{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62018cj0511","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62018cj0511)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-14","fingerprint":"ewai:eu:f8b9a4","proof":"sha256:3356f0bbd4f1e208447b6946938e12879fa062fefc2a081bc83fbf186107bc79","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:62018cj0511","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"Front matter","paragraphs":["para_1","para_2","para_3","para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37","para_38","para_39","para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59","para_60","para_61","para_62","para_63","para_64","para_65","para_66","para_67","para_68","para_69","para_70","para_71","para_72","para_73","para_74","para_75","para_76","para_77","para_78","para_79","para_80","para_81","para_82","para_83","para_84","para_85","para_86","para_87","para_88","para_89","para_90","para_91","para_92","para_93","para_94","para_95","para_96","para_97","para_98","para_99","para_100","para_101","para_102","para_103","para_104","para_105","para_106","para_107","para_108","para_109","para_110","para_111","para_112","para_113","para_114","para_115","para_116","para_117","para_118","para_119","para_120","para_121","para_122","para_123","para_124","para_125","para_126","para_127","para_128","para_129","para_130"],"kind":"front_matter"},{"title":"Judgment","paragraphs":["para_131","para_132","para_133","para_134","para_135","para_136","para_137","para_138","para_139","para_140"],"kind":"assessment"},{"title":"EU law","paragraphs":["para_141"],"kind":"legal_framework"},{"title":"Directive 95/46","paragraphs":["para_142","para_143","para_144","para_145","para_146","para_147","para_148","para_149","para_150","para_151","para_152"],"kind":"legal_framework"},{"title":"Directive 97/66","paragraphs":["para_153","para_154","para_155","para_156","para_157"],"kind":"legal_framework"},{"title":"Directive 2000/31","paragraphs":["para_158","para_159","para_160","para_161","para_162","para_163","para_164","para_165","para_166","para_167","para_168","para_169","para_170","para_171","para_172","para_173","para_174","para_175","para_176","para_177","para_178","para_179","para_180","para_181","para_182","para_183","para_184","para_185"],"kind":"legal_framework"},{"title":"Directive 2002/21","paragraphs":["para_186","para_187","para_188","para_189","para_190","para_191","para_192","para_193","para_194","para_195","para_196"],"kind":"legal_framework"},{"title":"Directive 2002/58","paragraphs":["para_197","para_198","para_199","para_200","para_201","para_202","para_203","para_204","para_205","para_206","para_207","para_208","para_209","para_210","para_211","para_212","para_213","para_214","para_215","para_216","para_217","para_218","para_219","para_220","para_221","para_222","para_223","para_224","para_225","para_226","para_227","para_228","para_229","para_230","para_231","para_232","para_233","para_234","para_235","para_236","para_237","para_238","para_239","para_240","para_241","para_242","para_243","para_244","para_245","para_246","para_247","para_248","para_249","para_250","para_251","para_252","para_253","para_254","para_255","para_256","para_257","para_258","para_259","para_260","para_261"],"kind":"legal_framework"},{"title":"Regulation 2016/679","paragraphs":["para_262","para_263","para_264","para_265","para_266","para_267","para_268","para_269","para_270","para_271","para_272","para_273","para_274","para_275","para_276","para_277","para_278","para_279","para_280","para_281","para_282","para_283","para_284","para_285","para_286","para_287","para_288","para_289","para_290","para_291","para_292","para_293","para_294","para_295","para_296","para_297","para_298","para_299","para_300","para_301","para_302","para_303","para_304","para_305","para_306","para_307","para_308","para_309","para_310","para_311","para_312","para_313","para_314","para_315","para_316","para_317","para_318","para_319","para_320","para_321","para_322","para_323","para_324","para_325","para_326","para_327","para_328","para_329","para_330","para_331","para_332","para_333","para_334","para_335","para_336","para_337","para_338","para_339","para_340","para_341","para_342","para_343","para_344","para_345","para_346","para_347","para_348","para_349","para_350","para_351","para_352","para_353","para_354","para_355","para_356","para_357","para_358","para_359","para_360","para_361","para_362","para_363","para_364","para_365","para_366","para_367"],"kind":"legal_framework"},{"title":"Code de la sécurité intérieure (Internal Security Code)","paragraphs":["para_368","para_369","para_370","para_371","para_372","para_373","para_374","para_375","para_376","para_377","para_378","para_379","para_380","para_381","para_382","para_383","para_384","para_385","para_386","para_387","para_388","para_389","para_390","para_391","para_392"],"kind":"legal_framework"},{"title":"The prevention of the proliferation of weapons of mass destruction.’","paragraphs":["para_393","para_394","para_395","para_396","para_397","para_398","para_399","para_400","para_401","para_402","para_403","para_404","para_405","para_406","para_407","para_408","para_409","para_410","para_411","para_412","para_413","para_414","para_415","para_416","para_417","para_418","para_419","para_420","para_421","para_422","para_423","para_424","para_425","para_426","para_427","para_428","para_429","para_430","para_431","para_432","para_433","para_434","para_435","para_436","para_437","para_438","para_439","para_440","para_441","para_442","para_443","para_444","para_445","para_446","para_447","para_448","para_449","para_450","para_451","para_452","para_453","para_454","para_455","para_456","para_457","para_458","para_459","para_460","para_461","para_462","para_463","para_464","para_465","para_466"],"kind":"legal_framework"},{"title":"The CPCE","paragraphs":["para_467","para_468","para_469","para_470","para_471","para_472","para_473","para_474","para_475","para_476","para_477","para_478","para_479","para_480","para_481","para_482","para_483","para_484","para_485","para_486","para_487","para_488","para_489","para_490","para_491","para_492","para_493","para_494","para_495","para_496","para_497","para_498","para_499","para_500","para_501","para_502","para_503","para_504","para_505","para_506","para_507","para_508","para_509","para_510","para_511","para_512","para_513"],"kind":"legal_framework"},{"title":"Decree No 2011‑219","paragraphs":["para_514","para_515","para_516","para_517","para_518","para_519","para_520","para_521","para_522","para_523","para_524","para_525","para_526","para_527","para_528","para_529","para_530","para_531","para_532","para_533","para_534","para_535","para_536","para_537","para_538","para_539","para_540","para_541","para_542","para_543","para_544","para_545","para_546","para_547","para_548","para_549","para_550","para_551","para_552","para_553","para_554","para_555","para_556","para_557","para_558","para_559","para_560","para_561","para_562","para_563","para_564","para_565","para_566","para_567","para_568","para_569","para_570","para_571","para_572","para_573","para_574","para_575","para_576"],"kind":"legal_framework"},{"title":"Content erasure.’","paragraphs":["para_577","para_578","para_579","para_580","para_581","para_582","para_583","para_584","para_585","para_586"],"kind":"legal_framework"},{"title":"Belgian law","paragraphs":["para_587","para_588","para_589","para_590","para_591","para_592","para_593","para_594","para_595","para_596","para_597","para_598","para_599","para_600","para_601","para_602","para_603","para_604","para_605","para_606","para_607","para_608","para_609","para_610"],"kind":"legal_framework"},{"title":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraphs":["para_611"],"kind":"facts"},{"title":"Case C‑511/18","paragraphs":["para_612","para_613","para_614","para_615","para_616","para_617","para_618","para_619","para_620","para_621","para_622","para_623","para_624","para_625","para_626","para_627","para_628","para_629","para_630","para_631","para_632","para_633","para_634","para_635","para_636","para_637","para_638","para_639","para_640","para_641","para_642","para_643","para_644"],"kind":"facts"},{"title":"Case C‑512/18","paragraphs":["para_645","para_646","para_647","para_648","para_649","para_650","para_651","para_652","para_653","para_654","para_655","para_656","para_657","para_658","para_659"],"kind":"facts"},{"title":"Case C‑520/18","paragraphs":["para_660","para_661","para_662","para_663","para_664","para_665","para_666","para_667","para_668","para_669","para_670","para_671","para_672","para_673","para_674","para_675","para_676","para_677","para_678"],"kind":"facts"},{"title":"Procedure before the Court","paragraphs":["para_679","para_680","para_681"],"kind":"facts"},{"title":"Consideration of the questions referred","paragraphs":["para_682"],"kind":"questions"},{"title":"Question 1 in Cases C‑511/18 and C‑512/18 and questions 1 and 2 in Case C‑520/18","paragraphs":["para_683","para_684","para_685"],"kind":"questions"},{"title":"Preliminary remarks","paragraphs":["para_686","para_687","para_688","para_689","para_690","para_691","para_692","para_693","para_694","para_695","para_696"],"kind":"questions"},{"title":"Scope of Directive 2002/58","paragraphs":["para_697","para_698","para_699","para_700","para_701","para_702","para_703","para_704","para_705","para_706","para_707","para_708","para_709","para_710","para_711","para_712","para_713","para_714","para_715","para_716","para_717","para_718","para_719","para_720","para_721","para_722","para_723","para_724","para_725","para_726","para_727","para_728","para_729","para_730","para_731","para_732","para_733"],"kind":"questions"},{"title":"Interpretation of Article 15(1) of Directive 2002/58","paragraphs":["para_734","para_735","para_736","para_737","para_738","para_739","para_740","para_741","para_742","para_743","para_744","para_745","para_746","para_747","para_748","para_749","para_750","para_751","para_752","para_753","para_754","para_755","para_756","para_757","para_758","para_759","para_760","para_761","para_762","para_763","para_764","para_765","para_766","para_767","para_768","para_769","para_770","para_771","para_772","para_773","para_774","para_775","para_776","para_777","para_778","para_779","para_780","para_781","para_782","para_783","para_784","para_785","para_786","para_787","para_788","para_789","para_790","para_791","para_792","para_793","para_794","para_795","para_796","para_797","para_798","para_799","para_800","para_801","para_802","para_803","para_804","para_805","para_806","para_807","para_808","para_809","para_810","para_811","para_812","para_813","para_814","para_815","para_816","para_817","para_818","para_819","para_820","para_821","para_822","para_823","para_824","para_825","para_826","para_827","para_828","para_829","para_830","para_831","para_832","para_833","para_834","para_835","para_836","para_837","para_838","para_839","para_840","para_841","para_842","para_843","para_844","para_845","para_846","para_847","para_848","para_849","para_850","para_851","para_852","para_853","para_854","para_855","para_856","para_857","para_858","para_859","para_860","para_861","para_862","para_863","para_864","para_865","para_866","para_867","para_868","para_869","para_870","para_871","para_872","para_873","para_874","para_875","para_876","para_877"],"kind":"questions"},{"title":"Questions 2 and 3 in Case C‑511/18","paragraphs":["para_878","para_879","para_880","para_881","para_882","para_883","para_884"],"kind":"questions"},{"title":"Automated analysis of traffic and location data","paragraphs":["para_885","para_886","para_887","para_888","para_889","para_890","para_891","para_892","para_893","para_894","para_895","para_896","para_897","para_898","para_899","para_900","para_901","para_902","para_903","para_904","para_905","para_906","para_907"],"kind":"questions"},{"title":"Real-time collection of traffic and location data","paragraphs":["para_908","para_909","para_910","para_911","para_912","para_913","para_914","para_915","para_916","para_917","para_918","para_919","para_920","para_921","para_922"],"kind":"questions"},{"title":"Notification of persons whose data has been collected or analysed","paragraphs":["para_923","para_924","para_925","para_926","para_927","para_928","para_929","para_930","para_931","para_932","para_933"],"kind":"questions"},{"title":"Question 2 in Case C‑512/18","paragraphs":["para_934","para_935","para_936","para_937","para_938","para_939","para_940","para_941","para_942","para_943","para_944","para_945","para_946","para_947","para_948","para_949","para_950","para_951","para_952","para_953","para_954","para_955","para_956","para_957","para_958","para_959","para_960","para_961","para_962","para_963","para_964","para_965","para_966","para_967","para_968","para_969","para_970","para_971","para_972","para_973","para_974"],"kind":"questions"},{"title":"Question 3 in Case C‑520/18","paragraphs":["para_975","para_976","para_977","para_978","para_979","para_980","para_981","para_982","para_983","para_984","para_985","para_986","para_987","para_988","para_989","para_990","para_991","para_992","para_993","para_994","para_995","para_996","para_997","para_998","para_999","para_1000","para_1001","para_1002","para_1003","para_1004","para_1005","para_1006","para_1007"],"kind":"questions"},{"title":"Costs","paragraphs":["para_1008","para_1009","para_1010"],"kind":"costs"},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_1011","para_1012","para_1013","para_1014","para_1015","para_1016","para_1017","para_1018","para_1019","para_1020","para_1021","para_1022","para_1023","para_1024","para_1025","para_1026","para_1027","para_1028","para_1029","para_1030","para_1031","para_1032","para_1033","para_1034","para_1035","para_1036"],"kind":"operative"}],"paragraphs":[{"text":"62018CJ0511","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"6 October 2020 (\n *1\n )","paragraph_id":"para_3"},{"text":"[Text rectified by order of 16 November 2020]","paragraph_id":"para_4"},{"text":"Table of Contents","paragraph_id":"para_5"},{"text":"Legislative framework","paragraph_id":"para_6"},{"text":"EU law","paragraph_id":"para_7"},{"text":"Directive 95/46","paragraph_id":"para_8"},{"text":"Directive 97/66","paragraph_id":"para_9"},{"text":"Directive 2000/31","paragraph_id":"para_10"},{"text":"Directive 2002/21","paragraph_id":"para_11"},{"text":"Directive 2002/58","paragraph_id":"para_12"},{"text":"Regulation 2016/679","paragraph_id":"para_13"},{"text":"French law","paragraph_id":"para_14"},{"text":"Code de la sécurité intérieure (Internal Security Code)","paragraph_id":"para_15"},{"text":"The CPCE","paragraph_id":"para_16"},{"text":"Loi n o  2004‑575 du 21 juin 2004 pour la confiance dans l’économie numérique (Law No 2004‑575 of 21 June 2004 to promote trust in the digital economy)","paragraph_id":"para_17"},{"text":"Decree No 2011‑219","paragraph_id":"para_18"},{"text":"Belgian law","paragraph_id":"para_19"},{"text":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_20"},{"text":"Case C‑511/18","paragraph_id":"para_21"},{"text":"Case C‑512/18","paragraph_id":"para_22"},{"text":"Case C‑520/18","paragraph_id":"para_23"},{"text":"Procedure before the Court","paragraph_id":"para_24"},{"text":"Consideration of the questions referred","paragraph_id":"para_25"},{"text":"Question 1 in Cases C‑511/18 and C‑512/18 and questions 1 and 2 in Case C‑520/18","paragraph_id":"para_26"},{"text":"Preliminary remarks","paragraph_id":"para_27"},{"text":"Scope of Directive 2002/58","paragraph_id":"para_28"},{"text":"Interpretation of Article 15(1) of Directive 2002/58","paragraph_id":"para_29"},{"text":"– Legislative measures providing for the preventive retention of traffic and location data for the purpose of safeguarding national security","paragraph_id":"para_30"},{"text":"– Legislative measures providing for the preventive retention of traffic and location data for the purposes of combating crime and safeguarding public security","paragraph_id":"para_31"},{"text":"– Legislative measures providing for the preventive retention of IP addresses and data relating to civil identity for the purposes of combating crime and safeguarding public security","paragraph_id":"para_32"},{"text":"– Legislative measures providing for the expedited retention of traffic and location data for the purpose of combating serious crime","paragraph_id":"para_33"},{"text":"Questions 2 and 3 in Case C‑511/18","paragraph_id":"para_34"},{"text":"Automated analysis of traffic and location data","paragraph_id":"para_35"},{"text":"Real-time collection of traffic and location data","paragraph_id":"para_36"},{"text":"Notification of persons whose data has been collected or analysed","paragraph_id":"para_37"},{"text":"Question 2 in Case C‑512/18","paragraph_id":"para_38"},{"text":"Question 3 in Case C‑520/18","paragraph_id":"para_39"},{"text":"Costs","paragraph_id":"para_40"},{"text":"(Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Providers of electronic communications services – Hosting service providers and Internet access providers – General and indiscriminate retention of traffic and location data – Automated analys …","paragraph_id":"para_41"},{"text":"In Joined Cases C‑511/18, C‑512/18 and C‑520/18,","paragraph_id":"para_42"},{"text":"REQUESTS for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decisions of 26 July 2018, received at the Court on 3 August 2018 (C‑511/18 and C‑512/18), and from the Cour constitutionnelle (Constitutional Court, Belgium), made by decision of 19 July 2018, received at the Court on 2 August 2018 (C‑520/18), in the proceedings","paragraph_id":"para_43"},{"text":"La Quadrature du Net (C‑511/18 and C‑512/18),","paragraph_id":"para_44"},{"text":"French Data Network (C‑511/18 and C‑512/18),","paragraph_id":"para_45"},{"text":"Fédération des fournisseurs d’accès à Internet associatifs (C‑511/18 and C‑512/18),","paragraph_id":"para_46"},{"text":"Igwan.net (C‑511/18)","paragraph_id":"para_47"},{"text":"v","paragraph_id":"para_48"},{"text":"Premier ministre (C‑511/18 and C‑512/18),","paragraph_id":"para_49"},{"text":"Garde des Sceaux, ministre de la Justice (C‑511/18 and C‑512/18),","paragraph_id":"para_50"},{"text":"Ministre de l’Intérieur (C‑511/18),","paragraph_id":"para_51"},{"text":"Ministre des Armées (C‑511/18),","paragraph_id":"para_52"},{"text":"interveners:","paragraph_id":"para_53"},{"text":"Privacy International (C‑512/18),","paragraph_id":"para_54"},{"text":"Center for Democracy and Technology (C‑512/18),","paragraph_id":"para_55"},{"text":"and","paragraph_id":"para_56"},{"text":"Ordre des barreaux francophones et germanophone,","paragraph_id":"para_57"},{"text":"Académie Fiscale ASBL,","paragraph_id":"para_58"},{"text":"UA,","paragraph_id":"para_59"},{"text":"Liga voor Mensenrechten ASBL,","paragraph_id":"para_60"},{"text":"Ligue des Droits de l’Homme ASBL,","paragraph_id":"para_61"},{"text":"VZ,","paragraph_id":"para_62"},{"text":"WY,","paragraph_id":"para_63"},{"text":"XX","paragraph_id":"para_64"},{"text":"v","paragraph_id":"para_65"},{"text":"Conseil des ministres,","paragraph_id":"para_66"},{"text":"interveners:","paragraph_id":"para_67"},{"text":"Child Focus (C‑520/18),","paragraph_id":"para_68"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_69"},{"text":"composed of K. Lenaerts, President, R. Silva de Lapuerta, Vice-President, J.‑C. Bonichot, A. Arabadjiev, A. Prechal, M. Safjan, P.G. Xuereb and L.S. Rossi, Presidents of Chambers, J. Malenovský, L. Bay Larsen, T. von Danwitz (Rapporteur), C. Toader, K. Jürimäe, C. Lycourgos and N. Piçarra, Judges,","paragraph_id":"para_70"},{"text":"Advocate General: M. Campos Sánchez-Bordona,","paragraph_id":"para_71"},{"text":"Registrar: C. Strömholm, Administrator,","paragraph_id":"para_72"},{"text":"having regard to the written procedure and further to the hearing on 9 and 10 September 2019,","paragraph_id":"para_73"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_74"},{"text":"–","paragraph_id":"para_75"},{"text":"La Quadrature du Net, the Fédération des fournisseurs d’accès à Internet associatifs, Igwan.net and the Center for Democracy and Technology, by A. Fitzjean Ò Cobhthaigh, avocat,","paragraph_id":"para_76"},{"text":"–","paragraph_id":"para_77"},{"text":"French Data Network, by Y. Padova, avocat,","paragraph_id":"para_78"},{"text":"–","paragraph_id":"para_79"},{"text":"Privacy International, by H. Roy, avocat,","paragraph_id":"para_80"},{"text":"–","paragraph_id":"para_81"},{"text":"the Ordre des barreaux francophones et germanophone, by E. Kiehl, P. Limbrée, E. Lemmens, A. Cassart and J.