Opinion of the Advocate General — ECLI:EU:C:2021:942
Date: 2021-11-18
Language of the case: English
Subject matter: Telecommunications;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Ireland

summary, I suggest that Questions 1, 2 and 4 referred by the Supreme Court should be answered in the same terms as the ruling given by the Court in La Quadrature du Net. C. Access to retained data (Question 3) 57. The referring court asks what criteria it should take into account in order to determine whether the national rules on access to retained data provide for the prior scrutiny required by the case-law of the Court, or whether an ex post judicial or independent scrutiny would suffice. 58. The judgment in Prokuratuur also responded to that question. In order to ensure compliance with the conditions to be satisfied by legislation governing access to retained data, (33) ‘it is essential that access of the competent national authorities to retained data be subject to a prior review carried out either by a court or by an independent administrative body, and that the decision of that court or body be made following a reasoned request by those authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime’. (34) 59. The Court held that ‘one of the requirements for that prior review is that the court or body entrusted with carrying it out must have all the powers and provide all the guarantees necessary in order to reconcile the various interests and rights at issue. As regards a criminal investigation in particular, it is a requirement of such a review that that court or body must be able to strike a fair balance between, on the one hand, the interests relating to the needs of the investigation in the context of combating crime and, on the other, the fundamental rights to privacy and protection of personal data of the persons whose data are concerned by the access’. (35) 60. If the prior review is entrusted to an independent authority, that authority ‘must have a status enabling it to act objectively and impartially when carrying out its duties and must, for that purpose, be free from any external influence’. (36) 61. Specifically, ‘the requirement of independence that has to be satisfied by the authority entrusted with carrying out the prior review … means that that authority must be a third party in relation to the authority which requests access to the data, in order that the former is able to carry out the review objectively and impartially and free from any external influence. In particular, in the criminal field, … the requirement of independence entails that the authority entrusted with the prior review, first, must not be involved in the conduct of the criminal investigation in question and, second, has a neutral stance vis-à-vis the parties to the criminal proceedings’. (37) 62. According to the description of the Irish provisions provided by the referring court, access to retained data does not appear to be subject to prior review by a court or an independent authority and is instead at the discretion of a Garda officer of a certain rank, who decides whether or not to submit the request to the service providers. 63. It is for the referring court to examine whether the officer to whom the national legislation entrusts the prior review of access to retained traffic and location data has the status of an ‘independent authority’ and the nature of a ‘third party’, as required by the case-law of the Court of Justice. 64. In conducting that examination, the competent court must bear in mind that, in the judgment in Prokuratuur, it was held that a public prosecutor’s office of a Member State does not have the attributes of independence or of a ‘third party’ where it also carries out investigative functions in criminal proceedings. 65. As regards the possibility of conducting the review mentioned by the referring court ex post, the judgment in Prokuratuur also provides the (negative) answer: – ‘the lack of a review by an independent authority may [not] be made up for by a subsequent review carried out by a court as to whether a national authority’s access to traffic and location data was lawful’; – ‘the independent review must take place before any access, except in the event of duly justified urgency, in which case the review must take place within a short time’. (38) D. The possibility of limiting in time the effects of a declaration of incompatibility of the national provision with EU law (Questions 5 and 6) 66. Lastly, the Supreme Court asks whether: – it is entitled to limit the temporal effect of a declaration of incompatibility of the national provision with Article 15 of Directive 2002/58, where failure to do so would result in ‘chaos and damage to the public interest’; – it may, having been invited to disapply the national provision enacted to transpose the provisions of a directive, refuse to do so or limit its declaration to the period after the judgment of the Court of Justice of 8 April 2014, (39) which declared that Directive 2006/24 was invalid. 67. The answers to those questions are, once again, found in the judgment in La Quadrature du Net, which followed the traditional case-law in that respect. 