Information;Judgment — ECLI:EU:C:2022:896
Date: 2022-11-17
Language of the case: Bulgarian
Court formation: Sixth Chamber
Subject matter: Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Bulgaria

Summary C-350/21 – 1 
Case C-350/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
4 June 2021 
Referring court or tribunal:  
Spetsializiran nakazatelen sad (Bulgaria) 
Date of the decision to refer:  
3 June 2021 
Applicant:  
Spetsializirana prokuratura 
  
Subject matter of the main proceedings 
Compatibility with EU law of national legislation providing for the general and 
indiscriminate retention of all traffic data for a period of 6 months in order to fight 
serious crime 
Subject matter and legal basis of the request for a preliminary ruling 
The request has been made under Article 267, first paragraph, point (b) TFEU. 
Questions referred for a preliminary ruling 
Is national legislation (Article 251b(1) of the Zakon za elektronnite saobshtenia 
(Law on electronic communications)) providing for the general and indiscriminate 
retention of all traffic data (traffic data and location data of users of electronic 
means of communication) for a period of 6 months in order to fight serious crime 
compatible with Article 15(1) of Directive 2002/58, read in combination with 
Article 5(1) and recital 11 thereof, provided that the national legislation contains 
certain safeguards? 
Is national legislation (Article 159a of the Nakazatelno-protsesualen kodeks (Code 
of Criminal Procedure)) which does not limit access to traffic data to what is 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-350/21 
 
2  
strictly necessary and does not grant the persons whose traffic data are accessed 
by the law enforcement authorities the right to be notified thereof, provided that 
that does not impede criminal proceedings, or the right to a legal remedy against 
unlawful access compatible with Article 15(1) of Directive 2002/58, read in 
combination with Article 5(1) and recital 11 thereof? 
EU legislation and case-law relied on 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy in 
the electronic communications sector, OJ 2002 L 201, p. 37. 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation), OJ 2016 L 119, p. 1. 
Directive (EU) 2016/680 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data by competent authorities for the purposes of the prevention, 
investigation, detection or prosecution of criminal offences or the execution of 
criminal penalties, and on the free movement of such data, and repealing Council 
Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89). 
Judgment of the Court of 8 April 2014, Digital Rights Ireland and Seitlinger and 
Others, С-293/12 and C-594/12, EU:C:2014:238 (‘the judgment in Digital Rights 
Ireland and Others’) 
Judgment of the Court of 21 December 2016, Tele2 Sverige and Watson and 
Others, С-203/15 and С-698/15, EU:C:2016:970 (‘the judgment in Tele2’) 
Judgment of 2 October 2018, Ministerio Fiscal, C-207/16, EU:C:2018:788 (‘the 
judgment in Ministerio Fiscal’) 
Judgment of 6 October 2020, Privacy International, C-623/17, EU:C:2020:790 
(‘the judgment in Privacy International’) 
Judgment of 6 October 2020, La Quadrature du Net and Others, C-511/18, 
C-512/18 and C-520/18, EU:C:2020:791 (‘the judgment in La Quadrature du Net 
and Others’) 
Judgment of 2 March 2021, Prokuratuur (Conditions for access to electronic 
communications data), C-746/18, EU:C:2021:152 (‘the judgment in 
Prokuratuur’) 
SPETSIALIZIRANA PROKURATURA 
 
3 
Provisions of national law relied on 
Zakon za elektronnite saobshtenia (Law on electronic communications, ‘the ZES’) 
Nakazatelno protsesualen kodeks (Bulgarian Code of Criminal Procedure, ‘the 
NPK’) 
Succinct presentation of the facts and procedure in the main proceedings 
1 The Spetsializirana prokuratura (Specialised Public Prosecutor’s Office) has 
lodged a request with the referring court seeking access to the communications 
traffic data of five persons. The request concerns data that have already been 
retained for a period of 6 months. 
2 The Public Prosecutor’s Office claims that two of those persons (NG and RZ) are 
members of a criminal association set up to profit from marketing products subject 
to excise duty (cigars without tax labels). It claims that the third person (IG) acts 
as the contact between NG and other persons from whom NG obtains cigars 
without tax labels. It states that the fourth person (PP) is involved in this activity.  
The fifth person (SJ) obtains cigarettes without tax labels from NG, as agreed 
between them by telephone. 
3 It claims that these persons communicate exclusively via their mobile telephones. 
The Public Prosecutor's Office has provided the specific telephone numbers of the 
five suspects. 
4 It that the traffic data requested would be used in criminal proceedings for the 
purpose of the prevention, investigation and documentation of criminal offences. 
It therefore requests that the information referred to in Article 159a(1) to (6) of the 
NPK be made available. 
5 Having examined the evidence, the referring court finds that it can be assumed 
that the five persons were possibly involved in the criminal activity under 
investigation (distribution of cigarettes without tax labels through a criminal 
association), which is punishable under Article 321 of the Nakazatelen kodeks 
(Bulgarian Criminal Code, ‘the NK’), read in combination with Article 234 
thereof. That is a serious intentional offence. There is also evidence that the 
telephone numbers provided by the Public Prosecutor’s Office are being used by 
the persons concerned, possibly including in the commission of that activity. 
Authorisation to disclose traffic data has already been granted for some of those 
people and telephone numbers. 
6 A request for authorisation to access traffic data already retained for a period of 
6 months is admissible under national legislation. 
7 However, the question arises as to whether that national court judgment is 
compatible with EU law, which precludes the general and indiscriminate retention 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-350/21 
 