‑F. Henrotte, avocats,","paragraph_id":"para_82"},{"text":"–","paragraph_id":"para_83"},{"text":"the Académie Fiscale ASBL and UA, by J.‑P. Riquet,","paragraph_id":"para_84"},{"text":"–","paragraph_id":"para_85"},{"text":"the Liga voor Mensenrechten ASBL, by J. Vander Velpen, avocat,","paragraph_id":"para_86"},{"text":"–","paragraph_id":"para_87"},{"text":"the Ligue des Droits de l’Homme ASBL, by R. Jespers and J. Fermon, avocats,","paragraph_id":"para_88"},{"text":"–","paragraph_id":"para_89"},{"text":"VZ, WY and XX, by D. Pattyn, avocat,","paragraph_id":"para_90"},{"text":"–","paragraph_id":"para_91"},{"text":"Child Focus, by N. Buisseret, K. De Meester and J. Van Cauter, avocats,","paragraph_id":"para_92"},{"text":"–","paragraph_id":"para_93"},{"text":"the French Government, initially by D. Dubois, F. Alabrune, D. Colas, E. de Moustier and A.‑L. Desjonquères, then by D. Dubois, F. Alabrune, E. de Moustier and A.‑L. Desjonquères, acting as Agents,","paragraph_id":"para_94"},{"text":"–","paragraph_id":"para_95"},{"text":"the Belgian Government, by J.‑C. Halleux, P. Cottin and C. Pochet, acting as Agents, and by J. Vanpraet, Y. Peeters, S. Depré and E. de Lophem, avocats,","paragraph_id":"para_96"},{"text":"–","paragraph_id":"para_97"},{"text":"the Czech Government, by M. Smolek, J. Vláčil and O. Serdula, acting as Agents,","paragraph_id":"para_98"},{"text":"–","paragraph_id":"para_99"},{"text":"the Danish Government, initially by J. Nymann-Lindegren, M. Wolff and P. Ngo, then by J. Nymann-Lindegren and M. Wolff, acting as Agents,","paragraph_id":"para_100"},{"text":"–","paragraph_id":"para_101"},{"text":"the German Government, initially by J. Möller, M. Hellmann, E. Lankenau, R. Kanitz and T. Henze, then by J. Möller, M. Hellmann, E. Lankenau and R. Kanitz, acting as Agents,","paragraph_id":"para_102"},{"text":"–","paragraph_id":"para_103"},{"text":"the Estonian Government, by N. Grünberg and A. Kalbus, acting as Agents,","paragraph_id":"para_104"},{"text":"–","paragraph_id":"para_105"},{"text":"Ireland, by A. Joyce, M. Browne and G. Hodge, acting as Agents, and by D. Fennelly, Barrister-at-Law,","paragraph_id":"para_106"},{"text":"–","paragraph_id":"para_107"},{"text":"the Spanish Government, initially by L. Aguilera Ruiz and A. Rubio González, then by L. Aguilera Ruiz, acting as Agent,","paragraph_id":"para_108"},{"text":"–","paragraph_id":"para_109"},{"text":"the Cypriot Government, by E. Neofytou, acting as Agent,","paragraph_id":"para_110"},{"text":"–","paragraph_id":"para_111"},{"text":"the Latvian Government, by V. Soņeca, acting as Agent,","paragraph_id":"para_112"},{"text":"–","paragraph_id":"para_113"},{"text":"the Hungarian Government, initially by M.Z. Fehér and Z. Wagner, then by M.Z. Fehér, acting as Agent,","paragraph_id":"para_114"},{"text":"–","paragraph_id":"para_115"},{"text":"the Netherlands Government, by M.K. Bulterman and M.A.M. de Ree, acting as Agents,","paragraph_id":"para_116"},{"text":"–","paragraph_id":"para_117"},{"text":"the Polish Government, by B. Majczyna, J. Sawicka and M. Pawlicka, acting as Agents,","paragraph_id":"para_118"},{"text":"–","paragraph_id":"para_119"},{"text":"the Swedish Government, initially by H. Shev, H. Eklinder, C. Meyer-Seitz and A. Falk, then by H. Shev, H. Eklinder, C. Meyer-Seitz and J. Lundberg, acting as Agents,","paragraph_id":"para_120"},{"text":"–","paragraph_id":"para_121"},{"text":"the United Kingdom Government, by S. Brandon, acting as Agent, and by G. Facenna QC and C. Knight, Barrister,","paragraph_id":"para_122"},{"text":"–","paragraph_id":"para_123"},{"text":"[indent deleted by order of 16 November 2020],","paragraph_id":"para_124"},{"text":"–","paragraph_id":"para_125"},{"text":"the European Commission, initially by H. Kranenborg, M. Wasmeier and P. Costa de Oliveira, then by H. Kranenborg and M. Wasmeier, acting as Agents,","paragraph_id":"para_126"},{"text":"–","paragraph_id":"para_127"},{"text":"the European Data Protection Supervisor, by T. Zerdick and A. Buchta, acting as Agents,","paragraph_id":"para_128"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 15 January 2020,","paragraph_id":"para_129"},{"text":"gives the following","paragraph_id":"para_130"},{"text":"Judgment","paragraph_id":"para_131"},{"text":"1","paragraph_id":"para_132"},{"text":"These requests for a preliminary ruling concern the interpretation of Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on pri …","paragraph_id":"para_133","court_paragraph":1},{"text":"2","paragraph_id":"para_134"},{"text":"The request in Case C‑511/18 has been made in proceedings between La Quadrature du Net, French Data Network, the Fédération des fournisseurs d’accès à Internet associatifs and Igwan.net, on the one hand, and the Premier ministre (Prime Minister, France), the Garde des Sceaux, ministre de la Justice …","paragraph_id":"para_135","court_paragraph":2},{"text":"3","paragraph_id":"para_136"},{"text":"The request in Case C‑512/18 has been made in proceedings between French Data Network, La Quadrature du Net and the Fédération des fournisseurs d’accès à Internet associatifs, on the one hand, and the Prime Minister (France) and the Keeper of the Seals, Minister for Justice (France), on the other, c …","paragraph_id":"para_137","court_paragraph":3},{"text":"4","paragraph_id":"para_138"},{"text":"The request in Case C‑520/18 has been made in proceedings between the Ordre des barreaux francophones et germanophone, the Académie Fiscale ASBL, UA, the Liga voor Mensenrechten ASBL, the Ligue des Droits de l’Homme ASBL, VZ, WY and XX, on the one hand, and the Conseil des ministres (Council of Mini …","paragraph_id":"para_139","court_paragraph":4},{"text":"Legislative framework","paragraph_id":"para_140"},{"text":"EU law","paragraph_id":"para_141"},{"text":"Directive 95/46","paragraph_id":"para_142"},{"text":"5","paragraph_id":"para_143"},{"text":"Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ) was repealed with effect from 25 May 2018 by Regulation (EU) 2016/679 of …","paragraph_id":"para_144","court_paragraph":5},{"text":"‘This Directive shall not apply to the processing of personal data:","paragraph_id":"para_145"},{"text":"–","paragraph_id":"para_146"},{"text":"in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,","paragraph_id":"para_147"},{"text":"–","paragraph_id":"para_148"},{"text":"by a natural person in the course of a purely personal or household act.’","paragraph_id":"para_149"},{"text":"6","paragraph_id":"para_150"},{"text":"Article 22 of Directive 95/46, which is in Chapter III of that directive, headed ‘Judicial remedies, liability and sanctions’, was worded as follows:","paragraph_id":"para_151","court_paragraph":6},{"text":"‘Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.’","paragraph_id":"para_152"},{"text":"Directive 97/66","paragraph_id":"para_153"},{"text":"7","paragraph_id":"para_154"},{"text":"Under Article 5 of Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector ( OJ 1998 L 24, p. 1 ), headed ‘Confidentiality of the communications’:","paragraph_id":"para_155","court_paragraph":7},{"text":"‘1.   Member States shall ensure via national regulations the confidentiality of communications by means of a public telecommunications network and publicly available telecommunications services. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications, by others than users, without the consent of the users concerned, except when legally authorised, in accordance with Article 14(1).","paragraph_id":"para_156"},{"text":"2.   Paragraph 1 shall not affect any legally authorised recording of communications in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication.’","paragraph_id":"para_157"},{"text":"Directive 2000/31","paragraph_id":"para_158"},{"text":"8","paragraph_id":"para_159"},{"text":"Recitals 14 and 15 of Directive 2000/31 provide:","paragraph_id":"para_160","court_paragraph":8},{"text":"‘(14)","paragraph_id":"para_161"},{"text":"The protection of individuals with regard to the processing of personal data is solely governed by Directive [95/46] and Directive [97/66] which are fully applicable to information society services; these Directives already establish a Community legal framework in the field of personal data and ther …","paragraph_id":"para_162"},{"text":"(15)","paragraph_id":"para_163"},{"text":"The confidentiality of communications is guaranteed by Article 5 Directive [97/66]; in accordance with that Directive, Member States must prohibit any kind of interception or surveillance of such communications by others than the senders and receivers, except when legally authorised.’","paragraph_id":"para_164"},{"text":"9","paragraph_id":"para_165"},{"text":"Article 1 of Directive 2000/31 is worded as follows:","paragraph_id":"para_166","court_paragraph":9},{"text":"‘1.   This Directive seeks to contribute to the proper functioning of the internal market by ensuring the free movement of information society services between the Member States.","paragraph_id":"para_167"},{"text":"2.   This Directive approximates, to the extent necessary for the achievement of the objective set out in paragraph 1, certain national provisions on information society services relating to the internal market, the establishment of service providers, commercial communications, electronic contracts, the liability of intermediaries, codes of conduct, out-of-court dispute settlements, court actions and cooperation between Member States.","paragraph_id":"para_168"},{"text":"3.   This Directive complements Community law applicable to information society services without prejudice to the level of protection for, in particular, public health and consumer interests, as established by Community acts and national legislation implementing them in so far as this does not restrict the freedom to provide information society services.","paragraph_id":"para_169"},{"text":"…","paragraph_id":"para_170"},{"text":"5.   This Directive shall not apply to:","paragraph_id":"para_171"},{"text":"…","paragraph_id":"para_172"},{"text":"(b)","paragraph_id":"para_173"},{"text":"questions relating to information society services covered by Directives [95/46] and [97/66];","paragraph_id":"para_174"},{"text":"…’","paragraph_id":"para_175"},{"text":"10","paragraph_id":"para_176"},{"text":"Article 2 of Directive 2000/31 is worded as follows:","paragraph_id":"para_177","court_paragraph":10},{"text":"‘For the purpose of this Directive, the following terms shall bear the following meanings:","paragraph_id":"para_178"},{"text":"(a)","paragraph_id":"para_179"},{"text":"“information society services”: services within the meaning of Article 1(2) of Directive 98/34/EC [of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations ( OJ 1998 L 204, p. 37 )] as amended by Directive 98/48/EC [of the European Parliament and of the Council of 20 July 1998 ( OJ 1998 L 217, p. 18 )];","paragraph_id":"para_180"},{"text":"…’","paragraph_id":"para_181"},{"text":"11","paragraph_id":"para_182"},{"text":"Article 15 of Directive 2000/31 provides:","paragraph_id":"para_183","court_paragraph":11},{"text":"‘1.   ‘Member States shall not impose a general obligation on providers, when providing the services covered by Articles 12, 13 and 14, to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.","paragraph_id":"para_184"},{"text":"2.   Member States may establish obligations for information society service providers promptly to inform the competent public authorities of alleged illegal activities undertaken or information provided by recipients of their service or obligations to communicate to the competent authorities, at their request, information enabling the identification of recipients of their service with whom they have storage agreements.’","paragraph_id":"para_185"},{"text":"Directive 2002/21","paragraph_id":"para_186"},{"text":"12","paragraph_id":"para_187"},{"text":"Recital 10 of Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) ( OJ 2002 L 108, p. 33 ) states:","paragraph_id":"para_188","court_paragraph":12},{"text":"‘The definition of “information society service” in Article 1 of Directive [98/34, as amended by Directive 98/48,] spans a wide range of economic activities which take place on-line. Most of these activities are not covered by the scope of this Directive because they do not consist wholly or mainly …","paragraph_id":"para_189"},{"text":"13","paragraph_id":"para_190"},{"text":"Article 2 of Directive 2002/21 provides:","paragraph_id":"para_191","court_paragraph":13},{"text":"‘For the purposes of this Directive:","paragraph_id":"para_192"},{"text":"…","paragraph_id":"para_193"},{"text":"(c)","paragraph_id":"para_194"},{"text":"“electronic communications service” means a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but exclude se …","paragraph_id":"para_195"},{"text":"…’","paragraph_id":"para_196"},{"text":"Directive 2002/58","paragraph_id":"para_197"},{"text":"14","paragraph_id":"para_198"},{"text":"Recitals 2, 6, 7, 11, 22, 26 and 30 of Directive 2002/58 state:","paragraph_id":"para_199","court_paragraph":14},{"text":"‘(2)","paragraph_id":"para_200"},{"text":"This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the [Charter]. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.","paragraph_id":"para_201"},{"text":"…","paragraph_id":"para_202"},{"text":"(6)","paragraph_id":"para_203"},{"text":"The Internet is overturning traditional market structures by providing a common, global infrastructure for the delivery of a wide range of electronic communications services. Publicly available electronic communications services over the Internet open new possibilities for users but also new risks for their personal data and privacy.","paragraph_id":"para_204"},{"text":"(7)","paragraph_id":"para_205"},{"text":"In the case of public communications networks, specific legal, regulatory and technical provisions should be made in order to protect fundamental rights and freedoms of natural persons and legitimate interests of legal persons, in particular with regard to the increasing capacity for automated storage and processing of data relating to subscribers and users.","paragraph_id":"para_206"},{"text":"…","paragraph_id":"para_207"},{"text":"(11)","paragraph_id":"para_208"},{"text":"Like Directive [95/46], this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by [Union] law. Therefore it does not alter the existing balance between the individual’s right to privacy and the possibility for Member State …","paragraph_id":"para_209"},{"text":"…","paragraph_id":"para_210"},{"text":"(22)","paragraph_id":"para_211"},{"text":"The prohibition of storage of communications and the related traffic data by persons other than the users or without their consent is not intended to prohibit any automatic, intermediate and transient storage of this information in so far as this takes place for the sole purpose of carrying out the …","paragraph_id":"para_212"},{"text":"…","paragraph_id":"para_213"},{"text":"(26)","paragraph_id":"para_214"},{"text":"The data relating to subscribers processed within electronic communications networks to establish connections and to transmit information contain information on the private life of natural persons and concern the right to respect for their correspondence or concern the legitimate interests of legal …","paragraph_id":"para_215"},{"text":"…","paragraph_id":"para_216"},{"text":"(30)","paragraph_id":"para_217"},{"text":"Systems for the provision of electronic communications networks and services should be designed to limit the amount of personal data necessary to a strict minimum. …’","paragraph_id":"para_218"},{"text":"15","paragraph_id":"para_219"},{"text":"Article 1 of Directive 2002/58, headed ‘Scope and aim’, provides:","paragraph_id":"para_220","court_paragraph":15},{"text":"‘1.   This Directive provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the [European Union].","paragraph_id":"para_221"},{"text":"2.   The provisions of this Directive particularise and complement Directive [95/46] for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.","paragraph_id":"para_222"},{"text":"3.   This Directive shall not apply to activities which fall outside the scope of the [TFEU], such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law.’","paragraph_id":"para_223"},{"text":"16","paragraph_id":"para_224"},{"text":"Article 2 of Directive 2002/58, headed ‘Definitions’, provides:","paragraph_id":"para_225","court_paragraph":16},{"text":"‘Save as otherwise provided, the definitions in Directive [95/46] and in Directive [2002/21] shall apply.","paragraph_id":"para_226"},{"text":"The following definitions shall also apply:","paragraph_id":"para_227"},{"text":"(a)","paragraph_id":"para_228"},{"text":"“user” means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;","paragraph_id":"para_229"},{"text":"(b)","paragraph_id":"para_230"},{"text":"“traffic data” means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;","paragraph_id":"para_231"},{"text":"(c)","paragraph_id":"para_232"},{"text":"“location data” means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;","paragraph_id":"para_233"},{"text":"(d)","paragraph_id":"para_234"},{"text":"“communication” means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information;","paragraph_id":"para_235"},{"text":"…’","paragraph_id":"para_236"},{"text":"17","paragraph_id":"para_237"},{"text":"Article 3 of Directive 2002/58, headed ‘Services concerned’, provides:","paragraph_id":"para_238","court_paragraph":17},{"text":"‘This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices.’","paragraph_id":"para_239"},{"text":"18","paragraph_id":"para_240"},{"text":"Article 5 of Directive 2002/58, headed ‘Confidentiality of the communications’, provides:","paragraph_id":"para_241","court_paragraph":18},{"text":"‘1.   Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or o …","paragraph_id":"para_242"},{"text":"…","paragraph_id":"para_243"},{"text":"3.   Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear …","paragraph_id":"para_244"},{"text":"19","paragraph_id":"para_245"},{"text":"Article 6 of Directive 2002/58, headed ‘Traffic data’, provides:","paragraph_id":"para_246","court_paragraph":19},{"text":"‘1.   Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).","paragraph_id":"para_247"},{"text":"2.   Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued.","paragraph_id":"para_248"},{"text":"3.   For the purpose of marketing electronic communications services or for the provision of value added services, the provider of a publicly available electronic communications service may process the data referred to in paragraph 1 to the extent and for the duration necessary for such services or …","paragraph_id":"para_249"},{"text":"…","paragraph_id":"para_250"},{"text":"5.   Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiri …","paragraph_id":"para_251"},{"text":"…’","paragraph_id":"para_252"},{"text":"20","paragraph_id":"para_253"},{"text":"Article 9(1) of that directive, that article being headed ‘Location data other than traffic data’, provides:","paragraph_id":"para_254","court_paragraph":20},{"text":"‘Where location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communications services, can be processed, such data may only be processed when they are made anonymous, or with the consent of the users or subscribers t …","paragraph_id":"para_255"},{"text":"21","paragraph_id":"para_256"},{"text":"Article 15 of that directive, headed ‘Application of certain provisions of Directive [95/46]’, states:","paragraph_id":"para_257","court_paragraph":21},{"text":"‘1.   Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a d …","paragraph_id":"para_258"},{"text":"…","paragraph_id":"para_259"},{"text":"2.   