Cyprus / Supreme Court / Joint cases 216/14 and 36/2015

Key facts of the case:

In October 2010 the police secured from the district court of Paphos orders to access the telephone data of the applicant, in the process of investigating criminal charges against him concerning the dispatch of threatening messages through SMS. The charges against the applicant concerned conspiracy for committing misdemeanours, consisting of the dispatch of written messages sent through telephone which contained death threats, the dispatch of insulting/indecent messages and interference with the judicial process. The applicant had previously secured from the district court a permit to file for certiorari orders in order to cancel the court orders secured by the police for accessing his telephone data; this case involved the examination of these orders by the Supreme Court. The applicant argued that the court orders which the police had secured from the lower court were in breach of articles 7 and 8 of the Charter, which safeguard the right to private life and data protection in light of the principle of proportionality, compliance with which is foreseen under article Charter article 52(1). The applicant also invoked article 15 of the Cypriot Constitution and article 8 of the ECHR and the invalidation of the Data Retention Directive by the CJEU in the Digital Rights Ireland case.

Outcome of the case:

The Court looked into whether the national data retention law which had transposed the Data Retention Directive had been invalidated by the Digital Rights Ireland case or whether its ambit extended beyond the Data Retention Directive, which would have meant that the validity of the law was intact. It concluded that although the national data retention law states in its preamble that it purports to transpose the Data Retention Directive, the ambit of this law is wider than that of the directive as it seeks to regulate access to data in addition to the duty to retain data. The court relied on judicial precedent which had also found that the national data retention law was not rendered invalid by the Digital Rights Ireland case.

The Court rejected both certiorari applications filed by the claimant on the ground that the scope of the Charter, which is set out in article 51(1), provides that the Charter provisions apply only with regard to Union law and that national legislation which is not based on Union law cannot be assessed on the basis of the Charter. The Court concluded that the national legal framework adequately specifies the purpose and conditions for interfering with the right to communication in a manner that does not lead to infringement of article 8 of the ECHR or of any other rights protected by the Constitution nor does it violate the proportionality principle. In any case, even if the Charter had been found to be applicable, national law does not conflict with the Charter because all prerequisites for the protection of the fundamental rights of private life and communication are included in the legislation.

With regard to the validity of the law following the invalidation of the Data Retention Directive by the CJEU ruling in the Digital Rights Ireland case, the English Court concluded that the ratio of that case is that legislation establishing a general data retention regime infringes Articles 7 and 8 of the EU Charter unless it is accompanied by an access regime at the national level which provides adequate safeguards for those rights. The Court concluded that the national law does provide such safeguards and is therefore compliant.