68. In Case C‑520/18, the Cour Constitutionnelle (Constitutional Court, Belgium) referred to the Court of Justice a question similar to that referred by the Irish Supreme Court in this reference for preliminary ruling. (40) 69. In responding to that question in the judgment in La Quadrature du Net, the Court, after recalling the requirements flowing from the principle of the primacy of EU law (paragraphs 214 and 215), reproduced its statement of the law regarding the limitation of the effects of its judgments: ‘Only the Court may, in exceptional cases, on the basis of overriding considerations of legal certainty, allow the temporary suspension of the ousting effect of a rule of EU law with respect to national law that is contrary thereto. Such a restriction on the temporal effects of the interpretation of that [EU] law, made by the Court, may be granted only in the actual judgment ruling upon the interpretation requested’. (41) 70. Immediately afterwards, the Court stated that, ‘unlike a breach of a procedural obligation such as the prior assessment of the impact of a project in the specific field of environmental protection, a failure to comply with Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, cannot be remedied by a procedure comparable to the procedure referred to in the preceding paragraph. Maintaining the effects of national legislation such as that at issue in the main proceedings would mean that the legislation would continue to impose on providers of electronic communications services obligations which are contrary to EU law and which seriously interfere with the fundamental rights of the persons whose data has been retained.’ (42) 71. On that basis, the Court concluded that ‘the referring court cannot apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which it is bound to make under that law in respect of the national legislation at issue in the main proceedings’. (43) 72. Those considerations are fully applicable to Questions 5 and 6 referred by the Supreme Court. 73. First, it is immaterial that the national legislation at issue was enacted for the purpose of transposing Directive 2006/24 into national law. What matters in that regard is that the national provision complies in terms of its content with EU law as a whole, which is not the case here. 74. Where the Court has declared a directive to be invalid on the grounds that it is incompatible with substantive provisions of the Treaties, that incompatibility with primary EU law also applies to national provisions which merely give effect to that directive. 75. The referring court states that the 2011 Act was enacted to comply with Article 288 TFEU, by transposing Directive 2006/24 into Irish law. Nobody disputes that this is the case but, as I have just observed, what is relevant here is that that directive was invalid from the outset (this was the finding in the Digital Rights judgment), since it amounted to disproportionate interference with the rights recognised by Articles 7 and 8 of the Charter, and that the retention of traffic and location data must be governed by Directive 2002/58, as interpreted by the Court of Justice. 76. Second, it is well known that preliminary rulings on interpretation given by the Court of Justice produce effects from the time when the provision of EU law interpreted came into force. (44) 77. While the temporal limitation of the effects of the interpretation of EU law given by the Court of Justice can be allowed only in the judgment ruling on the interpretation sought, it should be recalled that that did not occur in the Digital Rights judgment, which the referring court cites. 78. Nor did it occur in: – the judgment in Tele2 Sverige, given on 21 December 2016, which interpreted Directive 2002/58, declaring that it precluded national legislation which, for the purpose of fighting serious crime, provides for general and indiscriminate retention of traffic and location data; – the judgment in La Quadrature du Net, which, on 6 October 2020, again confirmed the interpretation of Directive 2002/58, in the manner described above. 79. Third, this reference does not address the difficulties linked to the exclusion of evidence in criminal proceedings brought against an individual who was convicted of murder. Rather, this case concerns civil proceedings (as the Supreme Court describes them) which have to be resolved by an objective comparison of national law with EU law. 80. This is emphasised by the national court: ‘In the appeal currently before this Court [the Supreme Court], the only issue is whether the High Court was correct in determining that s. 6(1)(a) of the [2011 Act] is inconsistent with EU law’. (45) 81. The reply to the ‘only issue’ is that Section 6(1)(a) of the 2011 Act does not comply with EU law and that there are no reasons to delay the effects of the judgment which must make that finding. V. Conclusion 82. In the light of the foregoing considerations, I suggest that the Court of Justice reply as follows to the Supreme Court (Ireland): 1. Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8, 11 and 52(1) of the Charter of Fundamental Rights of the European Union and Article 4(2) TEU, is to be interpreted as meaning that it precludes national legislation which: – requires providers of publicly available electronic communications services to retain, on a preventive, general and indiscriminate basis, the traffic and location data of end users of those services for purposes other than the safeguarding of national security against a threat which is shown to be genuine and present or foreseeable; – does not make access by the competent authorities to retained traffic and location data subject to a prior review carried out either by a court or by an independent administrative body. 2. A national court may not limit in time the effects of a declaration of illegality of domestic legislation which imposes on suppliers of electronic communications services, with a view to, inter alia, safeguarding national security and combating crime, an obligation requiring the general and indiscriminate retention of traffic and location data that is incompatible with Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8, 11 and 52(1) of the Charter of Fundamental Rights. 1 Original language: Spanish. 2 ‘Opinion in SpaceNet and Telekom Deutschland’. 3 (EU:C:2020:6). 