Source: http://lcbackerblog.blogspot.com/2014/04/digital-rights-ireland-ltd-c29312-v.html
Timestamp: 2016-12-05 20:40:38
Document Index: 631062046

Matched Legal Cases: ['§ 62', '§ 57', '§ 99', 'art 7', '§ 48', '§ 46', '§ 79', 'art 20']

Law at the End of the Day: Digital Rights Ireland Ltd (C‑293/12) v Minister for Communications, Marine and Natural Resources, et al., European Court of Justice Strikes Down EU Data Retention Directive of 2006
(Pix (c) Larry Catá Backer 2014) On April 8, 2014, the European Court of Justice, sitting as the Grand Chamber, delivered its decision in Digital
Rights Ireland Ltd (C‑293/12) v Minister for Communications, Marine and Natural Resources, Minister for Justice, Equality and Law Reform, Commissioner of the Garda Síochána, Ireland, The Attorney General. A European Union directive that required telecom operators to retain data for two years has been deemed “invalid”, Brussels’ highest court ruled today. The European Court of Justice (ECJ) declared the directive invalid, saying it “entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data.” . . . . The case arose after Digital Rights Ireland launched a court action against the State in 2006 that questioned the legality of Irish data-retention legislation requiring phone companies and internet service providers to gather data about customer locations, calls texts and emails, and store that information for up to two years. (Charlie Taylor, and Karlin Lillington,
EU data retention directive thrown out by European Court, Irish Times, Aptil 8, 2014).
The key conclusion of the decision was this:
"Consequently, the EU legislation in question must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards so that the persons whose data have been retained have sufficient guarantees to effectively protect their personal data against the risk of abuse and against any unlawful access and use of that data (see, by analogy, as regards Article 8 of the ECHR, Eur. Court H.R., Liberty and Others v. the United Kingdom, 1 July 2008, no. 58243/00, § 62 and 63; Rotaru v. Romania, § 57 to 59, and S. and Marper v. the United Kingdom, § 99)." Digital Rights, supra at ¶ 54.
This is likely to be an important decision not just within the European Union but also may affect those entities and states that deal with or through Europe on these matters, and especially the United States. The 2006 E.U. law of, drafted in the wake of terrorist attacks in London and Madrid, orders phone and Internet providers to store details of connections on their network in case needed for law enforcement authorities. They must keep the information for at least six months and delete it after two years. The judgment won’t lead to a blanket-ban on data storage, the European Union said in a statement. Instead, nations may need to scale back rules to take into account the court’s criticism, it said. (Aoife White, EU’s top court says data law tramples on privacy rights Financial Post, April 8, 2014)
But not just the United States. (See, e.g., Europe says no to data retention, so why is it an option in Australia?, The Conversation, April 13, 2014; "The decision comes at an important point in the data retention debate in Australia. We are currently in the midst of the second inquiry within three years from two successive Commonwealth governments."). More generally the judgment will have fundamental implications both throughout Europe and worldwide. The decision itself is effective throughout all 28 member states and will provide greater privacy protection for over half a billion EU citizens.
It will almost certainly be followed by more cases in other member states by national civil rights groups challenging local data retention laws. It also comes at a time when data protection law throughout Europe is under review and will help to establish high standards for any new law.
. . . . The judgment will be of central importance to other cases, pending against the UK government, challenging internet surveillance by the British intelligence service GCHQ. (TJ McIntyre, Opinion: Surveillance judgment is a victory for democracy, Irish Independent, April 2014).
