# Digital Rights Ireland Ltd v Minister for Communications - Type: Case Law - Source: CJEU - Identifier: C-293/12 - Date: 2014-04-08 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0293&ref=51474 - Canonical: https://overview.legal/posts/51474 - Topics: Right to Object, Personal Data, Right of Access, Consent, Controllers, Criminal Data, Telecommunications, Processors, Security, Special Categories of Data ## Summary Invalidated Data Retention Directive as incompatible with fundamental rights. ## Sections (39) ### ¶900 KB. Apply EUR-Lex Access to European Union law This document is an excerpt from the EUR-Lex website You are here EUROPA EUR-Lex home EUR-Lex - 62012CJ0293 - EN Help Print Menu EU law Treaties Treaties currently in force Founding Treaties Accession Treaties Other treaties and protocols Chronological overview Legal acts Consolidated texts International agreements Preparatory documents EFTA documents Lawmaking procedures Summaries of EU legislation Browse by EU institutions European Parliament European Council Council of the European Union European Commission Court of Justice of the European Union European Central Bank European Court of Auditors European Economic and Social Committee European Committee of the Regions Browse by EuroVoc EU case-law Case-law Reports of cases Directory of case-law Official Journal Access to the Official Journal Official Journal L series daily view Official Journal C series daily view Browse the Official Journal Legally binding printed editions Special edition National law and case-law National transposition National case-law JURE case-law Information Themes in focus EUR-Lex developments Statistics ELI register What is ELI ELI background Why implement ELI Countries implementing ELI Testimonials Implementing ELI Glossary EU budget online Quick search Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care). Search tips Need more search options? Use the Advanced search Document 62012CJ0293 Help Print Text Document information Summary / Keywords Case file Permanent link Download notice Save to My items Create an email alert Create an RSS alert ​ Judgment of the Court (Grand Chamber), > Topics: Statistics ### ¶267 TFEU from the High Court (Ireland) and the Verfassungsgerichtshof (Austria), made by decisions of ### ¶95 EC. ### ¶12 Recital 4 in the preamble to Directive 2006/24 states: ‘Article 15(1) of Directive 2002/58/EC sets out the conditions under which Member States may restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of that Directive. Any such restrictions must be necessary, appropriate and proportionate within a democratic society for specific public order purposes, i.e. to safeguard national security (i.e. State security), defence, public security or the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communications systems.’ > Topics: Telecommunications · Applies: gdpr-art-8-par-1-en, gdpr-art-15-par-1-en, gdpr-art-5-en, gdpr-art-6-en, gdpr-art-9-en ### ¶14 Recitals 7 to 11 in the preamble to Directive 2006/24 read as follows: ‘(7) The Conclusions of the Justice and Home Affairs Council of ### ¶15 Recitals 16, 21 and 22 in the preamble to Directive 2006/24 state: ‘(16) The obligations incumbent on service providers concerning measures to ensure data quality, which derive from Article 6 of Directive 95/46/EC, and their obligations concerning measures to ensure confidentiality and security of processing of data, which derive from Articles 16 and 17 of that Directive, apply in full to data being retained within the meaning of this Directive. (21) Since the objectives of this Directive, namely to harmonise the obligations on providers to retain certain data and to ensure that those data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law, cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale and effects of this Directive, be better achieved at Community level, the Community may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives. (22) This Directive respects the fundamental rights and observes the principles recognised, in particular, by the Charter of Fundamental Rights of the European Union. In particular, this Directive, together with Directive 2002/58/EC, seeks to ensure full compliance with citizens' fundamental rights to respect for private life and communications and to the protection of their personal data, as enshrined in Articles 7 and 8 of the Charter.’ > Topics: Personal Data · Applies: gdpr-art-5-en, gdpr-art-6-en ### ¶16 Directive 2006/24 lays down the obligation on the providers of publicly available electronic communications services or of public communications networks to retain certain data which are generated or processed by them. In that context, Articles 1 to 9, 11 and 13 of the directive state: ‘Article > Topics: Telecommunications ### ¶4 Access to data Member States shall adopt measures to ensure that data retained in accordance with this Directive are provided only to the competent national authorities in specific cases and in accordance with national law. The procedures to be followed and the conditions to be fulfilled in order to gain access to retained data in accordance with necessity and proportionality requirements shall be defined by each Member State in its national law, subject to the relevant provisions of EU law or public international law, and in particular the ECHR as interpreted by the European Court of Human Rights. Article ### ¶5 Categories of data to be retained ### ¶6 Periods of retention Member States shall ensure that the categories of data specified in Article 5 are retained for periods of not less than six months and not more than two years from the date of the communication. Article > Applies: gdpr-art-5-en ### ¶9 Supervisory authority > Topics: Supervisory Authorities, Supervision ### ¶13 Remedies, liability and penalties ### ¶1 Each Member State shall take the necessary measures to ensure that the national measures implementing Chapter III of Directive 95/46/EC providing for judicial remedies, liability and sanctions are fully implemented with respect to the processing of data under this Directive. ### ¶17 On ### ¶8 ECHR? (iii) Is Directive 2006/24 compatible with the right to the protection of personal data laid down in Article 8 of the Charter? (iv) Is Directive 2006/24 compatible with the right to freedom of expression laid down in Article 11 of the Charter and Article > Topics: Personal Data · Applies: gdpr-art-8-en, gdpr-art-11-en ### ¶10 ECHR? (v) Is Directive 2006/24 compatible with the right to [g]ood [a]dministration laid down in Article 41 of the Charter? > Applies: gdpr-art-41-en ### ¶3 To what extent do the Treaties — and specifically the principle of loyal cooperation laid down in [Article 4(3) TEU] — require a national court to inquire into, and assess, the compatibility of the national implementing measures for [Directive 2006/24] with the protections afforded by the [Charter], including Article 7 thereof (as informed by Article 8 of the ECHR)?’ Case C–594/12 > Applies: gdpr-art-4-par-3-en, gdpr-art-7-en, gdpr-art-8-en ### ¶19 The origin of the request for a preliminary ruling in Case C‑594/12 lies in several actions brought before the Verfassungsgerichtshof by the Kärntner Landesregierung and by Mr Seitlinger, Mr Tschohl and 11 128 other applicants, respectively, seeking the annulment of Paragraph 102a of the 2003 Law on telecommunications (Telekommunikationsgesetz 2003), which was inserted into that 2003 Law by the federal law amending it (Bundesgesetz, mit dem das Telekommunikationsgesetz 2003 — TKG 2003 geändert wird, BGBl I, 27/2011) for the purpose of transposing Directive 2006/24 into Austrian national law. They take the view, inter alia, that Article 102a of the Telekommunikationsgesetz 2003 infringes the fundamental right of individuals to the protection of their data. > Topics: Telecommunications ### ¶20 The Verfassungsgerichtshof wonders, in particular, whether Directive 2006/24 is compatible with the Charter in so far as it allows the storing of many types of data in relation to an unlimited number of persons for a long time. The Verfassungsgerichtshof takes the view that the retention of data affects almost exclusively persons whose conduct in no way justifies the retention of data relating to them. Those persons are exposed to a greater risk that authorities will investigate the data relating to them, become acquainted with the content of those data, find out about their private lives and use those data for multiple purposes, having regard in particular to the unquantifiable number of persons having access to the data for a minimum period of six months. According to the referring court, there are doubts as to whether that directive is able to achieve the objectives which it pursues and as to the proportionality of the interference with the fundamental rights concerned. ### ¶21 In those circumstances the Verfassungsgerichtshof decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling: ‘1. Concerning the validity of acts of institutions of the European Union: Are Articles 3 to 9 of [Directive 2006/24] compatible with Articles 7, 8 and 11 of the [Charter]? ### ¶2 Concerning the interpretation of the Treaties: (a) In the light of the explanations relating to Article 8 of the Charter, which, according to Article 52(7) of the Charter, were drawn up as a way of providing guidance in the interpretation of the Charter and to which regard must be given by the Verfassungsgerichtshof, must [Directive 95/46] and Regulation (EC) No 45/2001 of the European Parliament and of the Council [of > Applies: gdpr-art-8-en, gdpr-art-52-en ### ¶18 December 2000] on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data [ OJ 2001 L 8, p. 1 ] be taken into account, for the purposes of assessing the permissibility of interference, as being of equal standing to the conditions under Article 8(2) and Article 52(1) of the Charter? (b) What is the relationship between “Union law”, as referred to in the final sentence of Article 52(3) of the Charter, and the directives in the field of the law on data protection? (c) In view of the fact that [Directive 95/26] and Regulation … No 45/2001 contain conditions and restrictions with a view to safeguarding the fundamental right to data protection