The provisions of Chapter III on judicial remedies, liability and sanctions of Directive [95/46] shall apply with regard to national provisions adopted pursuant to this Directive and with regard to the individual rights derived from this Directive.","paragraph_id":"para_260"},{"text":"…’","paragraph_id":"para_261"},{"text":"Regulation 2016/679","paragraph_id":"para_262"},{"text":"22","paragraph_id":"para_263"},{"text":"Recital 10 of Regulation 2016/679 states:","paragraph_id":"para_264","court_paragraph":22},{"text":"‘In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member …","paragraph_id":"para_265"},{"text":"23","paragraph_id":"para_266"},{"text":"Article 2 of that regulation provides:","paragraph_id":"para_267","court_paragraph":23},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_268"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_269"},{"text":"(a)","paragraph_id":"para_270"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_271"},{"text":"(b)","paragraph_id":"para_272"},{"text":"by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;","paragraph_id":"para_273"},{"text":"…","paragraph_id":"para_274"},{"text":"(d)","paragraph_id":"para_275"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.","paragraph_id":"para_276"},{"text":"…","paragraph_id":"para_277"},{"text":"4.   This Regulation shall be without prejudice to the application of Directive [2000/31], in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.’","paragraph_id":"para_278"},{"text":"24","paragraph_id":"para_279"},{"text":"Article 4 of that regulation reads as follows:","paragraph_id":"para_280","court_paragraph":24},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_281"},{"text":"(1)","paragraph_id":"para_282"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_283"},{"text":"(2)","paragraph_id":"para_284"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_285"},{"text":"…’","paragraph_id":"para_286"},{"text":"25","paragraph_id":"para_287"},{"text":"Article 5 of Regulation 2016/679 provides:","paragraph_id":"para_288","court_paragraph":25},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_289"},{"text":"(a)","paragraph_id":"para_290"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_291"},{"text":"(b)","paragraph_id":"para_292"},{"text":"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);","paragraph_id":"para_293"},{"text":"(c)","paragraph_id":"para_294"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_295"},{"text":"(d)","paragraph_id":"para_296"},{"text":"accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);","paragraph_id":"para_297"},{"text":"(e)","paragraph_id":"para_298"},{"text":"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data will be processed solely for archiving purposes in the public interes …","paragraph_id":"para_299"},{"text":"(f)","paragraph_id":"para_300"},{"text":"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).","paragraph_id":"para_301"},{"text":"…’","paragraph_id":"para_302"},{"text":"26","paragraph_id":"para_303"},{"text":"Article 6 of that regulation reads as follows:","paragraph_id":"para_304","court_paragraph":26},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_305"},{"text":"…","paragraph_id":"para_306"},{"text":"(c)","paragraph_id":"para_307"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_308"},{"text":"…","paragraph_id":"para_309"},{"text":"3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:","paragraph_id":"para_310"},{"text":"(a)","paragraph_id":"para_311"},{"text":"Union law; or","paragraph_id":"para_312"},{"text":"(b)","paragraph_id":"para_313"},{"text":"Member State law to which the controller is subject.","paragraph_id":"para_314"},{"text":"The purpose of the processing shall be determined in that legal basis … That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subj …","paragraph_id":"para_315"},{"text":"…’","paragraph_id":"para_316"},{"text":"27","paragraph_id":"para_317"},{"text":"Article 23 of that regulation provides:","paragraph_id":"para_318","court_paragraph":27},{"text":"‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and ob …","paragraph_id":"para_319"},{"text":"(a)","paragraph_id":"para_320"},{"text":"national security;","paragraph_id":"para_321"},{"text":"(b)","paragraph_id":"para_322"},{"text":"defence;","paragraph_id":"para_323"},{"text":"(c)","paragraph_id":"para_324"},{"text":"public security;","paragraph_id":"para_325"},{"text":"(d)","paragraph_id":"para_326"},{"text":"the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;","paragraph_id":"para_327"},{"text":"(e)","paragraph_id":"para_328"},{"text":"other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation … matters, public health and social security;","paragraph_id":"para_329"},{"text":"(f)","paragraph_id":"para_330"},{"text":"the protection of judicial independence and judicial proceedings;","paragraph_id":"para_331"},{"text":"(g)","paragraph_id":"para_332"},{"text":"the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;","paragraph_id":"para_333"},{"text":"(h)","paragraph_id":"para_334"},{"text":"a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);","paragraph_id":"para_335"},{"text":"(i)","paragraph_id":"para_336"},{"text":"the protection of the data subject or the rights and freedoms of others;","paragraph_id":"para_337"},{"text":"(j)","paragraph_id":"para_338"},{"text":"the enforcement of civil law claims.","paragraph_id":"para_339"},{"text":"2.   In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:","paragraph_id":"para_340"},{"text":"(a)","paragraph_id":"para_341"},{"text":"the purposes of the processing or categories of processing;","paragraph_id":"para_342"},{"text":"(b)","paragraph_id":"para_343"},{"text":"the categories of personal data;","paragraph_id":"para_344"},{"text":"(c)","paragraph_id":"para_345"},{"text":"the scope of the restrictions introduced;","paragraph_id":"para_346"},{"text":"(d)","paragraph_id":"para_347"},{"text":"the safeguards to prevent abuse or unlawful access or transfer;","paragraph_id":"para_348"},{"text":"(e)","paragraph_id":"para_349"},{"text":"the specification of the controller or categories of controllers;","paragraph_id":"para_350"},{"text":"(f)","paragraph_id":"para_351"},{"text":"the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;","paragraph_id":"para_352"},{"text":"(g)","paragraph_id":"para_353"},{"text":"the risks to the rights and freedoms of data subjects; and","paragraph_id":"para_354"},{"text":"(h)","paragraph_id":"para_355"},{"text":"the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.’","paragraph_id":"para_356"},{"text":"28","paragraph_id":"para_357"},{"text":"Under Article 79(1) of that regulation:","paragraph_id":"para_358","court_paragraph":28},{"text":"‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’","paragraph_id":"para_359"},{"text":"29","paragraph_id":"para_360"},{"text":"Article 94 of Regulation 2016/679 provides:","paragraph_id":"para_361","court_paragraph":29},{"text":"‘1.   Directive [95/46] is repealed with effect from 25 May 2018.","paragraph_id":"para_362"},{"text":"2.   References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive [95/46] shall be construed as references to the European Data Protection Board established by this Regulation.’","paragraph_id":"para_363"},{"text":"30","paragraph_id":"para_364"},{"text":"Article 95 of that regulation provides:","paragraph_id":"para_365","court_paragraph":30},{"text":"‘This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive [2002/58].’","paragraph_id":"para_366"},{"text":"French law","paragraph_id":"para_367"},{"text":"Code de la sécurité intérieure (Internal Security Code)","paragraph_id":"para_368"},{"text":"31","paragraph_id":"para_369"},{"text":"Book VIII of the legislative part of the code de la sécurité intérieure (Internal Security Code; ‘the CSI’) lays down rules relating to intelligence in Articles L. 801‑1 to L. 898‑1.","paragraph_id":"para_370","court_paragraph":31},{"text":"32","paragraph_id":"para_371"},{"text":"Article L. 811‑3 of the CSI states:","paragraph_id":"para_372","court_paragraph":32},{"text":"‘For the sole performance of their respective tasks, the specialised intelligence services may use the techniques referred to in Title V of this Book in order to gather intelligence relating to the protection and promotion of the following fundamental State interests:","paragraph_id":"para_373"},{"text":"1.","paragraph_id":"para_374"},{"text":"National independence, territorial integrity and national defence;","paragraph_id":"para_375"},{"text":"2.","paragraph_id":"para_376"},{"text":"Major foreign policy interests, the implementation of France’s European and international commitments and the prevention of all forms of foreign interference;","paragraph_id":"para_377"},{"text":"3.","paragraph_id":"para_378"},{"text":"France’s major economic, industrial and scientific interests;","paragraph_id":"para_379"},{"text":"4.","paragraph_id":"para_380"},{"text":"The prevention of terrorism;","paragraph_id":"para_381"},{"text":"5.","paragraph_id":"para_382"},{"text":"The prevention of:","paragraph_id":"para_383"},{"text":"(a)","paragraph_id":"para_384"},{"text":"attacks against the republican nature of the institutions;","paragraph_id":"para_385"},{"text":"(b)","paragraph_id":"para_386"},{"text":"actions designed to maintain or rebuild groups that have been disbanded under Article L. 212‑1;","paragraph_id":"para_387"},{"text":"(c)","paragraph_id":"para_388"},{"text":"collective violence liable to cause serious disruption to the maintenance of law and order;","paragraph_id":"para_389"},{"text":"6.","paragraph_id":"para_390"},{"text":"The prevention of organised crime;","paragraph_id":"para_391"},{"text":"7.","paragraph_id":"para_392"},{"text":"The prevention of the proliferation of weapons of mass destruction.’","paragraph_id":"para_393"},{"text":"33","paragraph_id":"para_394"},{"text":"Article L. 811‑4 of the CSI provides:","paragraph_id":"para_395","court_paragraph":33},{"text":"‘A decree adopted in the Conseil d’État (Council of State, France) following consultation of the Commission nationale de contrôle des techniques de renseignement (Commission for the Oversight of Intelligence Techniques, France) shall designate the services, other than the specialised intelligence se …","paragraph_id":"para_396"},{"text":"34","paragraph_id":"para_397"},{"text":"The first paragraph of Article L. 821‑1 of the CSI is worded as follows:","paragraph_id":"para_398","court_paragraph":34},{"text":"‘The implementation on national territory of the intelligence gathering techniques referred to in Chapters I to IV of Title V of this Book shall be subject to prior authorisation from the Prime Minister following consultation of the Commission for the Oversight of Intelligence Techniques.’","paragraph_id":"para_399"},{"text":"35","paragraph_id":"para_400"},{"text":"Article L. 821‑2 of the CSI provides:","paragraph_id":"para_401","court_paragraph":35},{"text":"‘The authorisation mentioned in Article L. 821‑1 shall be issued upon a written and reasoned application from the Minister for Defence, the Minister for the Interior, the Minister for Justice or the ministers responsible for economic affairs, the budget or customs. Each minister may delegate that power individually only to immediate staff with clearance to handle confidential material relating to national defence.","paragraph_id":"para_402"},{"text":"The application shall state:","paragraph_id":"para_403"},{"text":"1. the technique(s) to be implemented;","paragraph_id":"para_404"},{"text":"2. the service for which it is submitted;","paragraph_id":"para_405"},{"text":"3. the purpose(s) pursued;","paragraph_id":"para_406"},{"text":"4. the reason(s) for the measures;","paragraph_id":"para_407"},{"text":"5. the period of validity of the authorisation;","paragraph_id":"para_408"},{"text":"6. the person(s), place(s) or vehicle(s) concerned.","paragraph_id":"para_409"},{"text":"In respect of point 6, persons whose identity is not known may be designated by their identifiers or status and places or vehicles may be designated by reference to the persons who are the subject of the application.","paragraph_id":"para_410"},{"text":"…’","paragraph_id":"para_411"},{"text":"36","paragraph_id":"para_412"},{"text":"Under the first paragraph of Article L. 821‑3 of the CSI:","paragraph_id":"para_413","court_paragraph":36},{"text":"‘The application shall be sent to the President or, failing that, to one of the members of the Commission for the Oversight of Intelligence Techniques mentioned in points 2 and 3 of Article L. 831‑1, who shall provide the Prime Minister with an opinion within 24 hours. If the application is examined by the select panel or the full panel of the Commission, the Prime Minister shall be informed forthwith and the opinion shall be issued within 72 hours.’","paragraph_id":"para_414"},{"text":"37","paragraph_id":"para_415"},{"text":"Article L. 821‑4 of the CSI provides:","paragraph_id":"para_416","court_paragraph":37},{"text":"‘Authorisation to implement the techniques referred to in Chapters I to IV of Title V of this Book shall be issued by the Prime Minister for a maximum period of four months. … The authorisation shall contain the grounds and statements set out in points 1 to 6 of Article L. 821‑2. All authorisations shall be renewable under the same conditions as those laid down in this Chapter.","paragraph_id":"para_417"},{"text":"Where the authorisation is issued after obtaining an unfavourable opinion from the Commission for the Oversight of Intelligence Techniques, it shall state the reasons why that opinion was not followed.","paragraph_id":"para_418"},{"text":"…’","paragraph_id":"para_419"},{"text":"38","paragraph_id":"para_420"},{"text":"Article L. 833‑4 of the CSI, which appears in Chapter III of Title III, provides:","paragraph_id":"para_421","court_paragraph":38},{"text":"‘The Commission shall – on its own initiative or after receiving a complaint from any person wishing to verify that no intelligence techniques have been unlawfully implemented against him or her – conduct a review of the technique or techniques referred to with a view to determining whether they hav …","paragraph_id":"para_422"},{"text":"39","paragraph_id":"para_423"},{"text":"The first and second paragraphs of Article L. 841‑1 of the CSI read as follows:","paragraph_id":"para_424","court_paragraph":39},{"text":"‘Subject to the special provisions set out in Article L. 854‑9 of this Code, the Conseil d’État (Council of State, France) shall have jurisdiction to hear, under the conditions laid down in Chapter III bis of Title VII of Book VII of the code de justice administrative (Code of Administrative Justice), actions concerning the implementation of the intelligence techniques referred to in Title V of this Book.","paragraph_id":"para_425"},{"text":"An action may be brought before it by:","paragraph_id":"para_426"},{"text":"1. any person wishing to verify that no intelligence techniques have been unlawfully implemented against him or her and who can demonstrate that the procedure provided for in Article L. 833‑4 has been conducted beforehand;","paragraph_id":"para_427"},{"text":"2. the Commission for the Oversight of Intelligence Techniques, under the conditions laid down in Article L. 833‑8.’","paragraph_id":"para_428"},{"text":"40","paragraph_id":"para_429"},{"text":"Title V of Book VIII of the legislative part of the CSI, concerning ‘intelligence gathering techniques subject to authorisation’, includes, inter alia, Chapter I, headed ‘Access of the administrative authorities to connection data’, containing Articles L. 851‑1 to L. 851‑7 of the CSI.","paragraph_id":"para_430","court_paragraph":40},{"text":"41","paragraph_id":"para_431"},{"text":"Article L. 851‑1 of the CSI provides:","paragraph_id":"para_432","court_paragraph":41},{"text":"‘Subject to the conditions laid down in Chapter I of Title II of this Book, the collection of information or documents processed or retained by their networks or electronic communications services, including technical data relating to the identification of the subscription or connection numbers to e …","paragraph_id":"para_433"},{"text":"By way of derogation from Article L. 821‑2, written and reasoned applications for technical data relating to the identification of subscription or connection numbers to electronic communications services, or the inventorying of all the subscription or connection numbers of a specified person, shall …","paragraph_id":"para_434"},{"text":"A department reporting to the Prime Minister shall be responsible for gathering information or documents from the operators and persons referred to in the first paragraph of this article. The Commission for the Oversight of Intelligence Techniques shall have permanent, complete, direct and immediate access to the information or documents collected.","paragraph_id":"para_435"},{"text":"The detailed rules for the application of this article shall be laid down by decree adopted in the Conseil d’État (Council of State, France) following consultation of the Commission nationale de l’informatique et des libertés (Data Protection Authority, France) and the Commission for the Oversight of Intelligence Techniques.’","paragraph_id":"para_436"},{"text":"42","paragraph_id":"para_437"},{"text":"Article L. 851‑2 of the CSI provides:","paragraph_id":"para_438","court_paragraph":42},{"text":"‘I. Under the conditions laid down in Chapter I of Title II of this Book, and for the sole purpose of preventing terrorism, the collection in real time, on the networks of the operators and persons referred to in Article L. 851‑1, of the information or documents referred to in that article relating …","paragraph_id":"para_439"},{"text":"I bis. The maximum number of authorisations issued under this article in force at the same time shall be determined by the Prime Minister following consultation of the Commission for the Oversight of Intelligence Techniques. The decision establishing that quota and how it is to be allocated between the ministers referred to in the first paragraph of Article L. 821‑2, together with the number of interception authorisations issued, shall be forwarded to the Commission.","paragraph_id":"para_440"},{"text":"…’","paragraph_id":"para_441"},{"text":"43","paragraph_id":"para_442"},{"text":"Article L. 851‑3 of the CSI provides:","paragraph_id":"para_443","court_paragraph":43},{"text":"‘I. Under the conditions laid down in Chapter I of Title II of this Book, and for the sole purpose of preventing terrorism, the operators and persons referred to in Article L. 851‑1 may be required to implement on their networks automated data processing practices designed, within the parameters laid down in the authorisation, to detect links that might constitute a terrorist threat.","paragraph_id":"para_444"},{"text":"Such automated processing shall exclusively use the information or documents referred to in Article L. 851‑1 and shall not collect any data other than data meeting the design parameters or allow the identification of the persons to whom the information or documents relate.","paragraph_id":"para_445"},{"text":"In accordance with the principle of proportionality, the authorisation of the Prime Minister shall specify the technical scope of the implementation of those processing practices.","paragraph_id":"para_446"},{"text":"II. The Commission for the Oversight of Intelligence Techniques shall issue an opinion on the application for authorisation for automated processing and the chosen detection parameters. It shall have permanent, complete and direct access to those processing practices and to the information and data collected. It shall be informed of any changes to the processing practices and parameters and may issue recommendations.","paragraph_id":"para_447"},{"text":"The first authorisation for the implementation of automated processing practices provided for in point I of this article shall be issued for a period of two months. The authorisation shall be renewable under the conditions on duration laid down in Chapter I of Title II of this Book. The application for renewal shall include a record of the number of identifiers flagged by the automated processing and an analysis of the relevance of that flagging.","paragraph_id":"para_448"},{"text":"III. The conditions laid down in Article L. 871‑6 are applicable to the physical operations