4 ‘Opinion in Ordre des barreaux francophones et germanophone’ (C‑520/18, EU:C:2020:7). 5 Cases C‑293/12 and C‑594/12, EU:C:2014/238; ‘the Digital Rights judgment’. 6 Directive of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ 2006 L 105, p. 54). 7 Cases C‑203/15 and C‑698/15, EU:C:2016:970; ‘judgment in Tele2 Sverige’. 8 Directive of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11). 9 Case C‑207/16, (EU:C:2018:788). 10 C‑623/17, EU:C:2020:790. 11 C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791; ‘judgment in La Quadrature du Net’. 12 Point 25 et seq. of this Opinion. 13 Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). 14 See point 80 of this Opinion. 15 Point 25 et seq. of this Opinion. 16 Case C‑746/18, EU:C:2021:152; ‘judgment in Prokuratuur’. That judgment was discussed at the hearing. 17 Those were the words used by the Supreme Court in the letter received by the Registry on 27 October 2020, in reply to the Court of Justice’s formal letter asking it to state whether it was continuing with the request for a preliminary ruling following the judgment in La Quadrature du Net. 18 In the absence of another explanation, those ‘situations’ must be taken to be those relating to the facts adjudicated on and the applicable national provisions. 19 The Bundesverwaltungsgericht (Federal Administrative Court, Germany) explained the differences between German national law and the national law examined in the judgment in La Quadrature du Net and asked the Court of Justice to give a ruling in the light of those differences. 20 Points 33 to 41 below reproduce the corresponding points of that Opinion. 21 Judgment in La Quadrature du Net, paragraph 109. 22 Ibid., paragraphs 111 to 133. 23 Ibid., paragraph 136. 24 Ibid., paragraph 137 (italics added). The Court goes on to state that that is the case ‘even if such a measure is applied indiscriminately to all users of electronic communications systems, without there being at first sight any connection … with a threat to the national security of that Member State’, in which case it must ‘be considered that the existence of that threat is, in itself, capable of establishing that connection’ (loc. ult. cit.). 25 CE:ECHR:2021:0525JUD005817013. 26 CE:ECHR:2021:0525JUD003525208. 27 CE:ECHR:2015:1204JUD004714306. 28 Judgment in La Quadrature du Net, paragraph 147: ‘Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data for the purposes of combating serious crime, preventing serious threats to public security and equally of safeguarding national security, provided that such retention is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary’. Italics added. 29 Opinion in Ordre des barreaux francophones et germanophone (C‑520/18, EU:C:2020:7, point 101). 30 Judgment in La Quadrature du Net, paragraph 112 and the case-law cited. 31 Supported by many of the governments which entered an appearance. 32 Paragraph 135 of the judgment in La Quadrature du Net. 33 Legislation which ‘must be based on objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data in question. In that regard, such access can, as a general rule, be granted, in relation to the objective of fighting crime, only to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime. However, in particular situations, where for example vital national security, defence or public security interests are threatened by terrorist activities, access to the data of other persons might also be granted where there is objective evidence from which it can be deduced that that data might, in a specific case, make an effective contribution to combating such activities’. Judgment in Prokuratuur, paragraph 50. 34 Judgment in Prokuratuur, paragraph 51, italics added. That paragraph states that, in line with the judgment in La Quadrature du Net, paragraph 189, ‘in cases of duly justified urgency, the review must take place within a short time’. 35 Ibid., paragraph 52. 36 Ibid., paragraph 53. 37 Ibid., paragraph 54. 38 Ibid., paragraph 58. 39 The Digital Rights judgment. 40 Paragraph 213 of the judgment in La Quadrature du Net summarises the wording of the third question referred for a preliminary ruling in Case C‑520/18 as follows: ‘the referring court seeks, in essence, to ascertain whether a national court may apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which it is bound to make under that law in respect of national legislation imposing on providers of electronic communications services – with a view to, inter alia, pursuing the objectives of safeguarding national security and combating crime – an obligation requiring the general and indiscriminate retention of traffic and location data, owing to the fact that that legislation is incompatible with Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter.’ Italics added. 41 Judgment in La Quadrature du Net, paragraph 216. 42 Ibid., paragraph 217. 43 Ibid., paragraph 220. 44 According to settled case-law, the interpretation which the Court gives to a rule of EU law, in the exercise of the jurisdiction conferred upon it by Article 267 TFEU, clarifies and defines the meaning and scope of that rule as it must be, or ought to have been, understood and applied from the time of its coming into force. It follows that the rule as thus interpreted may and must be applied by the courts to legal relationships arising and established before the judgment ruling on the request for interpretation, provided that in other respects the conditions for bringing before the courts having jurisdiction an action relating to the application of that rule are satisfied (judgments of 3 October 2019, Schuch-Ghannadan, C‑274/18, EU:C:2019:828, paragraph 60, and of 16 September 2020, Romenergo and Aris Capital, C‑339/19, EU:C:2020:709, paragraph 47). 45 Order for reference, paragraph 6 of Appendix II, in fine.