under the Charter, must amendments resulting from subsequent secondary law be taken into account for the purpose of interpreting Article 8 of the Charter? (d) Having regard to Article 52(4) of the Charter, does it follow from the principle of the preservation of higher levels of protection in Article 53 of the Charter that the limits applicable under the Charter in relation to permissible restrictions must be more narrowly circumscribed by secondary law? (e) Having regard to Article 52(3) of the Charter, the fifth paragraph in the preamble thereto and the explanations in relation to Article 7 of the Charter, according to which the rights guaranteed in that article correspond to those guaranteed by Article 8 of the [ECHR], can assistance be derived from the case-law of the European Court of Human Rights for the purpose of interpreting Article 8 of the Charter such as to influence the interpretation of that latter article?’ > Topics: Personal Data, Processing · Applies: gdpr-art-8-par-2-en, gdpr-art-52-par-1-en, gdpr-art-52-par-3-en, gdpr-art-52-par-4-en, gdpr-art-7-en, gdpr-art-8-en, gdpr-art-53-en ### ¶22 By decision of the President of the Court of ### ¶11 June 2013, Cases C‑293/12 and C‑594/12 were joined for the purposes of the oral procedure and the judgment. Consideration of the questions referred The second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12 ### ¶23 By the second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12, which should be examined together, the referring courts are essentially asking the Court to examine the validity of Directive 2006/24 in the light of Articles 7, 8 and 11 of the Charter. The relevance of Articles 7, 8 and 11 of the Charter with regard to the question of the validity of Directive 2006/24 ### ¶24 It follows from Article 1 and recitals 4, 5, 7 to 11, 21 and 22 of Directive 2006/24 that the main objective of that directive is to harmonise Member States’ provisions concerning the retention, by providers of publicly available electronic communications services or of public communications networks, of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the prevention, investigation, detection and prosecution of serious crime, such as organised crime and terrorism, in compliance with the rights laid down in Articles 7 and 8 of the Charter. > Topics: Telecommunications · Applies: gdpr-art-1-en ### ¶25 The obligation, under Article 3 of Directive 2006/24, on providers of publicly available electronic communications services or of public communications networks to retain the data listed in Article 5 of the directive for the purpose of making them accessible, if necessary, to the competent national authorities raises questions relating to respect for private life and communications under Article 7 of the Charter, the protection of personal data under Article 8 of the Charter and respect for freedom of expression under Article 11 of the Charter. > Topics: Telecommunications, Personal Data · Applies: gdpr-art-3-en, gdpr-art-5-en, gdpr-art-7-en, gdpr-art-8-en, gdpr-art-11-en ### ¶27 Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them. ### ¶28 In such circumstances, even though, as is apparent from Article 1(2) and Article 5(2) of Directive 2006/24, the directive does not permit the retention of the content of the communication or of information consulted using an electronic communications network, it is not inconceivable that the retention of the data in question might have an effect on the use, by subscribers or registered users, of the means of communication covered by that directive and, consequently, on their exercise of the freedom of expression guaranteed by Article 11 of the Charter. > Topics: Telecommunications · Applies: gdpr-art-1-par-2-en, gdpr-art-5-par-2-en, gdpr-art-11-en ### ¶29 The retention of data for the purpose of possible access to them by the competent national authorities, as provided for by Directive 2006/24, directly and specifically affects private life and, consequently, the rights guaranteed by Article 7 of the Charter. Furthermore, such a retention of data also falls under Article 8 of the Charter because it constitutes the processing of personal data within the meaning of that article and, therefore, necessarily has to satisfy the data protection requirements arising from that article (Cases C‑92/09 and C‑93/09 Volker und Markus Schecke and Eifert EU:C:2010:662 , paragraph 47). > Topics: Personal Data, Processing · Applies: gdpr-art-7-en, gdpr-art-8-en ### ¶30 Whereas the references for a preliminary ruling in the present cases raise, in particular, the question of principle as to whether or not, in the light of Article 7 of the Charter, the data of subscribers and registered users may be retained, they also concern the question of principle as to whether Directive 2006/24 meets the requirements for the protection of personal data arising from Article 8 of the Charter. > Topics: Personal Data · Applies: gdpr-art-7-en, gdpr-art-8-en ### ¶31 In the light of the foregoing considerations, it is appropriate, for the purposes of answering the second question, parts (b) to (d), in Case