This post includes the decision itself and a comment about the decision and its possible effects in India from Venkatesh Nayak, Programme Coordinator, Access to Information Programme, Commonwealth Human Rights Initiative in New Delhi
JUDGMENT OF THE COURT (Grand Chamber)8 April 2014 (* Languages of the case English and German)
Digital Rights Ireland Ltd (C‑293/12)vMinister for Communications, Marine and Natural Resources, Minister for Justice, Equality and Law Reform, Commissioner of the Garda Síochána, Ireland, The Attorney General, intervener: Irish Human Rights Commission, and Kärntner Landesregierung (C‑594/12), Michael Seitlinger, Christof Tschohl and others, THE COURT (Grand Chamber), composed of V. Skouris, President, K. Lenaerts, Vice-President, A. Tizzano, R. Silva de Lapuerta, T. von Danwitz (Rapporteur), E. Juhász, A. Borg Barthet, C.G. Fernlund and J.L. da Cruz Vilaça, Presidents of Chambers, A. Rosas, G. Arestis, J.-C. Bonichot, A. Arabadjiev, C. Toader and C. Vajda, Judges,
having regard to the written procedure and further to the hearing on 9 July 2013, after considering the observations submitted on behalf of:
– the Austrian Government, by G. Hesse and G. Kunnert, acting as Agents, – the Spanish Government, by N. Díaz Abad, acting as Agent,
– the Portuguese Government, by L. Inez Fernandes and C. Vieira Guerra, acting as Agents, – the United Kingdom Government, by L. Christie, acting as Agent, assisted by S. Lee, Barrister,
after hearing the Opinion of the Advocate General at the sitting on 12 December 2013, gives the following
2 The request made by the High Court (Case C‑293/12) concerns proceedings between (i) Digital Rights Ireland Ltd. (‘Digital Rights’) and (ii) the Minister for Communications, Marine and Natural Resources, the Minister for Justice, Equality and Law Reform, the Commissioner of the Garda Síochána, Ireland and the Attorney General, regarding the legality of national legislative and administrative measures concerning the retention of data relating to electronic communications. 3 The request made by the Verfassungsgerichtshof (Constitutional Court) (Case C‑594/12) concerns constitutional actions brought before that court by the Kärntner Landesregierung (Government of the Province of Carinthia) and by Mr Seitlinger, Mr Tschohl and 11 128 other applicants regarding the compatibility with the Federal Constitutional Law (Bundes-Verfassungsgesetz) of the law transposing Directive 2006/24 into Austrian national law.
4 The object of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), according to Article 1(1) thereof, is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with regard to the processing of personal data. 5 As regards the security of processing such data, Article 17(1) of that directive provides:
‘Member States shall provide that the controller must implement appropriate technical and organi[s]ational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.’ Directive 2002/58/EC
6 The aim of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11, ‘Directive 2002/58), according to Article 1(1) thereof, is to harmonise the provisions of the Member States required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and to confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the European Union. According to Article 1(2), the provisions of that directive particularise and complement Directive 95/46 for the purposes mentioned in Article 1(1). 7 As regards the security of data processing, Article 4 of Directive 2002/58 provides:
– ensure the implementation of a security policy with respect to the processing of personal data, Relevant national authorities shall be able to audit the measures taken by providers of publicly available electronic communication services and to issue recommendations about best practices concerning the level of security which those measures should achieve.
2. In case of a particular risk of a breach of the security of the network, the provider of a publicly available electronic communications service must inform the subscribers concerning such risk and, where the risk lies outside the scope of the measures to be taken by the service provider, of any possible remedies, including an indication of the likely costs involved.’ 8 As regards the confidentiality of the communications and of the traffic data, Article 5(1) and (3) of that directive provide:
(8) The Declaration on Combating Terrorism adopted by the European Council on 25 March 2004 instructed the Council to examine measures for establishing rules on the retention of communications traffic data by service providers. (9) Under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) [signed in Rome on 4 November 1950], everyone has the right to respect for his private life and his correspondence. Public authorities may interfere with the exercise of that right only in accordance with the law and where necessary in a democratic society, inter alia, in the interests of national security or public safety, for the prevention of disorder or crime, or for the protection of the rights and freedoms of others. Because retention of data has proved to be such a necessary and effective investigative tool for law enforcement in several Member States, and in particular concerning serious matters such as organised crime and terrorism, it is necessary to ensure that retained data are made available to law enforcement authorities for a certain period, subject to the conditions provided for in this Directive. …
(10) On 13 July 2005, the Council reaffirmed in its declaration condemning the terrorist attacks on London the need to adopt common measures on the retention of telecommunications data as soon as possible. (11) Given the importance of traffic and location data for the investigation, detection, and prosecution of criminal offences, as demonstrated by research and the practical experience of several Member States, there is a need to ensure at European level that data that are generated or processed, in the course of the supply of communications services, by providers of publicly available electronic communications services or of a public communications network are retained for a certain period, subject to the conditions provided for in this Directive.’