performed by the operators and persons referred to in Article L. 851‑1 for the purpose of implementing such processing.","paragraph_id":"para_449"},{"text":"IV. Where the processing practices mentioned in point I of this article detect data likely to point to the existence of a terrorist threat, the Prime Minister or one of the persons delegated by him or her may – following consultation of the Commission for the Oversight of Intelligence Techniques und …","paragraph_id":"para_450"},{"text":"…’","paragraph_id":"para_451"},{"text":"44","paragraph_id":"para_452"},{"text":"Article L. 851‑4 of the CSI reads as follows:","paragraph_id":"para_453","court_paragraph":44},{"text":"‘Under the conditions laid down in Chapter I of Title II of this Book, technical data relating to the location of the terminal equipment used, as mentioned in Article L. 851‑1, may be collected upon request from the network and transmitted in real time by the operators to a department reporting to the Prime Minister.’","paragraph_id":"para_454"},{"text":"45","paragraph_id":"para_455"},{"text":"Article R. 851‑5 of the CSI, which appears in the regulatory part of that code, provides:","paragraph_id":"para_456","court_paragraph":45},{"text":"‘I. The information or documents referred to in Article L. 851‑1 are – excluding the content of the correspondence or the information consulted – as follows:","paragraph_id":"para_457"},{"text":"1. Those listed in Articles R. 10‑13 and R. 10‑14 of the [CPCE] and in Article 1 of Decree [No 2011‑219];","paragraph_id":"para_458"},{"text":"2. Technical data other than the data mentioned in point 1:","paragraph_id":"para_459"},{"text":"(a) enabling terminal equipment to be located;","paragraph_id":"para_460"},{"text":"(b) relating to access by terminal equipment to online public communication networks or services;","paragraph_id":"para_461"},{"text":"(c) relating to the conveyance of electronic communications by networks;","paragraph_id":"para_462"},{"text":"(d) relating to the identification and authentication of a user, a connection, a network or an online public communication service;","paragraph_id":"para_463"},{"text":"(e) relating to the characteristics of terminal equipment and the configuration data of their software.","paragraph_id":"para_464"},{"text":"II. Only the information and documents referred to in point I(1) may be collected pursuant to Article L. 851‑1. Such collection shall take place in non-real time.","paragraph_id":"para_465"},{"text":"The information listed in point I(2) may be collected only pursuant to Articles L. 851‑2 and L. 851‑3 under the conditions and within the limits laid down in those articles and subject to the application of Article R. 851‑9.’","paragraph_id":"para_466"},{"text":"The CPCE","paragraph_id":"para_467"},{"text":"46","paragraph_id":"para_468"},{"text":"Article L. 34‑1 of the CPCE states:","paragraph_id":"para_469","court_paragraph":46},{"text":"‘I. This article shall apply to the processing of personal data in the course of the provision to the public of electronic communications services; it shall apply in particular to networks that support data collection and identification devices.","paragraph_id":"para_470"},{"text":"II. Electronic communications operators, in particular persons whose business is to provide access to online public communication services, shall erase or render anonymous any data relating to traffic, subject to the provisions contained in points III, IV, V and VI.","paragraph_id":"para_471"},{"text":"Persons who provide electronic communications services to the public shall, with due regard for the provisions contained in the preceding paragraph, establish internal procedures for responding to requests from the competent authorities.","paragraph_id":"para_472"},{"text":"Persons who, as a principal or ancillary business activity, provide to the public a connection allowing online communication via access to the network shall, including where this is offered free of charge, be subject to compliance with the provisions applicable to electronic communications operators under this article.","paragraph_id":"para_473"},{"text":"III. For the purposes of investigating, detecting and prosecuting criminal offences or a failure to fulfil an obligation laid down in Article L. 336‑3 of the code de la propriété intellectuelle (Intellectual Property Code) or for the purposes of preventing breaches of automated data processing syste …","paragraph_id":"para_474"},{"text":"…","paragraph_id":"para_475"},{"text":"VI. Data retained and processed under the conditions set out in points III, IV and V shall relate exclusively to the identification of persons using the services provided by operators, the technical characteristics of the communications provided by the latter and the location of terminal equipment.","paragraph_id":"para_476"},{"text":"Under no circumstance may such data relate to the content of the correspondence or the information consulted, in any form whatsoever, as part of those communications.","paragraph_id":"para_477"},{"text":"The retention and processing of such data shall be effected with due regard for the provisions of loi n o  78‑17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (Law No 78‑17 of 6 January 1978 on information technology, files and freedoms).","paragraph_id":"para_478"},{"text":"Operators shall take any measures necessary to prevent such data from being used for purposes other than those provided for in this article.’","paragraph_id":"para_479"},{"text":"47","paragraph_id":"para_480"},{"text":"Article R. 10‑13 of the CPCE reads as follows:","paragraph_id":"para_481","court_paragraph":47},{"text":"‘I. Pursuant to point III of Article L. 34‑1, electronic communications operators shall retain the following data for the purposes of investigating, detecting and prosecuting criminal offences:","paragraph_id":"para_482"},{"text":"(a) Information identifying the user;","paragraph_id":"para_483"},{"text":"(b) Data relating to the communications terminal equipment used;","paragraph_id":"para_484"},{"text":"(c) The technical characteristics and date, time and duration of each communication;","paragraph_id":"para_485"},{"text":"(d) Data relating to the additional services requested or used and the providers of those services;","paragraph_id":"para_486"},{"text":"(e) Data identifying the addressee or addressees of the communication.","paragraph_id":"para_487"},{"text":"II. In the case of telephony activities, the operator shall retain the data referred to in point II and, additionally, data enabling the origin and location of the communication to be identified.","paragraph_id":"para_488"},{"text":"III. The data referred to in this article shall be retained for one year from the date of registration.","paragraph_id":"para_489"},{"text":"IV. Identifiable and specific additional costs borne by operators which have been ordered by judicial authorities to provide data falling within the categories mentioned in this article shall be offset in accordance with the methods laid down in Article R. 213‑1 of the code de procédure pénale (Code of Criminal Procedure).’","paragraph_id":"para_490"},{"text":"48","paragraph_id":"para_491"},{"text":"Article R. 10‑14 of the CPCE provides:","paragraph_id":"para_492","court_paragraph":48},{"text":"‘I. Pursuant to point IV of Article L. 34‑1, electronic communications operators are authorised to retain technical data identifying the user and the data mentioned in Article R. 10‑13(I)(b), (c) and (d) for the purposes of their billing and payment operations.","paragraph_id":"para_493"},{"text":"II. In the case of telephony activities, operators may retain, in addition to the data mentioned in point I, technical data relating to the location of the communication and the identification of the addressee or addressees of the communication and data for billing purposes.","paragraph_id":"para_494"},{"text":"III. The data mentioned in points I and II of this article may be retained only if it is necessary for billing purposes and for the payment of services rendered. Its retention shall be limited to the time strictly necessary for that purpose and shall not exceed one year.","paragraph_id":"para_495"},{"text":"IV. Operators may retain the following data for a period not exceeding three months to ensure the security of networks and facilities:","paragraph_id":"para_496"},{"text":"(a) Data identifying the origin of the communication;","paragraph_id":"para_497"},{"text":"(b) The technical characteristics and date, time and duration of each communication;","paragraph_id":"para_498"},{"text":"(c) Technical data identifying the addressee or addressees of the communication;","paragraph_id":"para_499"},{"text":"(d) Data relating to the additional services requested or used and the providers of those services.’","paragraph_id":"para_500"},{"text":"Loi n o  2004‑575 du 21 juin 2004 pour la confiance dans l’économie numérique (Law No 2004‑575 of 21 June 2004 to promote trust in the digital economy)","paragraph_id":"para_501"},{"text":"49","paragraph_id":"para_502"},{"text":"Article 6 of Loi n o  2004‑575 du 21 juin 2004 pour la confiance dans l’économie numérique (Law No 2004‑575 of 21 June 2004 to promote trust in the digital economy) (JORF of 22 June 2004, p. 11168; ‘the LCEN’) provides:","paragraph_id":"para_503","court_paragraph":49},{"text":"‘I.   1. Persons whose business is to provide access to online public communication services shall inform their subscribers of the existence of technical tools enabling access to some services to be restricted or for a selection of those services to be made and shall offer them at least one of those tools.","paragraph_id":"para_504"},{"text":"…","paragraph_id":"para_505"},{"text":"2.   Natural or legal persons who, even free of charge, and for provision to the public via online public communications services, store signals, writing, images, sounds or messages of any kind provided by recipients of those services, may not incur any civil liability for the activities or informat …","paragraph_id":"para_506"},{"text":"…","paragraph_id":"para_507"},{"text":"II. The persons referred to in point I(1) and (2) shall keep and retain the data in such a way as to make it possible to identify anyone who has assisted in the creation of all or part of the content of the services of which they are the providers.","paragraph_id":"para_508"},{"text":"They shall provide persons who publish an online public communication service with technical tools enabling them to satisfy the identification conditions laid down in point III.","paragraph_id":"para_509"},{"text":"A judicial authority may require the service providers mentioned in point I(1) and (2) to communicate the data referred to in the first paragraph.","paragraph_id":"para_510"},{"text":"The provisions of Articles 226‑17, 226‑21 and 226‑22 of the Criminal Code shall apply to the processing of that data.","paragraph_id":"para_511"},{"text":"A decree adopted in the Conseil d’État (Council of State, France) following consultation of the Data Protection Authority shall define the data referred to in the first paragraph and determine the period for which, and the methods by which, that data is to be retained.","paragraph_id":"para_512"},{"text":"…’","paragraph_id":"para_513"},{"text":"Decree No 2011‑219","paragraph_id":"para_514"},{"text":"50","paragraph_id":"para_515"},{"text":"Chapter I of Decree No 2011‑219, adopted on the basis of the last paragraph of Article 6(II) of the LCEN, contains Articles 1 to 4 of that decree.","paragraph_id":"para_516","court_paragraph":50},{"text":"51","paragraph_id":"para_517"},{"text":"Article 1 of Decree No 2011‑219 provides:","paragraph_id":"para_518","court_paragraph":51},{"text":"‘The following data is the data referred to in Article 6(II) of the [LCEN], which persons are required to retain under that provision:","paragraph_id":"para_519"},{"text":"1. For the persons referred to in point I(1) of that article and for each connection of their subscribers:","paragraph_id":"para_520"},{"text":"(a)","paragraph_id":"para_521"},{"text":"The connection identifier;","paragraph_id":"para_522"},{"text":"(b)","paragraph_id":"para_523"},{"text":"The identifier assigned by those persons to the subscriber;","paragraph_id":"para_524"},{"text":"(c)","paragraph_id":"para_525"},{"text":"The identifier of the terminal used for the connection when they have access to it;","paragraph_id":"para_526"},{"text":"(d)","paragraph_id":"para_527"},{"text":"The date and time of the start and end of the connection;","paragraph_id":"para_528"},{"text":"(e)","paragraph_id":"para_529"},{"text":"The characteristics of the subscriber’s line.","paragraph_id":"para_530"},{"text":"2. For the persons referred to in point I(2) of that article and for each creation operation:","paragraph_id":"para_531"},{"text":"(a)","paragraph_id":"para_532"},{"text":"The identifier of the connection giving rise to the communication;","paragraph_id":"para_533"},{"text":"(b)","paragraph_id":"para_534"},{"text":"The identifier assigned by the information system to the content forming the subject of the operation;","paragraph_id":"para_535"},{"text":"(c)","paragraph_id":"para_536"},{"text":"The types of protocols used to connect to the service and transfer the content;","paragraph_id":"para_537"},{"text":"(d)","paragraph_id":"para_538"},{"text":"The nature of the operation;","paragraph_id":"para_539"},{"text":"(e)","paragraph_id":"para_540"},{"text":"The date and time of the operation;","paragraph_id":"para_541"},{"text":"(f)","paragraph_id":"para_542"},{"text":"The identifier used by the author of the operation where provided by the author.","paragraph_id":"para_543"},{"text":"3. For the persons referred to in point I(1) and (2) of that article, the information provided by a user when signing up to a contract or creating an account:","paragraph_id":"para_544"},{"text":"(a)","paragraph_id":"para_545"},{"text":"The identifier of the connection at the time when the account was created;","paragraph_id":"para_546"},{"text":"(b)","paragraph_id":"para_547"},{"text":"The first name and surname or business name;","paragraph_id":"para_548"},{"text":"(c)","paragraph_id":"para_549"},{"text":"The associated postal addresses;","paragraph_id":"para_550"},{"text":"(d)","paragraph_id":"para_551"},{"text":"The pseudonyms used;","paragraph_id":"para_552"},{"text":"(e)","paragraph_id":"para_553"},{"text":"The associated email or account addresses;","paragraph_id":"para_554"},{"text":"(f)","paragraph_id":"para_555"},{"text":"The telephone numbers;","paragraph_id":"para_556"},{"text":"(g)","paragraph_id":"para_557"},{"text":"The updated password and the data for verifying or changing it.","paragraph_id":"para_558"},{"text":"4. For the persons referred to in point I(1) and (2) of that article, where the signing up to the contract or the account is subject to payment, the following information relating to the payment, for each payment operation:","paragraph_id":"para_559"},{"text":"(a)","paragraph_id":"para_560"},{"text":"The type of payment used;","paragraph_id":"para_561"},{"text":"(b)","paragraph_id":"para_562"},{"text":"The payment reference;","paragraph_id":"para_563"},{"text":"(c)","paragraph_id":"para_564"},{"text":"The amount;","paragraph_id":"para_565"},{"text":"(d)","paragraph_id":"para_566"},{"text":"The date and time of the transaction.","paragraph_id":"para_567"},{"text":"The data mentioned in points 3 and 4 shall be retained only to the extent that the persons ordinarily collect such data.’","paragraph_id":"para_568"},{"text":"52","paragraph_id":"para_569"},{"text":"Article 2 of that decree reads as follows:","paragraph_id":"para_570","court_paragraph":52},{"text":"‘Contributing to the creation of content involves the following operations:","paragraph_id":"para_571"},{"text":"(a)","paragraph_id":"para_572"},{"text":"Initial content creation;","paragraph_id":"para_573"},{"text":"(b)","paragraph_id":"para_574"},{"text":"Changes to content and content-related data;","paragraph_id":"para_575"},{"text":"(c)","paragraph_id":"para_576"},{"text":"Content erasure.’","paragraph_id":"para_577"},{"text":"53","paragraph_id":"para_578"},{"text":"Article 3 of that decree provides:","paragraph_id":"para_579","court_paragraph":53},{"text":"‘The data referred to in Article 1 shall be retained for one year from the date of:","paragraph_id":"para_580"},{"text":"(a)","paragraph_id":"para_581"},{"text":"creation of the content, for each operation contributing to the creation of content as defined in Article 2, as regards the data mentioned in points 1 and 2;","paragraph_id":"para_582"},{"text":"(b)","paragraph_id":"para_583"},{"text":"termination of the contract or closure of the account, as regards the data mentioned in point 3;","paragraph_id":"para_584"},{"text":"(c)","paragraph_id":"para_585"},{"text":"issue of the bill or the payment operation, for each bill or payment operation, as regards the data mentioned in point 4.’","paragraph_id":"para_586"},{"text":"Belgian law","paragraph_id":"para_587"},{"text":"54","paragraph_id":"para_588"},{"text":"The Law of 29 May 2016 amended, in particular, the loi du 13 juin 2005 relative aux communications électroniques (Law of 13 June 2005 on electronic communications) ( Moniteur belge of 20 June 2005, p. 28070; ‘the Law of 13 June 2005’), the code d’instruction criminelle (Code of Criminal Procedure) a …","paragraph_id":"para_589","court_paragraph":54},{"text":"55","paragraph_id":"para_590"},{"text":"Article 126 of the Law of 13 June 2005, as amended by the Law of 29 May 2016, provides:","paragraph_id":"para_591","court_paragraph":55},{"text":"‘1.   Without prejudice to the Loi du 8 décembre 1992 relative à la protection de la vie privée à l’égard des traitements de données à caractère personnel (Law of 8 December 1992 on the protection of privacy with respect to the processing of personal data), providers to the public of telephony servi …","paragraph_id":"para_592"},{"text":"This article shall not concern the content of communications.","paragraph_id":"para_593"},{"text":"The obligation to retain the data referred to in paragraph 3 shall also apply to unsuccessful call attempts, provided that that data is, in the course of providing the communications services concerned:","paragraph_id":"para_594"},{"text":"(1) generated or processed by operators of publicly available electronic communications services or of a public electronic communications network, so far as concerns telephony data, or","paragraph_id":"para_595"},{"text":"(2) logged by those providers, so far as concerns Internet data.","paragraph_id":"para_596"},{"text":"2.   