C‑293/12 and the first question in Case C‑594/12, to examine the validity of the directive in the light of Articles 7 and 8 of the Charter. Interference with the rights laid down in Articles 7 and 8 of the Charter ### ¶32 By requiring the retention of the data listed in Article 5(1) of Directive 2006/24 and by allowing the competent national authorities to access those data, Directive 2006/24, as the Advocate General has pointed out, in particular, in paragraphs 39 and 40 of his Opinion, derogates from the system of protection of the right to privacy established by Directives 95/46 and 2002/58 with regard to the processing of personal data in the electronic communications sector, directives which provided for the confidentiality of communications and of traffic data as well as the obligation to erase or make those data anonymous where they are no longer needed for the purpose of the transmission of a communication, unless they are necessary for billing purposes and only for as long as so necessary. > Topics: Telecommunications, Right to be Forgotten, Personal Data, Processing · Applies: gdpr-art-5-par-1-en ### ¶33 To establish the existence of an interference with the fundamental right to privacy, it does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced in any way (see, to that effect, Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others EU:C:2003:294 , paragraph 75). ### ¶34 As a result, the obligation imposed by Articles 3 and 6 of Directive 2006/24 on providers of publicly available electronic communications services or of public communications networks to retain, for a certain period, data relating to a person’s private life and to his communications, such as those referred to in Article 5 of the directive, constitutes in itself an interference with the rights guaranteed by Article 7 of the Charter. > Topics: Telecommunications · Applies: gdpr-art-5-en, gdpr-art-7-en ### ¶35 Furthermore, the access of the competent national authorities to the data constitutes a further interference with that fundamental right (see, as regards Article 8 of the ECHR, Eur. Court H.R., Leander v. Sweden , > Applies: gdpr-art-8-en ### ¶26 March 1987, § 48, Series A no 116; Rotaru v. Romania [GC], no. 28341/95, § 46, ECHR 2000-V; and Weber and Saravia v. Germany (dec.), no. 54934/00, § 79, ECHR 2006-XI). Accordingly, Articles 4 and 8 of Directive 2006/24 laying down rules relating to the access of the competent national authorities to the data also constitute an interference with the rights guaranteed by Article 7 of the Charter. > Applies: gdpr-art-7-en ### ¶36 Likewise, Directive 2006/24 constitutes an interference with the fundamental right to the protection of personal data guaranteed by Article 8 of the Charter because it provides for the processing of personal data. > Topics: Personal Data, Processing · Applies: gdpr-art-8-en ### ¶37 It must be stated that the interference caused by Directive 2006/24 with the ## Cited law provisions (33) ### GDPR — gdpr-art-1-par-1-en This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. ### GDPR — gdpr-art-1-par-2-en This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. ### GDPR — gdpr-art-4-par-3-en ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; ### GDPR — gdpr-art-5-par-1-en Personal data shall be: ### GDPR — gdpr-art-5-par-2-en The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-8-par-1-en Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. ### GDPR — gdpr-art-8-par-2-en The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. ### GDPR — gdpr-art-13-par-1-en Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: ### GDPR — gdpr-art-15-par-1-en The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: ### GDPR — gdpr-art-17-par-1-en The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: ### GDPR — gdpr-art-52-par-1-en Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation. ### GDPR — gdpr-art-52-par-3-en Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not. ### GDPR — gdpr-art-52-par-4-en Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board. ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-3-en Territorial scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-7-en Conditions for consent ### GDPR — gdpr-art-8-en Conditions applicable to child's consent in relation to information society services ### GDPR — gdpr-art-9-en Processing of special categories of personal data ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-11-en Processing which does not require identification ### GDPR — gdpr-art-13-en Information to be provided where personal data are collected from the data subject ### GDPR — gdpr-art-15-en Right of access by the data subject ### GDPR — gdpr-art-21-en Right to object ### GDPR — gdpr-art-28-en Processor ### GDPR — gdpr-art-41-en Monitoring of approved codes of conduct ### GDPR — gdpr-art-52-en Independence ### GDPR — gdpr-art-53-en General conditions for the members of the supervisory authority ### GDPR — gdpr-art-95-en This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC. --- Generated by overview.legal · https://overview.legal/posts/51474 · 2026-08-22