(d) “user ID” means a unique identifier allocated to persons when they subscribe to or register with an Internet access service or Internet communications service; (e) “cell ID” means the identity of the cell from which a mobile telephony call originated or in which it terminated;
17 On 11 August 2006, Digital Rights brought an action before the High Court in which it claimed that it owned a mobile phone which had been registered on 3 June 2006 and that it had used that mobile phone since that date. It challenged the legality of national legislative and administrative measures concerning the retention of data relating to electronic communications and asked the national court, in particular, to declare the invalidity of Directive 2006/24 and of Part 7 of the Criminal Justice (Terrorist Offences) Act 2005, which requires telephone communications service providers to retain traffic and location data relating to those providers for a period specified by law in order to prevent, detect, investigate and prosecute crime and safeguard the security of the State. 18 The High Court, considering that it was not able to resolve the questions raised relating to national law unless the validity of Directive 2006/24 had first been examined, decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling: ‘1. Is the restriction on the rights of the [p]laintiff in respect of its use of mobile telephony arising from the requirements of Articles 3, 4 … and 6 of Directive 2006/24/EC incompatible with [Article 5(4)] TEU in that it is disproportionate and unnecessary or inappropriate to achieve the legitimate aims of:
b) Ensuring the proper functioning of the internal market of the European Union?
3. To what extent do the Treaties — and specifically the principle of loyal cooperation laid down in [Article 4(3) TEU] — require a national court to inquire into, and assess, the compatibility of the national implementing measures for [Directive 2006/24] with the protections afforded by the [Charter], including Article 7 thereof (as informed by Article 8 of the ECHR)?’ Case C–594/12
19 The origin of the request for a preliminary ruling in Case C‑594/12 lies in several actions brought before the Verfassungsgerichtshof by the Kärntner Landesregierung and by Mr Seitlinger, Mr Tschohl and 11 128 other applicants, respectively, seeking the annulment of Paragraph 102a of the 2003 Law on telecommunications (Telekommunikationsgesetz 2003), which was inserted into that 2003 Law by the federal law amending it (Bundesgesetz, mit dem das Telekommunikationsgesetz 2003 — TKG 2003 geändert wird, BGBl I, 27/2011) for the purpose of transposing Directive 2006/24 into Austrian national law. They take the view, inter alia, that Article 102a of the Telekommunikationsgesetz 2003 infringes the fundamental right of individuals to the protection of their data. 20 The Verfassungsgerichtshof wonders, in particular, whether Directive 2006/24 is compatible with the Charter in so far as it allows the storing of many types of data in relation to an unlimited number of persons for a long time. The Verfassungsgerichtshof takes the view that the retention of data affects almost exclusively persons whose conduct in no way justifies the retention of data relating to them. Those persons are exposed to a greater risk that authorities will investigate the data relating to them, become acquainted with the content of those data, find out about their private lives and use those data for multiple purposes, having regard in particular to the unquantifiable number of persons having access to the data for a minimum period of six months. According to the referring court, there are doubts as to whether that directive is able to achieve the objectives which it pursues and as to the proportionality of the interference with the fundamental rights concerned. 21 In those circumstances the Verfassungsgerichtshof decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:
22 By decision of the President of the Court of 11 June 2013, Cases C‑293/12 and C‑594/12 were joined for the purposes of the oral procedure and the judgment. Consideration of the questions referred
23 By the second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12, which should be examined together, the referring courts are essentially asking the Court to examine the validity of Directive 2006/24 in the light of Articles 7, 8 and 11 of the Charter. The relevance of Articles 7, 8 and 11 of the Charter with regard to the question of the validity of Directive 2006/24
25 The obligation, under Article 3 of Directive 2006/24, on providers of publicly available electronic communications services or of public communications networks to retain the data listed in Article 5 of the directive for the purpose of making them accessible, if necessary, to the competent national authorities raises questions relating to respect for private life and communications under Article 7 of the Charter, the protection of personal data under Article 8 of the Charter and respect for freedom of expression under Article 11 of the Charter. 26 In that regard, it should be observed that the data which providers of publicly available electronic communications services or of public communications networks must retain, pursuant to Articles 3 and 5 of Directive 2006/24, include data necessary to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment, and to identify the location of mobile communication equipment, data which consist, inter alia, of the name and address of the subscriber or registered user, the calling telephone number, the number called and an IP address for Internet services. Those data make it possible, in particular, to know the identity of the person with whom a subscriber or registered user has communicated and by what means, and to identify the time of the communication as well as the place from which that communication took place. They also make it possible to know the frequency of the communications of the subscriber or registered user with certain persons during a given period. 27 Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them. 28 In such circumstances, even though, as is apparent from Article 1(2) and Article 5(2) of Directive 2006/24, the directive does not permit the retention of the content of the communication or of information consulted using an electronic communications network, it is not inconceivable that the retention of the data in question might have an effect on the use, by subscribers or registered users, of the means of communication covered by that directive and, consequently, on their exercise of the freedom of expression guaranteed by Article 11 of the Charter. 29 The retention of data for the purpose of possible access to them by the competent national authorities, as provided for by Directive 2006/24, directly and specifically affects private life and, consequently, the rights guaranteed by Article 7 of the Charter. Furthermore, such a retention of data also falls under Article 8 of the Charter because it constitutes the processing of personal data within the meaning of that article and, therefore, necessarily has to satisfy the data protection requirements arising from that article (Cases C‑92/09 and C‑93/09 Volker und Markus Schecke and Eifert EU:C:2010:662, paragraph 47).