4  
of traffic data. It is precisely on the basis of such general and indiscriminate 
retention of traffic data, which is permissible under national legislation, that the 
request by the Public Prosecutor’s Office should be granted. Consequently, if it 
were to be found that the national legislation providing for such general and 
indiscriminate retention of traffic data infringes EU law, the referring court would 
have to dismiss the request. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
The first question 
8 The Court has found that Directive 2006/24 covers, in a generalised manner, all 
persons without any differentiation, limitation or exception; in particular, it is not 
necessary for persons to be suspects in order to retain their traffic data. 
Furthermore, it does not impose any limits in terms of a particular geographical 
zone, a particular time period or a circle of particular persons (judgment in Digital 
Rights Ireland and Others, paragraphs 57 to 59). That is described as a ‘general 
absence of limits’ (judgment in Digital Rights Ireland and Others, paragraph 60). 
Based on those aspects, the Directive has been declared to be invalid. 
9 The Court has held that national legislation providing for the general and 
indiscriminate retention of all the traffic data of all users, without the need to 
suspect that an offence has been committed, without taking account of any 
professional secrecy and without any limits, is precluded by EU law (judgment in 
Tele2, paragraphs 103, 105 and 106). 
10 The Court has held that any such legislation is precluded by EU law, as it provides 
for the retention of traffic data as the rule, whereas the Directive [2002/58] 
requires it to be the exception (judgment in Tele2, paragraphs 89 and 104). Traffic 
data may not be retained systematically and continuously, even in the context of 
fighting serious crime (judgment in La Quadrature du Net and Others, 
paragraph 142). 
11 The Court has also held that the national legislation must specify the 
circumstances and conditions under which a data retention measure may be 
adopted, thereby ensuring that such a measure is limited to what is strictly 
necessary (judgment in Tele2, paragraph 109). At paragraph 110 of the judgment 
in Tele2, the Court again requires that substantive conditions be adopted to limit 
the scope of retention as a preventive measure. Thus, it has reaffirmed that not all 
traffic data can be stored as a blanket measure. 
12 The Court permits the general retention of all traffic data in a particular 
geographical area only if it is to be assumed that there is a high risk of preparation 
for or commission of [serious] offences (judgments in Tele2, paragraph 111, and 
La Quadrature du Net and Others, paragraphs 144 and 150). 
SPETSIALIZIRANA PROKURATURA 
 
