The Court of Justice of the European Union has handed down a preliminary ruling stating that Member States may not impose a general obligation on providers of electronic communications services to retain data.
The ruling delivered on the 21st of December, stated that EU law excludes a general and indiscriminate retention of traffic and location data. However, Member States may make a provision for targeted retention of data as a preventive measure, which must be done with the sole intention of fighting serious crime.
Such retention must also be with respect to the categories of data to be retained, the means of communication affected, the persons concerned, and the chosen duration of retention, which must be strictly limited to what is necessary.
The access of the national authorities to the retained data must also be subject to a number of conditions, amongst which are that the access must be subject to a prior review by an independent authority and that national legislation should make provision for the irreversible destruction of the data at the end of the retention period.