30 Whereas the references for a preliminary ruling in the present cases raise, in particular, the question of principle as to whether or not, in the light of Article 7 of the Charter, the data of subscribers and registered users may be retained, they also concern the question of principle as to whether Directive 2006/24 meets the requirements for the protection of personal data arising from Article 8 of the Charter. 31 In the light of the foregoing considerations, it is appropriate, for the purposes of answering the second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12, to examine the validity of the directive in the light of Articles 7 and 8 of the Charter.
32 By requiring the retention of the data listed in Article 5(1) of Directive 2006/24 and by allowing the competent national authorities to access those data, Directive 2006/24, as the Advocate General has pointed out, in particular, in paragraphs 39 and 40 of his Opinion, derogates from the system of protection of the right to privacy established by Directives 95/46 and 2002/58 with regard to the processing of personal data in the electronic communications sector, directives which provided for the confidentiality of communications and of traffic data as well as the obligation to erase or make those data anonymous where they are no longer needed for the purpose of the transmission of a communication, unless they are necessary for billing purposes and only for as long as so necessary. 33 To establish the existence of an interference with the fundamental right to privacy, it does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced in any way (see, to that effect, Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 75). 34 As a result, the obligation imposed by Articles 3 and 6 of Directive 2006/24 on providers of publicly available electronic communications services or of public communications networks to retain, for a certain period, data relating to a person’s private life and to his communications, such as those referred to in Article 5 of the directive, constitutes in itself an interference with the rights guaranteed by Article 7 of the Charter. 35 Furthermore, the access of the competent national authorities to the data constitutes a further interference with that fundamental right (see, as regards Article 8 of the ECHR, Eur. Court H.R., Leander v. Sweden, 26 March 1987, § 48, Series A no 116; Rotaru v. Romania [GC], no. 28341/95, § 46, ECHR 2000-V; and Weber and Saravia v. Germany (dec.), no. 54934/00, § 79, ECHR 2006-XI). Accordingly, Articles 4 and 8 of Directive 2006/24 laying down rules relating to the access of the competent national authorities to the data also constitute an interference with the rights guaranteed by Article 7 of the Charter. 36 Likewise, Directive 2006/24 constitutes an interference with the fundamental right to the protection of personal data guaranteed by Article 8 of the Charter because it provides for the processing of personal data.
37 It must be stated that the interference caused by Directive 2006/24 with the fundamental rights laid down in Articles 7 and 8 of the Charter is, as the Advocate General has also pointed out, in particular, in paragraphs 77 and 80 of his Opinion, wide-ranging, and it must be considered to be particularly serious. Furthermore, as the Advocate General has pointed out in paragraphs 52 and 72 of his Opinion, the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance. Justification of the interference with the rights guaranteed by Articles 7 and 8 of the Charter
38 Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. 39 So far as concerns the essence of the fundamental right to privacy and the other rights laid down in Article 7 of the Charter, it must be held that, even though the retention of data required by Directive 2006/24 constitutes a particularly serious interference with those rights, it is not such as to adversely affect the essence of those rights given that, as follows from Article 1(2) of the directive, the directive does not permit the acquisition of knowledge of the content of the electronic communications as such.