Data retained under this article may be obtained, by simple request, from the providers and operators referred to in the first subparagraph of paragraph 1, for the purposes and under the conditions listed below, only by the following authorities:","paragraph_id":"para_597"},{"text":"(1) judicial authorities, with a view to the investigation, detection and prosecution of offences, in order to execute the measures referred to in Articles 46bis and 88bis of the Code of Criminal Procedure and under the conditions laid down in those articles;","paragraph_id":"para_598"},{"text":"(2) under the conditions laid down in this law, intelligence and security services, in order to carry out intelligence missions employing the data-gathering methods referred to in Articles 16/2, 18/7 and 18/8 of the Basic Law of 30 November 1998 on the intelligence and security services;","paragraph_id":"para_599"},{"text":"(3) any judicial police officer attached to the [Institut belge des services postaux et des télécommunications (Belgian Institute for Postal Services and Telecommunications)], with a view to the investigation, detection and prosecution of offences contrary to Articles 114 and 124 and this article;","paragraph_id":"para_600"},{"text":"(4) emergency services providing on-site assistance, in the case where, after having received an emergency call, they cannot obtain from the provider or operator concerned the data identifying the person having made the emergency call using the database referred to in the third subparagraph of Article 107(2), or obtain incomplete or incorrect data. Only the data identifying the caller may be requested and the request must be made no later than 24 hours after the call;","paragraph_id":"para_601"},{"text":"(5) any judicial police officer attached to the Missing Persons Unit of the Federal Police, in the course of his or her task of providing assistance to persons in danger, searching for persons whose disappearance is a cause for concern and in cases where there are serious presumptions or indications …","paragraph_id":"para_602"},{"text":"(6) the Telecommunications Ombudsman, with a view to identifying a person who has misused an electronic communications network or service, in accordance with the conditions laid down in Article 43bis(3)(7) of the loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques (Law of 21 March 1991 on the reform of certain public commercial undertakings). Only the identification data may be requested.","paragraph_id":"para_603"},{"text":"The providers and operators referred to in the first subparagraph of paragraph 1 shall ensure that the data referred to in paragraph 3 are accessible without restriction from Belgium and that that data and any other necessary information concerning that data may be transmitted without delay and only to the authorities referred to in this paragraph.","paragraph_id":"para_604"},{"text":"Without prejudice to other legal provisions, the providers and operators referred to in the first subparagraph of paragraph 1 may not use the data retained under paragraph 3 for any other purposes.","paragraph_id":"para_605"},{"text":"3.   Data that can be used to identify the user or subscriber and the means of communication, other than the data specifically provided for in the second and third subparagraphs, shall be retained for 12 months as from the date on which communication was last able to be made using the service employed.","paragraph_id":"para_606"},{"text":"Data relating to the terminal devices’ access and connection to the network and the service, and to the location of those devices, including the network termination point, shall be retained for 12 months as from the date of the communication.","paragraph_id":"para_607"},{"text":"Communication data other than content, including the origin and destination thereof, shall be retained for 12 months as from the date of the communication.","paragraph_id":"para_608"},{"text":"The King shall, by decree deliberated in the Council of Ministers and on a proposal from the Minister for Justice and the Minister [with responsibility for matters relating to electronic communications], and after obtaining the opinion of the Committee for the Protection of Privacy and the Institute, determine the data to be retained by category type as referred to in the first to third subparagraphs and the requirements which that data must satisfy.","paragraph_id":"para_609"},{"text":"…’","paragraph_id":"para_610"},{"text":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_611"},{"text":"Case C‑511/18","paragraph_id":"para_612"},{"text":"56","paragraph_id":"para_613"},{"text":"By applications lodged on 30 November 2015 and 16 March 2016, joined in the main proceedings, La Quadrature du Net, French Data Network, the Fédération des fournisseurs d’accès à Internet associatifs and Igwan.net brought actions before the Conseil d’État (Council of State, France) for the annulment …","paragraph_id":"para_614","court_paragraph":56},{"text":"57","paragraph_id":"para_615"},{"text":"As regards, in particular, the pleas alleging infringement of Directive 2000/31, the referring court states that the provisions of Article L. 851‑3 of the CSI require electronic communications operators and technical service providers to ‘implement on their networks automated data processing practic …","paragraph_id":"para_616","court_paragraph":57},{"text":"58","paragraph_id":"para_617"},{"text":"As regards the pleas alleging infringement of Directive 2002/58, the referring court considers that it follows, inter alia, from the provisions of that directive and from the judgment of 21 December 2016, Tele2 Sverige and Watson and Others ( C‑203/15 and C‑698/15 , EU:C:2016:970 ; ‘ Tele2 ’), that …","paragraph_id":"para_618","court_paragraph":58},{"text":"59","paragraph_id":"para_619"},{"text":"The referring court concludes from this that both the obligation to retain data resulting from Article L. 851‑1 of the CSI and the access of the administrative authorities to that data, including real-time access, provided for in Articles L. 851‑1, L. 851‑2 and L. 851‑4 of that code, fall within the …","paragraph_id":"para_620","court_paragraph":59},{"text":"60","paragraph_id":"para_621"},{"text":"On the other hand, the referring court takes the view that the scope of Directive 2002/58 does not extend to the provisions of the CSI referred to in the applications for annulment which relate to intelligence gathering techniques applied directly by the State, but do not regulate the activities of …","paragraph_id":"para_622","court_paragraph":60},{"text":"61","paragraph_id":"para_623"},{"text":"Thus, with a view to settling the disputes concerning the lawfulness of Decrees No 2015‑1185, No 2015‑1211, No 2015‑1639 and No 2016‑67 in the light of Directive 2002/58, in so far as they were adopted to implement Articles L. 851‑1 to L. 851‑4 of the CSI, three questions on the interpretation of EU law arise.","paragraph_id":"para_624","court_paragraph":61},{"text":"62","paragraph_id":"para_625"},{"text":"As regards the interpretation of Article 15(1) of Directive 2002/58, the referring court is uncertain, in the first place, whether a general and indiscriminate retention obligation, imposed on providers of electronic communications services on the basis of Articles L. 851‑1 and R. 851‑5 of the CSI, …","paragraph_id":"para_626","court_paragraph":62},{"text":"63","paragraph_id":"para_627"},{"text":"As regards, in the second place, the other obligations which may be imposed on providers of electronic communications services, the referring court states that the provisions of Article L. 851‑2 of the CSI permit, for the sole purpose of preventing terrorism, the collection of the information or doc …","paragraph_id":"para_628","court_paragraph":63},{"text":"64","paragraph_id":"para_629"},{"text":"The referring court considers that both general and indiscriminate retention and real-time access to connection data are of unparalleled operational usefulness, against a background of serious and persistent threats to national security, in particular the terrorist threat. General and indiscriminate …","paragraph_id":"para_630","court_paragraph":64},{"text":"65","paragraph_id":"para_631"},{"text":"Furthermore, the technique provided for in Article L. 851‑3 of the CSI makes it possible to detect, on the basis of criteria specifically defined for that purpose, those individuals whose conduct may, in view of their methods of communication, constitute a terrorist threat.","paragraph_id":"para_632","court_paragraph":65},{"text":"66","paragraph_id":"para_633"},{"text":"In the third place, as regards access by the competent authorities to retained data, the referring court is unsure whether Directive 2002/58, read in the light of the Charter, is to be interpreted as meaning that it is a prerequisite for the lawfulness of the procedures for the collection of connect …","paragraph_id":"para_634","court_paragraph":66},{"text":"67","paragraph_id":"para_635"},{"text":"As regards those other procedural safeguards, the referring court states in particular that any person wishing to verify that no intelligence techniques have been unlawfully implemented against him or her may bring the matter before a specialist panel of the Conseil d’État (Council of State, France) …","paragraph_id":"para_636","court_paragraph":67},{"text":"68","paragraph_id":"para_637"},{"text":"It is on that basis that the Conseil d’État (Council of State, France) decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:","paragraph_id":"para_638","court_paragraph":68},{"text":"‘(1)","paragraph_id":"para_639"},{"text":"Is the general and indiscriminate retention obligation imposed on providers on the basis of the implementing provisions of Article 15(1) of [Directive 2002/58] to be regarded, against a background of serious and persistent threats to national security, and in particular the terrorist threat, as inte …","paragraph_id":"para_640"},{"text":"(2)","paragraph_id":"para_641"},{"text":"Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as authorising legislative measures, such as the measures for the real-time collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data?","paragraph_id":"para_642"},{"text":"(3)","paragraph_id":"para_643"},{"text":"Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as meaning that it is a prerequisite for the lawfulness of the procedures for the collection of connection data that the data subjects are informed whenever their being so informed is no longer liable to jeopardise the inv …","paragraph_id":"para_644"},{"text":"Case C‑512/18","paragraph_id":"para_645"},{"text":"69","paragraph_id":"para_646"},{"text":"By application lodged on 1 September 2015, French Data Network, La Quadrature du Net and the Fédération des fournisseurs d’accès à Internet associatifs brought an action before the Conseil d’État (Council of State, France) for the annulment of the implied rejection decision arising from the Prime Mi …","paragraph_id":"para_647","court_paragraph":69},{"text":"70","paragraph_id":"para_648"},{"text":"As regards Article R. 10‑13 of the CPCE and the obligation of general and indiscriminate retention of communications data laid down therein, the referring court, which raises similar considerations to those in Case C‑511/18, observes that such retention allows a judicial authority to access data rel …","paragraph_id":"para_649","court_paragraph":70},{"text":"71","paragraph_id":"para_650"},{"text":"As regards Decree No 2011‑219, the referring court considers that Article 6(II) of the LCEN, which imposes an obligation to hold and retain only data relating to the creation of content, does not fall within the scope of Directive 2002/58 since that directive’s scope is limited, in accordance with A …","paragraph_id":"para_651","court_paragraph":71},{"text":"72","paragraph_id":"para_652"},{"text":"The referring court considers, however, that it follows from Article 15(1) and (2) of Directive 2000/31 that the directive does not establish a prohibition in principle on retaining data relating to the creation of content, from which derogation would be possible only by way of exception. Thus, the …","paragraph_id":"para_653","court_paragraph":72},{"text":"73","paragraph_id":"para_654"},{"text":"It is on that basis that the Conseil d’État (Council of State, France) decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:","paragraph_id":"para_655","court_paragraph":73},{"text":"‘(1)","paragraph_id":"para_656"},{"text":"Is the general and indiscriminate retention obligation imposed on providers on the basis of the implementing provisions of Article 15(1) of [Directive 2002/58] to be regarded, inter alia in the light of the safeguards and checks to which the collection and use of such connection data are then subjec …","paragraph_id":"para_657"},{"text":"(2)","paragraph_id":"para_658"},{"text":"Are the provisions of [Directive 2000/31], read in the light of Articles 6, 7, 8 and 11 and Article 52(1) of the [Charter], to be interpreted as allowing a State to introduce national legislation requiring the persons, whose activity consists in offering access to online public communications servic …","paragraph_id":"para_659"},{"text":"Case C‑520/18","paragraph_id":"para_660"},{"text":"74","paragraph_id":"para_661"},{"text":"By applications lodged on 10, 16, 17 and 18 January 2017, joined in the main proceedings, the Ordre des barreaux francophones et germanophone, the Académie Fiscale ASBL and UA, the Liga voor Mensenrechten ASBL, the Ligue des Droits de l’Homme ASBL, and VZ, WY and XX brought actions before the Cour c …","paragraph_id":"para_662","court_paragraph":74},{"text":"75","paragraph_id":"para_663"},{"text":"In support of their actions, the applicants in the main proceedings submit, in essence, that the Law of 29 May 2016 is unlawful because, among other things, it goes beyond what is strictly necessary and does not lay down adequate guarantees of protection. In particular, neither its provisions relati …","paragraph_id":"para_664","court_paragraph":75},{"text":"76","paragraph_id":"para_665"},{"text":"The referring court observes that the data which must be retained by providers of telephony services, including via the Internet, Internet access and Internet-based email and by operators providing public electronic communications networks, under the Law of 29 May 2016, is identical to that listed i …","paragraph_id":"para_666","court_paragraph":76},{"text":"77","paragraph_id":"para_667"},{"text":"The referring court also states that subparagraphs 1 and 2 of Article 126(2) of the Law of 13 June 2005, as amended by the Law of 29 May 2016, lay down the conditions under which, respectively, judicial authorities and the intelligence and security services may obtain access to retained data, and co …","paragraph_id":"para_668","court_paragraph":77},{"text":"78","paragraph_id":"para_669"},{"text":"Lastly, the referring court states that the Law of 29 May 2016 seeks to ensure an effective criminal investigation and effective penalties in cases involving the sexual abuse of minors and to make it possible to identify the perpetrator of such an offence, even where electronic communications system …","paragraph_id":"para_670","court_paragraph":78},{"text":"79","paragraph_id":"para_671"},{"text":"It is on that basis that the Cour constitutionnelle (Constitutional Court, Belgium) decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:","paragraph_id":"para_672","court_paragraph":79},{"text":"‘(1)","paragraph_id":"para_673"},{"text":"Must Article 15(1) of [Directive 2002/58], read in conjunction with the right to security, guaranteed by Article 6 of the [Charter], and the right to respect for personal data, as guaranteed by Articles 7, 8 and 52(1) of the [Charter], be interpreted as precluding national legislation such as that a …","paragraph_id":"para_674"},{"text":"(2)","paragraph_id":"para_675"},{"text":"Must Article 15(1) of [Directive 2002/58], in conjunction with Articles 4, 7, 8, 11 and 52(1) of the [Charter], be interpreted as precluding national legislation such as that at issue, which lays down a general obligation for operators and providers of electronic communications services to retain th …","paragraph_id":"para_676"},{"text":"(3)","paragraph_id":"para_677"},{"text":"If, on the basis of the answer to the first or the second question, the Cour constitutionnelle (Constitutional Court, Belgium) should conclude that the contested law fails to fulfil one or more obligations arising under the provisions referred to in these questions, might it maintain on a temporary …","paragraph_id":"para_678"},{"text":"Procedure before the Court","paragraph_id":"para_679"},{"text":"80","paragraph_id":"para_680"},{"text":"By decision of the President of the Court of 25 September 2018, Cases C‑511/18 and C‑512/18 were joined for the purposes of the written and oral parts of the procedure and the judgment. Case C‑520/18 was joined to those cases by decision of the President of the Court of 9 July 2020 for the purposes of the judgment.","paragraph_id":"para_681","court_paragraph":80},{"text":"Consideration of the questions referred","paragraph_id":"para_682"},{"text":"Question 1 in Cases C‑511/18 and C‑512/18 and questions 1 and 2 in Case C‑520/18","paragraph_id":"para_683"},{"text":"81","paragraph_id":"para_684"},{"text":"By question 1 in Cases C‑511/18 and C‑512/18 and questions 1 and 2 in Case C‑520/18, which should be considered together, the referring courts essentially ask whether Article 15(1) of Directive 2002/58 must be interpreted as precluding national legislation which imposes on providers of electronic communications services, for the purposes set out in Article 15(1), an obligation requiring the general and indiscriminate retention of traffic and location data.","paragraph_id":"para_685","court_paragraph":81},{"text":"Preliminary remarks","paragraph_id":"para_686"},{"text":"82","paragraph_id":"para_687"},{"text":"It is apparent from the documents available to the Court that the legislation at issue in the main proceedings covers all electronic communications systems and applies to all users of such systems, without distinction or exception. Furthermore, the data which must be retained by providers of electro …","paragraph_id":"para_688","court_paragraph":82},{"text":"83","paragraph_id":"para_689"},{"text":"Thus, the data which must, under the national legislation at issue in the main proceedings, be retained for a period of one year makes it possible, inter alia, to identify the person with whom the user of an electronic communications system has communicated and by what means, to determine the date, …","paragraph_id":"para_690","court_paragraph":83},{"text":"84","paragraph_id":"para_691"},{"text":"As for the aims pursued, it should be noted that the legislation at issue in Cases C‑511/18 and C‑512/18 pursues, among other aims, the investigation, detection and prosecution of criminal offences in general; national independence, territorial integrity and national defence; major foreign policy in …","paragraph_id":"para_692","court_paragraph":84},{"text":"85","paragraph_id":"para_693"},{"text":"The referring courts are uncertain, in particular, as to the possible impact of the right to security enshrined in Article 6 of the Charter on the interpretation of Article 15(1) of Directive 2002/58. Similarly, they ask whether the interference with the fundamental rights enshrined in Articles 7 an …","paragraph_id":"para_694","court_paragraph":85},{"text":"86","paragraph_id":"para_695"},{"text":"While both the Conseil d’État (Council of State, France) and the Cour constitutionnelle (Constitutional Court, Belgium) start from the premiss that the respective national legislation at issue in the main proceedings, which governs the retention of traffic and location data and access to that data b …","paragraph_id":"para_696","court_paragraph":86},{"text":"Scope of Directive 2002/58","paragraph_id":"para_697"},{"text":"87","paragraph_id":"para_698"},{"text":"La Quadrature du Net, the Fédération des fournisseurs d’accès à Internet associatifs, Igwan.net, Privacy International and the Center for Democracy and Technology rely on the Court’s case-law on the scope of Directive 2002/58 to argue, in essence, that both the retention of data and access to retain …","paragraph_id":"para_699","court_paragraph":87},{"text":"88","paragraph_id":"para_700"},{"text":"As regards the intelligence measures implemented directly by the competent French authorities, without regulating the activities of providers of electronic communications services by imposing specific obligations on them, the Center for Democracy and Technology observes that those measures necessari …","paragraph_id":"para_701","court_paragraph":88},{"text":"89","paragraph_id":"para_702"},{"text":"On the other hand, the Czech and Estonian Governments, Ireland, and the French, Cypriot, Hungarian, Polish, Swedish and United Kingdom Governments submit, in essence, that Directive 2002/58 does not apply to national legislation such as that at issue in the main proceedings, since the purpose of tha …","paragraph_id":"para_703","court_paragraph":89},{"text":"90","paragraph_id":"para_704"},{"text":"Those governments and Ireland also refer to Article 1(3) of Directive 2002/58, which excludes from the scope of that directive, as the first indent of Article 3(2) of Directive 95/46 did in the past, activities concerning public security, defence and State security. They rely in that regard on the interpretation of the latter provision set out in the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 ).","paragraph_id":"para_705","court_paragraph":90},{"text":"91","paragraph_id":"para_706"},{"text":"In that regard, it should be stated that, under