act above mentioned, which is an almost literal implementation of the Directive, should be declared inapplicable (Dutch Courts cannot declare that an Act of Parliament is invalid, due to Constitutional provisions, so it continues to exist). According to the claimants, the current retention of data of among other innocent Dutch citizens is in conflict with the right to privacy, the right to the protection of personal data and the freedom of expression. The President of the District Court holds that the duty to retain telecommunication data is, indeed, an infringement of these provisions. However, such an infringement may be justified and proportional. The District Court judges the question whether the infringement is strictly necessary. It is clear that a limitation of the retention of data cannot easily be imagined in the context of the effective prosecution of heavy criminals. But it will be very difficult to make a difference between a first offender and citizens who are not suspected at all. Therefore, there should be strict safeguards. There is no independent authority which controls the requirements in terms of protection and safeguards when service providers retain data outside the territory of the European Union, and there are some smaller ones which do so. Moreover, Dutch authorities have access to the data also in the case of offences, such as the theft of a bicycle. There are no provisions that see to it that access to the data is really limited to what is strictly necessary of the combat of (only) serious crimes. Moreover, access is not subject to prior independent approval by, for example, a court. EU law (for example the Charter) has been applied and implemented in Dutch law on the basis of judicial precedent. This entails that when the Court decides that the Act is inapplicable, EU law provisions prevail, but the inapplicable national Act it will continue to exist. This decision will also be followed in possible subsequent cases, as this judgment has become the core of Dutch law in this area, replacing the provisions of the Act. 

Outcome of the case:

The Court ruled that the Act on the Retention of Telecommunication Data is inapplicable because it is in conflict with the right to privacy and the right to the protection of personal data. The District Court judges that there is an infringement of these rights. It is clear that a limitation of the retention of data cannot easily be imagined in the context of the effective prosecution of heavy criminals. But it will be very difficult to make a difference between a first offender and citizens who are not suspected at all. Therefore, there should be strict safeguards. There is no independent authority which controls the requirements in terms of protection and safeguards when service providers retain data outside the territory of the European Union, and there are some smaller ones which do so. Moreover, Dutch authorities have access to the data also in the case of offences, such as the theft of a bicycle. There are no provisions that see to it that access to the data is really limited to what is strictly necessary of the combat of (only) serious crimes. Moreover, access is not subject to prior independent approval by, for example, a court.

Paragraphs referring to EU Charter: 

 

Article 51 of the Charter stipulates that the Charter applies when Member States implement Union law. It follows from ECJ case law that the concept “Union law” in the sense of this article must be regarded as activities by the Member States within the scope of the law of the Union (among other things: ECJEU 30 April 2014, C-390/12, Pfleger). As the Act on the Retention of Telecommunication Data implements the so-called e-privacy Directive (Directive 2002/58/EC) and implies a limitation of the free movement of services, this Act falls within the scope of the Charter. It should therefore be checked whether the Act - as alleged by Privacy First and others - infringes Articles 7 and 8 of the Charter without any justification whatsoever. The State, in this context, has not denied that the Act contains, virtually, the same provisions as the Data Retention Directive, but it has - rightly so, according to the President of the Court in summary proceedings - stated that the whole of relevant national legislation should be involved in the question whether the Act is in agreement with Articles 7 and 8 of the Charter. It is clear that the objections against the Data Retention Directive by the Court in its judgement of 8 April 2014, apply, among other things, to the absence of certain safeguards for the safety of and access to the retained data. Those objections may as well be met by applicable provisions in other national rules and legislation.

3.5. Articles 7 and 8 of the Charter lay down the right of respect of private life, family life, house and communication and the right to the protection of personal data. Privacy First and others have put forward that the sole fact that the Act lays down that telecommunication data are retained is as such an unacceptable infringement of Articles 7 and 8 of the Charter. It is a fact, just as the Court considers under considerations 32 up to and including 37 of the judgement, that the duty to retain data about the communications of persons during a certain period of time (in this case imposed by the Act) is an infringement of Articles 7 and 8 of the Charter. This is in line with the case law of the European Court of Human Rights, relied on by Privacy First and others. For example, there is, in relation to Article 8 ECHR, a consideration: “The mere storing of data relating to the private life of an individual amounts to an interference within the meaning of article 8 (...). The subsequent use of the stored information has no bearing on that finding.” (ECtHR 4 December 2008, S. and Marper, appl.nos 30562/04 and 30566/04). Privacy First and others therefore justifiably allege that the use of the data is an independent, further infringement of the rights mentioned. In sofar as Privacy First and others, however, argue that the infringement of the rights mentioned is as such inadmissable, the District Court does not follow that argument. It is a fact that the question has to be judged whether such an infringement is justified and proportional.

...

3.8. The above-mentioned is without prejudice to the fact that the District Court should judge about the question whether the infringement of Articles 7 and 8 of the Charter is carefully framed by provisions which safeguard that the infringement is really limited to what is strictly necessary. In this context, it should be noted that a limitation of the data that must be retained to the data of suspected citizens cannot be easily imagined in view of the aim of the Act, efficiently tracking down heavy crime. In the case of a first offender, no distinction can be made between suspected and non-suspected citizens in advance. The need to provide safeguards and guarantees as to the access of those data, however, is all the more important now that the infringement goes very far, so that high requirements should be met.

...

3.10  In addition, legislation should contain objective standards to limit the access of the competent national authorities to the data and their subsequent use in view of the prevention, tracking down and prosecuting infringements which may be considered sufficiently serous to justify the interference with the fundamental rights, laid down in Articles 7 and 8 of the Charter. The District Court holds that this is not the case in the Act. It is true that in the Act there are clear boundaries, because consultation of the data is limited to tracking down and prosecuting facts which are punishable with detention under remand or terrorist crimes, but this category also comprises punishable facts which are not sufficiently serious to justify this interference. The provisions of the Data Retention Directive were a reaction to the terrorist attacks in London and Madrid in 2004 and 2005.

Deciding body (original language): 
Rechtbank Den Haag, voorzieningenrechter
Language: 
Dutch