42 It is apparent from the case-law of the Court that the fight against international terrorism in order to maintain international peace and security constitutes an objective of general interest (see, to that effect, Cases C‑402/05 P and C‑415/05 P Kadi and Al Barakaat International Foundation v Council and Commission EU:C:2008:461, paragraph 363, and Cases C‑539/10 P and C‑550/10 P Al-Aqsa v Council EU:C:2012:711, paragraph 130). The same is true of the fight against serious crime in order to ensure public security (see, to that effect, Case C‑145/09 Tsakouridis EU:C:2010:708, paragraphs 46 and 47). Furthermore, it should be noted, in this respect, that Article 6 of the Charter lays down the right of any person not only to liberty, but also to security. 43 In this respect, it is apparent from recital 7 in the preamble to Directive 2006/24 that, because of the significant growth in the possibilities afforded by electronic communications, the Justice and Home Affairs Council of 19 December 2002 concluded that data relating to the use of electronic communications are particularly important and therefore a valuable tool in the prevention of offences and the fight against crime, in particular organised crime. 44 It must therefore be held that the retention of data for the purpose of allowing the competent national authorities to have possible access to those data, as required by Directive 2006/24, genuinely satisfies an objective of general interest.
49 As regards the question of whether the retention of data is appropriate for attaining the objective pursued by Directive 2006/24, it must be held that, having regard to the growing importance of means of electronic communication, data which must be retained pursuant to that directive allow the national authorities which are competent for criminal prosecutions to have additional opportunities to shed light on serious crime and, in this respect, they are therefore a valuable tool for criminal investigations. Consequently, the retention of such data may be considered to be appropriate for attaining the objective pursued by that directive. 50 That assessment cannot be called into question by the fact relied upon in particular by Mr Tschohl and Mr Seitlinger and by the Portuguese Government in their written observations submitted to the Court that there are several methods of electronic communication which do not fall within the scope of Directive 2006/24 or which allow anonymous communication. Whilst, admittedly, that fact is such as to limit the ability of the data retention measure to attain the objective pursued, it is not, however, such as to make that measure inappropriate, as the Advocate General has pointed out in paragraph 137 of his Opinion. 51 As regards the necessity for the retention of data required by Directive 2006/24, it must be held that the fight against serious crime, in particular against organised crime and terrorism, is indeed of the utmost importance in order to ensure public security and its effectiveness may depend to a great extent on the use of modern investigation techniques. However, such an objective of general interest, however fundamental it may be, does not, in itself, justify a retention measure such as that established by Directive 2006/24 being considered to be necessary for the purpose of that fight.
56 As for the question of whether the interference caused by Directive 2006/24 is limited to what is strictly necessary, it should be observed that, in accordance with Article 3 read in conjunction with Article 5(1) of that directive, the directive requires the retention of all traffic data concerning fixed telephony, mobile telephony, Internet access, Internet e-mail and Internet telephony. It therefore applies to all means of electronic communication, the use of which is very widespread and of growing importance in people’s everyday lives. Furthermore, in accordance with Article 3 of Directive 2006/24, the directive covers all subscribers and registered users. It therefore entails an interference with the fundamental rights of practically the entire European population. 57 In this respect, it must be noted, first, that Directive 2006/24 covers, in a generalised manner, all persons and all means of electronic communication as well as all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime. 58 Directive 2006/24 affects, in a comprehensive manner, all persons using electronic communications services, but without the persons whose data are retained being, even indirectly, in a situation which is liable to give rise to criminal prosecutions. It therefore applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. Furthermore, it does not provide for any exception, with the result that it applies even to persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy. 59 Moreover, whilst seeking to contribute to the fight against serious crime, Directive 2006/24 does not require any relationship between the data whose retention is provided for and a threat to public security and, in particular, it is not restricted to a retention in relation (i) to data pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime, or (ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offences. 60 Secondly, not only is there a general absence of limits in Directive 2006/24 but Directive 2006/24 also fails to lay down any objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference. On the contrary, Directive 2006/24 simply refers, in Article 1(1), in a general manner to serious crime, as defined by each Member State in its national law.
62 In particular, Directive 2006/24 does not lay down any objective criterion by which the number of persons authorised to access and subsequently use the data retained is limited to what is strictly necessary in the light of the objective pursued. Above all, the access by the competent national authorities to the data retained is not made dependent on a prior review carried out by a court or by an independent administrative body whose decision seeks to limit access to the data and their use to what is strictly necessary for the purpose of attaining the objective pursued and which intervenes following a reasoned request of those authorities submitted within the framework of procedures of prevention, detection or criminal prosecutions. Nor does it lay down a specific obligation on Member States designed to establish such limits. 63 Thirdly, so far as concerns the data retention period, Article 6 of Directive 2006/24 requires that those data be retained for a period of at least six months, without any distinction being made between the categories of data set out in Article 5 of that directive on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned.