Article 1(1) thereof, Directive 2002/58 provides, inter alia, for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communications sector.","paragraph_id":"para_707","court_paragraph":91},{"text":"92","paragraph_id":"para_708"},{"text":"Article 1(3) of that directive excludes from its scope ‘activities of the State’ in specified fields, including activities of the State in areas of criminal law and in the areas of public security, defence and State security, including the economic well-being of the State when the activities relate …","paragraph_id":"para_709","court_paragraph":92},{"text":"93","paragraph_id":"para_710"},{"text":"In addition, Article 3 of Directive 2002/58 states that that directive is to apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the European Union, including public communications net …","paragraph_id":"para_711","court_paragraph":93},{"text":"94","paragraph_id":"para_712"},{"text":"In that context, Article 15(1) of Directive 2002/58 states that Member States may adopt, subject to the conditions laid down, ‘legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of [that directive]’ (judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15 , EU:C:2016:970 , paragraph  71 ).","paragraph_id":"para_713","court_paragraph":94},{"text":"95","paragraph_id":"para_714"},{"text":"Article 15(1) of Directive 2002/58 necessarily presupposes that the national legislative measures referred to therein fall within the scope of that directive, since it expressly authorises the Member States to adopt them only if the conditions laid down in the directive are met. Further, such measur …","paragraph_id":"para_715","court_paragraph":95},{"text":"96","paragraph_id":"para_716"},{"text":"It is in the light of, inter alia, those considerations that the Court has held that Article 15(1) of Directive 2002/58, read in conjunction with Article 3 thereof, must be interpreted as meaning that the scope of that directive extends not only to a legislative measure that requires providers of el …","paragraph_id":"para_717","court_paragraph":96},{"text":"97","paragraph_id":"para_718"},{"text":"In addition, having regard to the considerations set out in paragraph 95 above and the general scheme of Directive 2002/58, an interpretation of that directive under which the legislative measures referred to in Article 15(1) thereof were excluded from the scope of that directive because the objecti …","paragraph_id":"para_719","court_paragraph":97},{"text":"98","paragraph_id":"para_720"},{"text":"The concept of ‘activities’ referred to in Article 1(3) of Directive 2002/58 cannot therefore, as was noted, in essence, by the Advocate General in point 75 of his Opinion in Joined Cases La Quadrature du Net and Others ( C‑511/18 and C‑512/18 , EU:C:2020:6 ), be interpreted as covering the legislative measures referred to in Article 15(1) of that directive.","paragraph_id":"para_721","court_paragraph":98},{"text":"99","paragraph_id":"para_722"},{"text":"Article 4(2) TEU, to which the governments listed in paragraph 89 of the present judgment have made reference, cannot invalidate that conclusion. Indeed, according to the Court’s settled case-law, although it is for the Member States to define their essential security interests and to adopt appropri …","paragraph_id":"para_723","court_paragraph":99},{"text":"100","paragraph_id":"para_724"},{"text":"It is true that, in the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 , paragraphs  56 to  59 ), the Court held that the transfer of personal data by airlines to the public authorities of a third country for the purpose of preventing and combati …","paragraph_id":"para_725","court_paragraph":100},{"text":"101","paragraph_id":"para_726"},{"text":"However, having regard to the considerations set out in paragraphs 93, 95 and 96 of the present judgment, that case-law cannot be transposed to the interpretation of Article 1(3) of Directive 2002/58. Indeed, as the Advocate General noted, in essence, in points 70 to 72 of his Opinion in Joined Case …","paragraph_id":"para_727","court_paragraph":101},{"text":"102","paragraph_id":"para_728"},{"text":"Furthermore, it should be noted that Directive 95/46, which was at issue in the case that gave rise to the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 ), has been, pursuant to Article 94(1) of Regulation 2016/679, repealed and replaced by that …","paragraph_id":"para_729","court_paragraph":102},{"text":"103","paragraph_id":"para_730"},{"text":"By contrast, where the Member States directly implement measures that derogate from the rule that electronic communications are to be confidential, without imposing processing obligations on providers of electronic communications services, the protection of the data of the persons concerned is cover …","paragraph_id":"para_731","court_paragraph":103},{"text":"104","paragraph_id":"para_732"},{"text":"It follows from the foregoing considerations that national legislation which requires providers of electronic communications services to retain traffic and location data for the purposes of protecting national security and combating crime, such as the legislation at issue in the main proceedings, falls within the scope of Directive 2002/58.","paragraph_id":"para_733","court_paragraph":104},{"text":"Interpretation of Article 15(1) of Directive 2002/58","paragraph_id":"para_734"},{"text":"105","paragraph_id":"para_735"},{"text":"It should be noted, as a preliminary point, that it is settled case-law that, in interpreting a provision of EU law, it is necessary not only to refer to its wording but also to consider its context and the objectives of the legislation of which it forms part, and in particular the origin of that legislation (see, to that effect, judgment of 17 April 2018, Egenberger, C‑414/16 , EU:C:2018:257 , paragraph  44 ).","paragraph_id":"para_736","court_paragraph":105},{"text":"106","paragraph_id":"para_737"},{"text":"As is apparent from, inter alia, recitals 6 and 7 thereof, the purpose of Directive 2002/58 is to protect users of electronic communications services from risks for their personal data and privacy resulting from new technologies and, in particular, from the increasing capacity for automated storage …","paragraph_id":"para_738","court_paragraph":106},{"text":"107","paragraph_id":"para_739"},{"text":"To that end, Article 5(1) of Directive 2002/58 enshrines the principle of confidentiality of both electronic communications and the related traffic data and requires, inter alia, that, in principle, persons other than users be prohibited from storing, without those users’ consent, those communications and that data.","paragraph_id":"para_740","court_paragraph":107},{"text":"108","paragraph_id":"para_741"},{"text":"As regards, in particular, the processing and storage of traffic data by providers of electronic communications services, it is apparent from Article 6 and recitals 22 and 26 of Directive 2002/58 that such processing is permitted only to the extent necessary and for the time necessary for the market …","paragraph_id":"para_742","court_paragraph":108},{"text":"109","paragraph_id":"para_743"},{"text":"Thus, in adopting that directive, the EU legislature gave concrete expression to the rights enshrined in Articles 7 and 8 of the Charter, so that the users of electronic communications services are entitled to expect, in principle, that their communications and data relating thereto will remain anonymous and may not be recorded, unless they have agreed otherwise.","paragraph_id":"para_744","court_paragraph":109},{"text":"110","paragraph_id":"para_745"},{"text":"However, Article 15(1) of Directive 2002/58 enables the Member States to introduce exceptions to the obligation of principle, laid down in Article 5(1) of that directive, to ensure the confidentiality of personal data, and to the corresponding obligations, referred to, inter alia, in Articles 6 and …","paragraph_id":"para_746","court_paragraph":110},{"text":"111","paragraph_id":"para_747"},{"text":"That being said, the option to derogate from the rights and obligations laid down in Articles 5, 6 and 9 of Directive 2002/58 cannot permit the exception to the obligation of principle to ensure the confidentiality of electronic communications and data relating thereto and, in particular, to the pro …","paragraph_id":"para_748","court_paragraph":111},{"text":"112","paragraph_id":"para_749"},{"text":"As regards the objectives that are capable of justifying a limitation of the rights and obligations laid down, in particular, in Articles 5, 6 and 9 of Directive 2002/58, the Court has previously held that the list of objectives set out in the first sentence of Article 15(1) of that directive is exh …","paragraph_id":"para_750","court_paragraph":112},{"text":"113","paragraph_id":"para_751"},{"text":"In addition, it is apparent from the third sentence of Article 15(1) of Directive 2002/58 that the Member States are not permitted to adopt legislative measures to restrict the scope of the rights and obligations provided for in Articles 5, 6 and 9 of that directive unless they do so in accordance w …","paragraph_id":"para_752","court_paragraph":113},{"text":"114","paragraph_id":"para_753"},{"text":"Thus, the interpretation of Article 15(1) of Directive 2002/58 must take account of the importance both of the right to privacy, guaranteed in Article 7 of the Charter, and of the right to protection of personal data, guaranteed in Article 8 thereof, as derived from the case-law of the Court, as wel …","paragraph_id":"para_754","court_paragraph":114},{"text":"115","paragraph_id":"para_755"},{"text":"It should be made clear, in that regard, that the retention of traffic and location data constitutes, in itself, on the one hand, a derogation from the prohibition laid down in Article 5(1) of Directive 2002/58 barring any person other than the users from storing that data, and, on the other, an int …","paragraph_id":"para_756","court_paragraph":115},{"text":"116","paragraph_id":"para_757"},{"text":"Whether or not the retained data has been used subsequently is also irrelevant (see, by analogy, as regards Article 8 of the ECHR, ECtHR, 16 February 2000, Amann v. Switzerland , CE:ECHR:2000:0216JUD002779895, § 69, and 13 February 2020, Trajkovski and Chipovski v. North Macedonia , CE:ECHR:2020:021 …","paragraph_id":"para_758","court_paragraph":116},{"text":"117","paragraph_id":"para_759"},{"text":"That conclusion is all the more justified since traffic and location data may reveal information on a significant number of aspects of the private life of the persons concerned, including sensitive information such as sexual orientation, political opinions, religious, philosophical, societal or othe …","paragraph_id":"para_760","court_paragraph":117},{"text":"118","paragraph_id":"para_761"},{"text":"Therefore, first, the retention of traffic and location data for policing purposes is liable, in itself, to infringe the right to respect for communications, enshrined in Article 7 of the Charter, and to deter users of electronic communications systems from exercising their freedom of expression, gu …","paragraph_id":"para_762","court_paragraph":118},{"text":"119","paragraph_id":"para_763"},{"text":"Second, in view of the significant quantity of traffic and location data that may be continuously retained under a general and indiscriminate retention measure, as well as the sensitive nature of the information that may be gleaned from that data, the mere retention of such data by providers of electronic communications services entails a risk of abuse and unlawful access.","paragraph_id":"para_764","court_paragraph":119},{"text":"120","paragraph_id":"para_765"},{"text":"That being said, in so far as Article 15(1) of Directive 2002/58 allows Member States to introduce the derogations referred to in paragraph 110 above, that provision reflects the fact that the rights enshrined in Articles 7, 8 and 11 of the Charter are not absolute rights, but must be considered in …","paragraph_id":"para_766","court_paragraph":120},{"text":"121","paragraph_id":"para_767"},{"text":"Indeed, as can be seen from Article 52(1) of the Charter, that provision allows limitations to be placed on the exercise of those rights, provided that those limitations are provided for by law, that they respect the essence of those rights and that, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.","paragraph_id":"para_768","court_paragraph":121},{"text":"122","paragraph_id":"para_769"},{"text":"Thus, in order to interpret Article 15(1) of Directive 2002/58 in the light of the Charter, account must also be taken of the importance of the rights enshrined in Articles 3, 4, 6 and 7 of the Charter and of the importance of the objectives of protecting national security and combating serious crime in contributing to the protection of the rights and freedoms of others.","paragraph_id":"para_770","court_paragraph":122},{"text":"123","paragraph_id":"para_771"},{"text":"In that regard, Article 6 of the Charter, to which the Conseil d’État (Council of State, France) and the Cour constitutionnelle (Constitutional Court, Belgium) refer, lays down the right of every individual not only to liberty but also to security and guarantees rights corresponding to those guarant …","paragraph_id":"para_772","court_paragraph":123},{"text":"124","paragraph_id":"para_773"},{"text":"In addition, it should be recalled that Article 52(3) of the Charter is intended to ensure the necessary consistency between the rights contained in the Charter and the corresponding rights guaranteed in the ECHR, without adversely affecting the autonomy of EU law and that of the Court of Justice of …","paragraph_id":"para_774","court_paragraph":124},{"text":"125","paragraph_id":"para_775"},{"text":"Article 5 of the ECHR, which enshrines the ‘right to liberty’ and the ‘right to security’, is intended, according to the case-law of the European Court of Human Rights, to ensure that individuals are protected from arbitrary or unjustified deprivations of liberty (see, to that effect, ECtHR, 18 Marc …","paragraph_id":"para_776","court_paragraph":125},{"text":"126","paragraph_id":"para_777"},{"text":"On the other hand, as regards, in particular, effective action to combat criminal offences committed against, inter alia, minors and other vulnerable persons, mentioned by the Cour constitutionnelle (Constitutional Court, Belgium), it should be pointed out that positive obligations of the public aut …","paragraph_id":"para_778","court_paragraph":126},{"text":"127","paragraph_id":"para_779"},{"text":"It is against the backdrop of those different positive obligations that the Court must strike a balance between the various interests and rights at issue.","paragraph_id":"para_780","court_paragraph":127},{"text":"128","paragraph_id":"para_781"},{"text":"The European Court of Human Rights has held that the positive obligations flowing from Articles 3 and 8 of the ECHR, whose corresponding safeguards are set out in Articles 4 and 7 of the Charter, require, in particular, the adoption of substantive and procedural provisions as well as practical measu …","paragraph_id":"para_782","court_paragraph":128},{"text":"129","paragraph_id":"para_783"},{"text":"Concerning observance of the principle of proportionality, the first sentence of Article 15(1) of Directive 2002/58 provides that the Member States may adopt a measure derogating from the principle that communications and the related traffic data are to be confidential where such a measure is ‘neces …","paragraph_id":"para_784","court_paragraph":129},{"text":"130","paragraph_id":"para_785"},{"text":"In that regard, it should be borne in mind that the protection of the fundamental right to privacy requires, according to the settled case-law of the Court, that derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary. In addition, an ob …","paragraph_id":"para_786","court_paragraph":130},{"text":"131","paragraph_id":"para_787"},{"text":"Specifically, it follows from the Court’s case-law that the question whether the Member States may justify a limitation on the rights and obligations laid down, inter alia, in Articles 5, 6 and 9 of Directive 2002/58 must be assessed by measuring the seriousness of the interference entailed by such …","paragraph_id":"para_788","court_paragraph":131},{"text":"132","paragraph_id":"para_789"},{"text":"In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will …","paragraph_id":"para_790","court_paragraph":132},{"text":"133","paragraph_id":"para_791"},{"text":"Thus, legislation requiring the retention of personal data must always meet objective criteria that establish a connection between the data to be retained and the objective pursued (see, to that effect, Opinion 1/15 ( EU-Canada PNR Agreement ) of 26 July 2017, EU:C:2017:592 , paragraph  191 and the case-law cited, and judgment of 3 October 2019, A and Others, C‑70/18 , EU:C:2019:823 , paragraph  63 ).","paragraph_id":"para_792","court_paragraph":133},{"text":"–  Legislative measures providing for the preventive retention of traffic and location data for the purpose of safeguarding national security","paragraph_id":"para_793"},{"text":"134","paragraph_id":"para_794"},{"text":"It should be observed that the objective of safeguarding national security, mentioned by the referring courts and the governments which submitted observations, has not yet been specifically examined by the Court in its judgments interpreting Directive 2002/58.","paragraph_id":"para_795","court_paragraph":134},{"text":"135","paragraph_id":"para_796"},{"text":"In that regard, it should be noted, at the outset, that Article 4(2) TEU provides that national security remains the sole responsibility of each Member State. That responsibility corresponds to the primary interest in protecting the essential functions of the State and the fundamental interests of s …","paragraph_id":"para_797","court_paragraph":135},{"text":"136","paragraph_id":"para_798"},{"text":"The importance of the objective of safeguarding national security, read in the light of Article 4(2) TEU, goes beyond that of the other objectives referred to in Article 15(1) of Directive 2002/58, inter alia the objectives of combating crime in general, even serious crime, and of safeguarding publi …","paragraph_id":"para_799","court_paragraph":136},{"text":"137","paragraph_id":"para_800"},{"text":"Thus, in situations such as those described in paragraphs 135 and 136 of the present judgment, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not, in principle, preclude a legislative measure which permits the competent authoritie …","paragraph_id":"para_801","court_paragraph":137},{"text":"138","paragraph_id":"para_802"},{"text":"The instruction for the preventive retention of data of all users of electronic communications systems must, however, be limited in time to what is strictly necessary. Although it is conceivable that an instruction requiring providers of electronic communications services to retain data may, owing t …","paragraph_id":"para_803","court_paragraph":138},{"text":"139","paragraph_id":"para_804"},{"text":"In view of the seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter resulting from a measure involving the general and indiscriminate retention of data, it must be ensured that recourse to such a measure is in fact limited to situations in which th …","paragraph_id":"para_805","court_paragraph":139},{"text":"–  Legislative measures providing for the preventive retention of traffic and location data for the purposes of combating crime and safeguarding public security","paragraph_id":"para_806"},{"text":"140","paragraph_id":"para_807"},{"text":"As regards the objective of preventing, investigating, detecting and prosecuting criminal offences, in accordance with the principle of proportionality, only action to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with …","paragraph_id":"para_808","court_paragraph":140},{"text":"141","paragraph_id":"para_809"},{"text":"National legislation providing for the general and indiscriminate retention of traffic and location data for the purpose of combating serious crime exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society, as required