5 
13 The general retention of all traffic data is permitted if national security is 
threatened; however, that means that future retention may be ordered for a limited 
period where there is a genuine and present or foreseeable threat to national 
security (judgments in Privacy International, paragraphs 75 and 76, and La 
Quadrature du Net and Others, paragraphs 137 to 139). The Court has therefore 
not yet held that the general retention of all data provided for by law is compatible 
with EU law where it is carried out for an unlimited period with a view to future, 
undetermined, needs and in the absence of any evidence of a specific need from 
the outset. 
14 The national legislation on the retention of traffic data provided for in 
Article 251b(1) of the ZES applies generally and continuously to all 
telecommunications by all users anywhere in Bulgaria, the only restriction being 
that the data retention period is limited to 6 months. The Konstitutsionen sad 
(Constitutional Court) has expressly found that legislation to be compatible with 
the Constitution, having argued thus and then implicitly relied on its 
constitutionality. 
15 Thus the question arises as to whether the national legislation (Article 251b(1) of 
the ZES) is compatible with EU law. Although the Court has already stated that 
any such general retention of traffic data in the ‘general absence of limits’ is 
precluded by EU law, it has not yet had the opportunity to examine and assess 
whether the arguments put forward by the Constitutional Court should be upheld. 
Traffic data retention period 
16 The Court has held that Article 6 of Directive 2006/24 infringes EU law in that it 
provides for one data retention period (at least 6 months) for all types of data, 
without any distinction between them and without the need for the period of 
retention to be determined based on objective criteria that ensure that it is limited 
to what is strictly necessary (judgment in Digital Rights Ireland and Others, 
paragraphs 63 and 64). 
17 Similarly, the national legislation (Article 251b(1) of the ZES) provides for one 
retention period (6 months) for all types of traffic data. It is therefore doubtful 
whether that legislation is compatible with EU law. 
Use of retained data relating to serious crime 
18 The Court has found, with regard to the rule laid down by Directive 2006/24, that 
access to retained data is not limited based on objective criteria, as Directive 
2006/24 permits access in the case of serious crime as defined by national law 
(judgment in Digital Rights Ireland and Others, paragraph 60), and that the 
Directive does not limit access to ‘precisely defined serious offences’, that being a 
question left to the discretion of each Member State (judgment in Digital Rights 
Ireland and Others, paragraph 61). Consequently, the Directive was declared to be 
invalid. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-350/21 
 
6  
19 In contrast, the Court has held that it suffices if the traffic data retained are used in 
connection with serious crime, without the need to impose additional requirements 
as to their nature (judgment in Tele2, paragraphs 102, 110 and 115; see also, to 
that effect, the judgment in Ministerio Fiscal, paragraph 56). 
20 The national legislation permits access to retained traffic data in connection with 
any intentional serious offence, that is for any offence punishable by a custodial 
sentence of more than 5 years committed intentionally, whether with direct intent 
or recklessly (the occurrence of the harmful effects being sought or accepted). 
Does the existence of that criterion (intentional offence) suffice to assume that the 
need for ‘precisely defined serious offences’ referred to at paragraph 60 of the 
judgment in Digital Rights Ireland and Others is satisfied, or is that requirement 
obsolete in light of the more recent case-law of the Court? 
Enhanced protection in the event of retention of and access to traffic data 
21 Although, in certain respects, the national legislation does not satisfy the 
requirements of EU law on the retention and use of traffic data, it does satisfy 
those requirements nonetheless in other respects and even ensures a higher level 
of protection. Those are new facts that have not yet been addressed by the Court. 
Specifically, they concern the enhanced protection of retained traffic data, both as 
regards the 6-month retention period and as regards requests for access to them 
and the destruction of the data obtained. The question therefore arises as to 
whether national legislation as a whole, taking into account all the safeguards it 
contains, is nevertheless compatible with EU law and, consequently, whether the 
national legislation enacted in Article 251b(1) of the ZES complies with 
Article 15(1) of Directive 2002/58, read in combination with Article 5 thereof. 
22 The national legislation is similar to the Swedish legislation set out at 
paragraphs 15 to 19 of the judgment in Tele2 in terms of the nature and period of 
data retention. However, under Bulgarian legislation, access to those data is 
subject to judicial review, which is not provided for under the Swedish legislation; 
furthermore, contrary to the Swedish legislation, the Bulgarian legislation only 
provides for access in connection with serious offences. 
23 The Court has specified the conditions under which data retention is compatible 
with EU law: 
– Traffic data retention must be based on clear and precise rules governing the 
scope and application of the measure (judgment in Tele2, paragraph 109). The 
national legislation includes such rules. 
– Access to the retained data must be governed by clear and precise substantive 
and procedural conditions (judgment in Tele2, paragraphs 117 and 118). 
Article 159a of the NPK includes such conditions. 
– General access to all retained data is prohibited; access may be granted only to 
the data of certain persons suspected of committing an offence (judgments in 
SPETSIALIZIRANA PROKURATURA 
 