71 Consequently, the answer to the second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12 is that Directive 2006/24 is invalid. The first question and the second question, parts (a) and (e), and the third question in Case C‑293/12 and the second question in Case C‑594/12
Programme Coordinator Access to Information Programme
New Delhi- 110 017 Website: www.humanrightsinitiative.org
In the matter of Digital Rights, Ireland Ltd. vs Minister for Communications etc. the European Court has struck down a 2006 Directive of the European Union that required service providers of telephony and Internet access in the EU member States to retain user data for a period between six months to two years so that national authorities may access them for law enforcement purposes (EU Directive is in the 1st attachment). The European Court observed that the kinds of data that were required to be retained under the Directive would help establish the identity of the user of the telephony or Internet services, the time and place from which communication took place. Combined together, these categories of information constitute very personal information about the private lives of the users such as their daily habits, permanent or temporary places of residence, daily movements or activities carried out, their social relationships and the social environments they frequent (for example, on the Internet). The Court ruled that the EU Directive unreasonably and disproportionately interfered with people's right to privacy and personal data protection (jjt in the 2nd attachment). The Court was critical of the general manner in which the EU Directive called for retention of all kinds of personal data. It did not contain objective criteria for ensuring that law enforcement authorities access to such data for the purpose of prevention, protection or prosecution of criminal offences (summary in the press note in 3rd attachment). This ruling shows how strict the regimes for protecting personal data access must be for law enforcement agencies to get hold of it. In India the Information Technology (Guidelines for Cybercafe), Rules 2011 (4th attachment) require owners of cybercafes to retain identity proof of web surfers along with a history of their surfing of sites for a period of one year (4th attachment). Readers who are experts in the subject may educate us on the retention period for mobile phone call data and home and office internet use data under the Information Technology Act. Last year when the national media reported how the National Security Agency (NSA) of USA had accessed meta data about mobile phone and internet usage of Indians after the Snowden disclosures I filed an RTI application with Telecom Regulatory Authority of India (TRAI) asking details of how the NSA had accessed this information. The media story may be accessed at: http://www.thehindu.com/news/national/india-among-top-targets-of-spying-by-nsa/article5157526.ece TRAI is the regulatory body over all telecom companies in the public and private sector in India and is mandated to protect the interests of subscribers. I subscribe to the mobile services of a private company and use the Internet datacard of another private company. TRAI transferred my RTI application to the Department of Telecommunications saying, they had given licenses to the mobile telephone companies, so they should handle my request for information. The Dept. of Telecom denied holding any information about the transfer of mobile telephone users meta data to NSA (RTI application and replies are in the 5th attachment). As the Dept. claimed that the information was not available, I did not file any appeals, But I was perplexed about how the NSA had obtained meta data of phone and Internet users without any paperwork being generated and the Government of India not coming to know of it. O course the Minister for External Affairs initially dismissed it as common practice for intelligence agencies to obtain such data in the course of their work but the GOvernemnt weakly expressed its concern over the Snowden leaks. This matter did not become a huge issue in India. No wonder we do not have a synonym for 'privacy' in most Indian languages that captures the fullest meaning of that English term. Huge quantities of information seem to have been ferreted out of the country without any paperwork - an excellent example of paper-less environmental friendly government process. I request readers top advise me on where else to look for this information. It is unbelievable that there is no paper trail of how the NSA accessed information about mobile and Internet users in India. Kindly circulate this email widely.
4/13/2014 05:41:00 PM
Joel Slawotsky on "Corporate Liability Under The A...
UN High Commissioner for Human Rights: Bulletin on...
Posted Video Recording of Conference "China-Consti...
"Cuba's Perplexing Change"--Call for Papers, 24th ...
Part 20A UPDATE Norway SWFs (Pension Fund Global, ...
Harvard Human Rights Journal Symposium 2014: The F...
Paper Posted: "The Crisis of Secular Liberalism an...
The U.N. Human Rights Commission Issues its "OHCHR...
Digital Rights Ireland Ltd (C‑293/12) v Minister...
Considering Zhiwei Tong's Essay, "Two Issues on Co...
Shaoming Zhu, "Introduction to China (Shanghai) Pi...
The Congressional-Executive Commission on China an...
Conference Announcement: "China-Constitution-Poli...