by Article 15(1) of …","paragraph_id":"para_810","court_paragraph":141},{"text":"142","paragraph_id":"para_811"},{"text":"In view of the sensitive nature of the information that traffic and location data may provide, the confidentiality of that data is essential for the right to respect for private life. Thus, having regard, first, to the deterrent effect on the exercise of the fundamental rights enshrined in Articles …","paragraph_id":"para_812","court_paragraph":142},{"text":"143","paragraph_id":"para_813"},{"text":"In addition, the Court has emphasised that legislation providing for the general and indiscriminate retention of traffic and location data covers the electronic communications of practically the entire population without any differentiation, limitation or exception being made in the light of the obj …","paragraph_id":"para_814","court_paragraph":143},{"text":"144","paragraph_id":"para_815"},{"text":"In particular, as the Court has previously held, such legislation is not restricted to retention in relation to (i) data pertaining to a time period and/or geographical area and/or a group of persons likely to be involved, in one way or another, in a serious crime, or (ii) persons who could, for oth …","paragraph_id":"para_816","court_paragraph":144},{"text":"145","paragraph_id":"para_817"},{"text":"Even the positive obligations of the Member States which may arise, depending on the circumstances, from Articles 3, 4 and 7 of the Charter and relating, as pointed out in paragraphs 126 and 128 of the present judgment, to the establishment of rules to facilitate effective action to combat criminal …","paragraph_id":"para_818","court_paragraph":145},{"text":"146","paragraph_id":"para_819"},{"text":"By contrast, in accordance with what has been stated in paragraphs 142 to 144 of the present judgment, and having regard to the balance that must be struck between the rights and interests at issue, the objectives of combating serious crime, preventing serious attacks on public security and, a forti …","paragraph_id":"para_820","court_paragraph":146},{"text":"147","paragraph_id":"para_821"},{"text":"Thus, as the Court has previously held, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data f …","paragraph_id":"para_822","court_paragraph":147},{"text":"148","paragraph_id":"para_823"},{"text":"As regards the limits to which such a data retention measure must be subject, these may, in particular, be determined according to the categories of persons concerned, since Article 15(1) of Directive 2002/58 does not preclude legislation based on objective evidence which makes it possible to target …","paragraph_id":"para_824","court_paragraph":148},{"text":"149","paragraph_id":"para_825"},{"text":"In that regard, it must be made clear that the persons thus targeted may, in particular, be persons who have been identified beforehand, in the course of the applicable national procedures and on the basis of objective evidence, as posing a threat to public or national security in the Member State concerned.","paragraph_id":"para_826","court_paragraph":149},{"text":"150","paragraph_id":"para_827"},{"text":"The limits on a measure providing for the retention of traffic and location data may also be set using a geographical criterion where the competent national authorities consider, on the basis of objective and non-discriminatory factors, that there exists, in one or more geographical areas, a situati …","paragraph_id":"para_828","court_paragraph":150},{"text":"151","paragraph_id":"para_829"},{"text":"In order to ensure that the interference entailed by the targeted retention measures described in paragraphs 147 to 150 of the present judgment complies with the principle of proportionality, their duration must not exceed what is strictly necessary in the light of the objective pursued and the circumstances justifying them, without prejudice to the possibility of extending those measures should such retention continue to be necessary.","paragraph_id":"para_830","court_paragraph":151},{"text":"–  Legislative measures providing for the preventive retention of IP addresses and data relating to civil identity for the purposes of combating crime and safeguarding public security","paragraph_id":"para_831"},{"text":"152","paragraph_id":"para_832"},{"text":"It should be noted that although IP addresses are part of traffic data, they are generated independently of any particular communication and mainly serve to identify, through providers of electronic communications services, the natural person who owns the terminal equipment from which an Internet co …","paragraph_id":"para_833","court_paragraph":152},{"text":"153","paragraph_id":"para_834"},{"text":"However, since IP addresses may be used, among other things, to track an Internet user’s complete clickstream and, therefore, his or her entire online activity, that data enables a detailed profile of the user to be produced. Thus, the retention and analysis of those IP addresses which is required f …","paragraph_id":"para_835","court_paragraph":153},{"text":"154","paragraph_id":"para_836"},{"text":"In order to strike a balance between the rights and interests at issue as required by the case-law cited in paragraph 130 of the present judgment, account must be taken of the fact that, where an offence is committed online, the IP address might be the only means of investigation enabling the person …","paragraph_id":"para_837","court_paragraph":154},{"text":"155","paragraph_id":"para_838"},{"text":"In those circumstances, while it is true that a legislative measure providing for the retention of the IP addresses of all natural persons who own terminal equipment permitting access to the Internet would catch persons who at first sight have no connection, within the meaning of the case-law cited …","paragraph_id":"para_839","court_paragraph":155},{"text":"156","paragraph_id":"para_840"},{"text":"In the light of the seriousness of the interference entailed by that retention with the fundamental rights enshrined in Articles 7 and 8 of the Charter, only action to combat serious crime, the prevention of serious threats to public security and the safeguarding of national security are capable of …","paragraph_id":"para_841","court_paragraph":156},{"text":"157","paragraph_id":"para_842"},{"text":"Concerning, last, data relating to the civil identity of users of electronic communications systems, that data does not, in itself, make it possible to ascertain the date, time, duration and recipients of the communications made, or the locations where those communications took place or their freque …","paragraph_id":"para_843","court_paragraph":157},{"text":"158","paragraph_id":"para_844"},{"text":"It follows that, in accordance with what has been stated in paragraph 140 of the present judgment, legislative measures concerning the processing of that data as such, including the retention of and access to that data solely for the purpose of identifying the user concerned, and without it being po …","paragraph_id":"para_845","court_paragraph":158},{"text":"159","paragraph_id":"para_846"},{"text":"In those circumstances, having regard to the balance that must be struck between the rights and interests at issue, and for the reasons set out in paragraphs 131 and 158 of the present judgment, it must be held that, even in the absence of a connection between all users of electronic communications …","paragraph_id":"para_847","court_paragraph":159},{"text":"–  Legislative measures providing for the expedited retention of traffic and location data for the purpose of combating serious crime","paragraph_id":"para_848"},{"text":"160","paragraph_id":"para_849"},{"text":"With regard to traffic and location data processed and stored by providers of electronic communications services on the basis of Articles 5, 6 and 9 of Directive 2002/58 or on the basis of legislative measures taken under Article 15(1) of that directive, as described in paragraphs 134 to 159 of the …","paragraph_id":"para_850","court_paragraph":160},{"text":"161","paragraph_id":"para_851"},{"text":"However, during that processing and storage, situations may arise in which it becomes necessary to retain that data after those time periods have ended in order to shed light on serious criminal offences or acts adversely affecting national security; this is the case both in situations where those o …","paragraph_id":"para_852","court_paragraph":161},{"text":"162","paragraph_id":"para_853"},{"text":"In that regard, the Council of Europe’s Convention on Cybercrime of 23 November 2001 (European Treaty Series – No. 185), which was signed by the 27 Member States and ratified by 25 of them and has as its objective to facilitate the fight against criminal offences committed using computer networks, p …","paragraph_id":"para_854","court_paragraph":162},{"text":"163","paragraph_id":"para_855"},{"text":"In a situation such as the one described in paragraph 161 of the present judgment, in the light of the balance that must be struck between the rights and interests at issue referred to in paragraph 130 of the present judgment, it is permissible for Member States to provide, in legislation adopted pu …","paragraph_id":"para_856","court_paragraph":163},{"text":"164","paragraph_id":"para_857"},{"text":"To the extent that the purpose of such expedited retention no longer corresponds to the purpose for which that data was initially collected and retained and since any processing of data must, under Article 8(2) of the Charter, be consistent with specified purposes, Member States must make clear, in …","paragraph_id":"para_858","court_paragraph":164},{"text":"165","paragraph_id":"para_859"},{"text":"In that regard, such expedited retention need not be limited to the data of persons specifically suspected of having committed a criminal offence or acts adversely affecting national security. While it must comply with the framework established by Article 15(1) of Directive 2002/58, read in the ligh …","paragraph_id":"para_860","court_paragraph":165},{"text":"166","paragraph_id":"para_861"},{"text":"It should also be added that, as is clear, in particular, from paragraphs 115 and 133 above, access to traffic and location data retained by providers in accordance with a measure taken under Article 15(1) of Directive 2002/58 may, in principle, be justified only by the public interest objective for …","paragraph_id":"para_862","court_paragraph":166},{"text":"167","paragraph_id":"para_863"},{"text":"In that regard, it is permissible for Member States to specify in their legislation that access to traffic and location data may, subject to those same substantive and procedural conditions, be permitted for the purpose of combating serious crime or safeguarding national security where that data is retained by a provider in a manner that is consistent with Articles 5, 6 and 9 or Article 15(1) of Directive 2002/58.","paragraph_id":"para_864","court_paragraph":167},{"text":"168","paragraph_id":"para_865"},{"text":"In the light of all of the above considerations, the answer to question 1 in Cases C‑511/18 and C‑512/18 and questions 1 and 2 in Case C‑520/18 is that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding le …","paragraph_id":"para_866","court_paragraph":168},{"text":"–","paragraph_id":"para_867"},{"text":"allow, for the purposes of safeguarding national security, recourse to an instruction requiring providers of electronic communications services to retain, generally and indiscriminately, traffic and location data in situations where the Member State concerned is confronted with a serious threat to n …","paragraph_id":"para_868"},{"text":"–","paragraph_id":"para_869"},{"text":"provide, for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security, for the targeted retention of traffic and location data which is limited, on the basis of objective and non-discriminatory factors, according to the categories of persons concerned or using a geographical criterion, for a period that is limited in time to what is strictly necessary, but which may be extended;","paragraph_id":"para_870"},{"text":"–","paragraph_id":"para_871"},{"text":"provide, for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security, for the general and indiscriminate retention of IP addresses assigned to the source of an Internet connection for a period that is limited in time to what is strictly necessary;","paragraph_id":"para_872"},{"text":"–","paragraph_id":"para_873"},{"text":"provide, for the purposes of safeguarding national security, combating crime and safeguarding public security, for the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems;","paragraph_id":"para_874"},{"text":"–","paragraph_id":"para_875"},{"text":"allow, for the purposes of combating serious crime and, a fortiori, safeguarding national security, recourse to an instruction requiring providers of electronic communications services, by means of a decision of the competent authority that is subject to effective judicial review, to undertake, for a specified period of time, the expedited retention of traffic and location data in the possession of those service providers,","paragraph_id":"para_876"},{"text":"provided that those measures ensure, by means of clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.","paragraph_id":"para_877"},{"text":"Questions 2 and 3 in Case C‑511/18","paragraph_id":"para_878"},{"text":"169","paragraph_id":"para_879"},{"text":"By questions 2 and 3 in Case C‑511/18, the referring court asks, in essence, whether Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which requires providers of electronic communica …","paragraph_id":"para_880","court_paragraph":169},{"text":"170","paragraph_id":"para_881"},{"text":"The referring court notes that the intelligence gathering techniques provided for in Articles L. 851‑2 to L. 851‑4 of the CSI do not impose on providers of electronic communications services a specific obligation to retain traffic and location data. With regard, in particular, to the automated analy …","paragraph_id":"para_882","court_paragraph":170},{"text":"171","paragraph_id":"para_883"},{"text":"As a preliminary point, it should be noted that the fact that, according to Article L. 851‑3 of the CSI, the automated analysis that it provides for does not, as such, allow the users whose data is being analysed to be identified, does not prevent such data from being classified as ‘personal data’. …","paragraph_id":"para_884","court_paragraph":171},{"text":"Automated analysis of traffic and location data","paragraph_id":"para_885"},{"text":"172","paragraph_id":"para_886"},{"text":"It is clear from Article L. 851‑3 of the CSI that the automated analysis for which it provides corresponds, in essence, to a screening of all the traffic and location data retained by providers of electronic communications services, which is carried out by those providers at the request of the compe …","paragraph_id":"para_887","court_paragraph":172},{"text":"173","paragraph_id":"para_888"},{"text":"National legislation authorising such automated analysis of traffic and location data derogates from the obligation of principle, established in Article 5 of Directive 2002/58, to ensure the confidentiality of electronic communications and related data. Such legislation also constitutes interference …","paragraph_id":"para_889","court_paragraph":173},{"text":"174","paragraph_id":"para_890"},{"text":"Moreover, the interference resulting from the automated analysis of traffic and location data, such as that at issue in the main proceedings, is particularly serious since it covers, generally and indiscriminately, the data of persons using electronic communication systems. That finding is all the m …","paragraph_id":"para_891","court_paragraph":174},{"text":"175","paragraph_id":"para_892"},{"text":"With regard to the justification for such interference, the requirement, established in Article 52(1) of the Charter, that any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits that interference with those rights must itself defin …","paragraph_id":"para_893","court_paragraph":175},{"text":"176","paragraph_id":"para_894"},{"text":"In addition, in order to meet the requirement of proportionality recalled in paragraphs 130 and 131 of the present judgment, according to which derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary, national legislation governing the a …","paragraph_id":"para_895","court_paragraph":176},{"text":"177","paragraph_id":"para_896"},{"text":"In that regard, it should be noted that the particularly serious interference that is constituted by the general and indiscriminate retention of traffic and location data, as referred to in the findings in paragraphs 134 to 139 of the present judgment, and the particularly serious interference const …","paragraph_id":"para_897","court_paragraph":177},{"text":"178","paragraph_id":"para_898"},{"text":"In situations such as those referred to in the previous paragraph, the implementation of automated analysis of the traffic and location data of all users of electronic communications systems, for a strictly limited period, may be considered to be justified in the light of the requirements stemming from Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter.","paragraph_id":"para_899","court_paragraph":178},{"text":"179","paragraph_id":"para_900"},{"text":"That being said, in order to guarantee that such a measure is actually limited to what is strictly necessary in order to protect national security and, more particularly, to prevent terrorism, in accordance with what was held in paragraph 139 of the present judgment, it is essential that the decisio …","paragraph_id":"para_901","court_paragraph":179},{"text":"180","paragraph_id":"para_902"},{"text":"In that regard, it should be noted that the pre-established models and criteria on which that type of data processing are based should be, first, specific and reliable, making it possible to achieve results identifying individuals who might be under a reasonable suspicion of participation in terrorist offences and, second, should be non-discriminatory (see, to that effect, Opinion 1/15 ( EU-Canada PNR Agreement ) of 26 July 2017, EU:C:2017:592 , paragraph  172 ).","paragraph_id":"para_903","court_paragraph":180},{"text":"181","paragraph_id":"para_904"},{"text":"In addition, it must be noted that any automated analysis carried out on the basis of models and criteria founded on the premiss that racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or information about a person’s health or sex life could, in …","paragraph_id":"para_905","court_paragraph":181},{"text":"182","paragraph_id":"para_906"},{"text":"Furthermore, since the automated analyses of traffic and location data necessarily involve some margin of error, any positive result obtained following automated processing must be subject to an individual re-examination by non-automated means before an individual measure adversely affecting the per …","paragraph_id":"para_907","court_paragraph":182},{"text":"Real-time collection of traffic and location data","paragraph_id":"para_908"},{"text":"183","paragraph_id":"para_909"},{"text":"The real-time collection of traffic and location data referred to in Article L. 851‑2 of the CSI may be individually authorised in respect of a ‘person previously identified as potentially having links to a [terrorist] threat’. Moreover, according to that description, and ‘where there are substantia …","paragraph_id":"para_910","court_paragraph":183},{"text":"184","paragraph_id":"para_911"},{"text":"The data that is the subject of such a measure allows the national competent authorities to monitor, for the duration of the authorisation, continuously and in real time, the persons with whom those persons are communicating, the means that they use, the duration of their communications and their pl …","paragraph_id":"para_912","court_paragraph":184},{"text":"185","paragraph_id":"para_913"},{"text":"With regard to the real-time collection of data referred to in Article L. 851‑4 of the CSI, that provision authorises technical data concerning the location of terminal equipment to be collected and transmitted in real time to a department reporting to the