7 
Tele2, paragraph 119, and La Quadrature du Net and Others, paragraph 161). 
Article 159a of the NPK, as interpreted and applied by the national court, 
includes that requirement. 
– Access must be subject to prior judicial review carried out following a reasoned 
request from the law enforcement authorities (judgment in Tele2, 
paragraph 120). Provision is made for such prior judicial review. 
– Providers of electronic communications services must take appropriate 
technical and organisational measures in order to prevent any misuse of and 
unlawful access to the data (judgment in Tele2, paragraph 122). The ZES 
provides for such measures, which are further reinforced by the involvement of 
the Komisia za zashtita na lichni danni (Commission for the Protection of 
Personal Data) and the Komisia narodnoto sabirane (National Assembly 
Commission). 
24 This enhanced protection therefore offers the necessary safeguards, whereas 
Article 251b(1) of the ZES requires the general and indiscriminate retention of all 
traffic data for a period of 6 months. 
Question 2 
Limitation of access to traffic data to what is ‘strictly necessary’ 
25 The Court has held that access must be limited to what is ‘strictly necessary for 
the purpose of attaining the objective pursued’ and must be based on a reasoned 
request (judgment in Digital Rights Ireland and Others, paragraph 62). At 
paragraph 65 of that judgment, the Court again notes that access to traffic data 
entails ‘a wide-ranging and particularly serious interference with those 
fundamental rights in the legal order of the EU’ and must therefore be limited to 
‘what is strictly necessary’. 
26 It requires national legislation to lay down clear and precise rules governing 
access to personal data and traffic data (judgments in Privacy International, 
paragraph 68, and La Quadrature du Net and Others, paragraph 132). At 
paragraph 38 of the judgment in Prokuratuur, the parameters for what is 
considered ‘strictly necessary’ are stated, namely the category of data and the 
period of access, to be assessed on the basis of the specific circumstances of the 
case. At paragraph 68 of the judgment in Privacy International reference is made 
to the requirement of proportionality. 
27 The national legislation (Article 159а of the NPK) does not provide for the 
criterion of what is ‘strictly necessary for the purpose of attaining the objective 
pursued’. According to the case-law, there must be reasonable grounds to suspect 
that the persons whose traffic data have been requested have participated or are 
participating in the criminal activity under investigation, and the law requires the 
authorisation to disclose such traffic data to be sought for a reasonable period, 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-350/21 
 
8  
which may not exceed 6 months. The question therefore arises as to whether those 
requirements suffice to satisfy the ‘strictly necessary’ criterion. 
Effective remedies available to the persons concerned 
28 The Court has held that EU legislation must lay down clear and precise rules 
imposing minimum safeguards so that the persons concerned have effective 
protection against abuse and unlawful access (judgment in Digital Rights Ireland 
and Others, paragraph 54). Due to the absence of such provisions, Directive 
2006/24 was declared to be invalid. 
29 The Court has further held that national legislation must also establish minimum 
requirements, so that persons whose data have been retained have sufficient 
guarantees of effective protection against misuse (judgments in Tele2, 
paragraph 109, and Privacy International, paragraph 68). The retention of traffic 
data constitutes, in itself, interference with the rights enshrined in Articles 7 and 8 
of the Charter, regardless of whether or not it has inconvenienced the persons 
concerned and whether or not the data have been used (judgments in Privacy 
International, paragraph 70, and La Quadrature du Net and Others, 
paragraphs 115 and 116). 
30 Furthermore, the Court has also held that national legislation must provide for the 
persons concerned to be notified as soon as that notification is no longer liable to 
jeopardise the criminal proceedings, so that they can exercise their right to a legal 
remedy (judgment in Tele2, paragraph 121). 
31 Provision must also be made for a review of compliance with the level of 
protection guaranteed by EU law by an independent authority at national level in 
order to safeguard the right of the persons concerned to lodge with the national 
supervisory authorities a claim seeking the protection of their data (judgment in 
Tele2, paragraph 123). 
32 Although the national legislation enacts numerous rules designed to guarantee the 
security of the retained traffic data, it does not grant the persons concerned the 
right to be notified that disclosure of their traffic data retained for a period of 
6 months has been ordered or the right to challenge the judicial authorisation 
referred to in Article 159a(4) of the NPK. 
33 The question that arises is whether the requirement of effective protection against 
abuse and unlawful access imposed by the Court at paragraph 54 of the judgment 
in Digital Rights Ireland and Others also applies where the Court has granted 
authorisation, but only following a request by the Public Prosecutor’s Office, 
without any involvement on the part of the person concerned. Does authorisation 
granted by the Court in those circumstances provide a sufficient guarantee against 
abuse and unlawful access, meaning that the person concerned does not need to be 
informed of the disclosure of his or her traffic data and cannot challenge the 
authorisation granted as unlawful?