Prime Minister. It appears that such data a …","paragraph_id":"para_914","court_paragraph":185},{"text":"186","paragraph_id":"para_915"},{"text":"Like national legislation authorising the automated analysis of data, national legislation authorising such real-time collection derogates from the obligation of principle, established in Article 5 of Directive 2002/58, to ensure the confidentiality of electronic communications and related data. It …","paragraph_id":"para_916","court_paragraph":186},{"text":"187","paragraph_id":"para_917"},{"text":"It must be emphasised that the interference constituted by the real-time collection of data that allows terminal equipment to be located appears particularly serious, since that data provides the competent national authorities with a means of accurately and permanently tracking the movements of user …","paragraph_id":"para_918","court_paragraph":187},{"text":"188","paragraph_id":"para_919"},{"text":"Although the objective of preventing terrorism pursued by the national legislation at issue in the main proceedings is liable, given its importance, to justify interference in the form of the real-time collection of traffic and location data, such a measure may be implemented, taking into account it …","paragraph_id":"para_920","court_paragraph":188},{"text":"189","paragraph_id":"para_921"},{"text":"In addition, a decision authorising the real-time collection of traffic and location data must be based on objective criteria provided for in the national legislation. In particular, that legislation must define, in accordance with the case-law cited in paragraph 176 of the present judgment, the cir …","paragraph_id":"para_922","court_paragraph":189},{"text":"Notification of persons whose data has been collected or analysed","paragraph_id":"para_923"},{"text":"190","paragraph_id":"para_924"},{"text":"The competent national authorities undertaking real-time collection of traffic and location data must notify the persons concerned, in accordance with the applicable national procedures, to the extent that and as soon as that notification is no longer liable to jeopardise the tasks for which those a …","paragraph_id":"para_925","court_paragraph":190},{"text":"191","paragraph_id":"para_926"},{"text":"With regard to the notification required in the context of automated analysis of traffic and location data, the competent national authority is obliged to publish information of a general nature relating to that analysis without having to notify the persons concerned individually. However, if the da …","paragraph_id":"para_927","court_paragraph":191},{"text":"192","paragraph_id":"para_928"},{"text":"In the light of all the foregoing, the answer to questions 2 and 3 in Case C‑511/18 is that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as not precluding national rules which requires providers of electronic comm …","paragraph_id":"para_929","court_paragraph":192},{"text":"–","paragraph_id":"para_930"},{"text":"recourse to automated analysis is limited to situations in which a Member State is facing a serious threat to national security which is shown to be genuine and present or foreseeable, and where recourse to such analysis may be the subject of an effective review, either by a court or by an independe …","paragraph_id":"para_931"},{"text":"–","paragraph_id":"para_932"},{"text":"recourse to the real-time collection of traffic and location data is limited to persons in respect of whom there is a valid reason to suspect that they are involved in one way or another in terrorist activities and is subject to a prior review carried out either by a court or by an independent admin …","paragraph_id":"para_933"},{"text":"Question 2 in Case C‑512/18","paragraph_id":"para_934"},{"text":"193","paragraph_id":"para_935"},{"text":"By question 2 in Case C‑512/18, the referring court seeks, in essence, to ascertain whether the provisions of Directive 2000/31, read in the light of Articles 6, 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which requires providers of access to online public communication services and hosting service providers to retain, generally and indiscriminately, inter alia, personal data relating to those services.","paragraph_id":"para_936","court_paragraph":193},{"text":"194","paragraph_id":"para_937"},{"text":"While the referring court maintains that such services fall within the scope of Directive 2000/31 rather than within that of Directive 2002/58, it takes the view that Article 15(1) and (2) of Directive 2000/31, read in conjunction with Articles 12 and 14 of the same, does not, in itself, establish a …","paragraph_id":"para_938","court_paragraph":194},{"text":"195","paragraph_id":"para_939"},{"text":"In addition, the referring court points out that its question is raised in reference to the obligation to retain provided for in Article 6 of the LCEN, read in conjunction with Decree No 2011‑219. The data that must be retained by the service providers concerned on that basis includes, inter alia, d …","paragraph_id":"para_940","court_paragraph":195},{"text":"196","paragraph_id":"para_941"},{"text":"Furthermore, the data that is the subject of the obligation to retain covers the identifiers of subscribers, of connections and of terminal equipment used, the identifiers attributed to the content, the dates and times of the start and end of the connections and operations as well as the types of pr …","paragraph_id":"para_942","court_paragraph":196},{"text":"197","paragraph_id":"para_943"},{"text":"In that regard, it should be noted that, in accordance with Article 1(2) of Directive 2000/31, that directive approximates certain national provisions on information society services that are referred to in Article 2(a) of that directive.","paragraph_id":"para_944","court_paragraph":197},{"text":"198","paragraph_id":"para_945"},{"text":"It is true that such services include those which are provided at a distance, by means of electronic equipment for the processing and storage of data, at the individual request of a recipient of services, and normally in return for remuneration, such as services providing access to the Internet or t …","paragraph_id":"para_946","court_paragraph":198},{"text":"199","paragraph_id":"para_947"},{"text":"However, Article 1(5) of Directive 2000/31 provides that that directive is not to apply to questions relating to information society services covered by Directives 95/46 and 97/66. In that regard, it is clear from recitals 14 and 15 of Directive 2000/31 that the protection of the confidentiality of …","paragraph_id":"para_948","court_paragraph":199},{"text":"200","paragraph_id":"para_949"},{"text":"Questions related to the protection of the confidentiality of communications and personal data must be assessed on the basis of Directive 2002/58 and Regulation 2016/679, which replaced Directive 97/66 and Directive 95/46 respectively, and it should be noted that the protection that Directive 2000/3 …","paragraph_id":"para_950","court_paragraph":200},{"text":"201","paragraph_id":"para_951"},{"text":"The obligation imposed by the national legislation referred to in paragraph 195 of the present judgment on providers of access to online public communication services and hosting service providers requiring them to retain personal data relating to those services must, therefore – as the Advocate Gen …","paragraph_id":"para_952","court_paragraph":201},{"text":"202","paragraph_id":"para_953"},{"text":"Accordingly, depending on whether the provision of services covered by that national legislation falls within the scope of Directive 2002/58 or not, it is to be governed either by that directive, specifically by Article 15(1) thereof, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, or by Regulation 2016/679, specifically by Article 23(1) of that regulation, read in the light of the same articles of the Charter.","paragraph_id":"para_954","court_paragraph":202},{"text":"203","paragraph_id":"para_955"},{"text":"In the present instance, it is conceivable, as the European Commission submitted in its written observations, that some of the services to which the national legislation referred to in paragraph 195 of the present judgment is applicable constitute electronic communications services within the meaning of Directive 2002/58, which is for the referring court to verify.","paragraph_id":"para_956","court_paragraph":203},{"text":"204","paragraph_id":"para_957"},{"text":"In that regard, Directive 2002/58 covers electronic communications services that satisfy the conditions set out in Article 2(c) of Directive 2002/21, to which Article 2 of Directive 2002/58 refers and which defines an electronic communications service as ‘a service normally provided for remuneration …","paragraph_id":"para_958","court_paragraph":204},{"text":"205","paragraph_id":"para_959"},{"text":"Therefore, Internet access services, which appear to be covered by the national legislation referred to in paragraph 195 of the present judgment, constitute electronic communications services within the meaning of Directive 2002/21, as is confirmed by recital 10 of that directive (see, to that effec …","paragraph_id":"para_960","court_paragraph":205},{"text":"206","paragraph_id":"para_961"},{"text":"With regard to the requirements resulting from Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, it is appropriate to refer back to all of the findings and assessments made in the context of the answer given to question 1 in each of Cases C‑511/18 and C‑512/18 and to questions 1 and 2 in Case C‑520/18.","paragraph_id":"para_962","court_paragraph":206},{"text":"207","paragraph_id":"para_963"},{"text":"As regards the requirements stemming from Regulation 2016/679, it should be noted that the purpose of that regulation is, inter alia, as is apparent from recital 10 thereof, to ensure a high level of protection of natural persons within the European Union and, to that end, to ensure a consistent and …","paragraph_id":"para_964","court_paragraph":207},{"text":"208","paragraph_id":"para_965"},{"text":"To that end, any processing of personal data must, subject to the derogations permitted in Article 23 of Regulation 2016/679, observe the principles governing the processing of personal data and the rights of the person concerned set out, respectively, in Chapters II and III of that regulation. In p …","paragraph_id":"para_966","court_paragraph":208},{"text":"209","paragraph_id":"para_967"},{"text":"With regard, more specifically, to Article 23(1) of Regulation 2016/679, that provision, much like Article 15(1) of Directive 2002/58, allows Member States to restrict, for the purposes of the objectives that it provides for and by means of legislative measures, the scope of the obligations and righ …","paragraph_id":"para_968","court_paragraph":209},{"text":"210","paragraph_id":"para_969"},{"text":"Accordingly, Article 23(1) and (2) of Regulation 2016/679 cannot be interpreted as being capable of conferring on Member States the power to undermine respect for private life, disregarding Article 7 of the Charter, or any of the other guarantees enshrined therein (see, by analogy, with regard to Di …","paragraph_id":"para_970","court_paragraph":210},{"text":"211","paragraph_id":"para_971"},{"text":"It follows that the findings and assessments made in the context of the answer given to question 1 in each of Cases C‑511/18 and C‑512/18 and to questions 1 and 2 in Case C‑520/18 apply, mutatis mutandis , to Article 23 of Regulation 2016/679.","paragraph_id":"para_972","court_paragraph":211},{"text":"212","paragraph_id":"para_973"},{"text":"In the light of the foregoing, the answer to question 2 in Case C‑512/18 is that Directive 2000/31 must be interpreted as not being applicable in the field of the protection of the confidentiality of communications and of natural persons as regards the processing of personal data in the context of i …","paragraph_id":"para_974","court_paragraph":212},{"text":"Question 3 in Case C‑520/18","paragraph_id":"para_975"},{"text":"213","paragraph_id":"para_976"},{"text":"By question 3 in Case C‑520/18, the referring court seeks, in essence, to ascertain whether a national court may apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which it is bound to make under that law in respect of national legislation im …","paragraph_id":"para_977","court_paragraph":213},{"text":"214","paragraph_id":"para_978"},{"text":"The principle of the primacy of EU law establishes the pre-eminence of EU law over the law of the Member States. That principle therefore requires all Member State bodies to give full effect to the various EU provisions, and the law of the Member States may not undermine the effect accorded to those …","paragraph_id":"para_979","court_paragraph":214},{"text":"215","paragraph_id":"para_980"},{"text":"In the light of the primacy principle, where it is unable to interpret national law in compliance with the requirements of EU law, the national court which is called upon within the exercise of its jurisdiction to apply provisions of EU law is under a duty to give full effect to those provisions, if …","paragraph_id":"para_981","court_paragraph":215},{"text":"216","paragraph_id":"para_982"},{"text":"Only the Court may, in exceptional cases, on the basis of overriding considerations of legal certainty, allow the temporary suspension of the ousting effect of a rule of EU law with respect to national law that is contrary thereto. Such a restriction on the temporal effects of the interpretation of …","paragraph_id":"para_983","court_paragraph":216},{"text":"217","paragraph_id":"para_984"},{"text":"The primacy and uniform application of EU law would be undermined if national courts had the power to give provisions of national law primacy in relation to EU law contravened by those provisions, even temporarily (see, to that effect, judgment of 29 July 2019, Inter-Environnement Wallonie and Bond Beter Leefmilieu Vlaanderen, C‑411/17 , EU:C:2019:622 , paragraph  177 and the case-law cited).","paragraph_id":"para_985","court_paragraph":217},{"text":"218","paragraph_id":"para_986"},{"text":"However, the Court has held, in a case concerning the lawfulness of measures adopted in breach of the obligation under EU law to conduct a prior assessment of the impact of a project on the environment and on a protected site, that if domestic law allows it, a national court may, by way of exception …","paragraph_id":"para_987","court_paragraph":218},{"text":"219","paragraph_id":"para_988"},{"text":"However, unlike a breach of a procedural obligation such as the prior assessment of the impact of a project in the specific field of environmental protection, a failure to comply with Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, cann …","paragraph_id":"para_989","court_paragraph":219},{"text":"220","paragraph_id":"para_990"},{"text":"Therefore, the referring court cannot apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which it is bound to make under that law in respect of the national legislation at issue in the main proceedings.","paragraph_id":"para_991","court_paragraph":220},{"text":"221","paragraph_id":"para_992"},{"text":"That said, in their observations submitted to the Court, VZ, WY and XX contend that question 3 implicitly yet necessarily asks whether EU law precludes the use, in criminal proceedings, of information and evidence obtained as a result of the general and indiscriminate retention of traffic and location data in breach of that law.","paragraph_id":"para_993","court_paragraph":221},{"text":"222","paragraph_id":"para_994"},{"text":"In that regard, and in order to give a useful answer to the referring court, it should be recalled that, as EU law currently stands, it is, in principle, for national law alone to determine the rules relating to the admissibility and assessment, in criminal proceedings against persons suspected of having committed serious criminal offences, of information and evidence obtained by such retention of data contrary to EU law.","paragraph_id":"para_995","court_paragraph":222},{"text":"223","paragraph_id":"para_996"},{"text":"The Court has consistently held that, in the absence of EU rules on the matter, it is for the national legal order of each Member State to establish, in accordance with the principle of procedural autonomy, procedural rules for actions intended to safeguard the rights that individuals derive from EU …","paragraph_id":"para_997","court_paragraph":223},{"text":"224","paragraph_id":"para_998"},{"text":"As regards the principle of equivalence, it is for the national court hearing criminal proceedings based on information or evidence obtained in contravention of the requirements stemming from Directive 2002/58 to determine whether national law governing those proceedings lays down less favourable rules on the admissibility and use of such information and evidence than those governing information and evidence obtained in breach of domestic law.","paragraph_id":"para_999","court_paragraph":224},{"text":"225","paragraph_id":"para_1000"},{"text":"As for the principle of effectiveness, it should be noted that the objective of national rules on the admissibility and use of information and evidence is, in accordance with the choices made by national law, to prevent information and evidence obtained unlawfully from unduly prejudicing a person wh …","paragraph_id":"para_1001","court_paragraph":225},{"text":"226","paragraph_id":"para_1002"},{"text":"That said, it is apparent from the Court’s case-law that in deciding whether to exclude information and evidence obtained in contravention of the requirements of EU law, regard must be had, in particular, to the risk of breach of the adversarial principle and, therefore, the right to a fair trial en …","paragraph_id":"para_1003","court_paragraph":226},{"text":"227","paragraph_id":"para_1004"},{"text":"Therefore, the principle of effectiveness requires national criminal courts to disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law, in the context of criminal proceedings against persons suspected of having …","paragraph_id":"para_1005","court_paragraph":227},{"text":"228","paragraph_id":"para_1006"},{"text":"In the light of the foregoing, the answer to question 3 in Case C‑520/18 is that a national court may not apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality, which it is bound to make under that law, in respect of national legislation imposin …","paragraph_id":"para_1007","court_paragraph":228},{"text":"Costs","paragraph_id":"para_1008"},{"text":"229","paragraph_id":"para_1009"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the actions pending before the national courts, the decision on costs is a matter for those courts. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_1010","court_paragraph":229},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_1011"},{"text":"1.","paragraph_id":"para_1012"},{"text":"Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/ …","paragraph_id":"para_1013"},{"text":"–","paragraph_id":"para_1014"},{"text":"allow, for the purposes of safeguarding national security, recourse to an instruction requiring providers of electronic communications services to retain, generally and indiscriminately, traffic and location data in situations where the Member State concerned is confronted with a serious threat to n …","paragraph_id":"para_1015"},{"text":"–","paragraph_id":"para_1016"},{"text":"provide, for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security, for the targeted retention of traffic and location data which is limited, on the basis of objective and non-discriminatory factors, according to the categories of persons concerned or using a geographical criterion, for a period that is limited in time to what is strictly necessary, but which may be extended;","paragraph_id":"para_1017"},{"text":"–","paragraph_id":"para_1018"},{"text":"provide, for the purposes of safeguarding national security, combating serious crime and preventing serious threats to public security, for the general and indiscriminate retention of IP addresses assigned to the source of an Internet connection for a period that is limited in time to what is strictly necessary;","paragraph_id":"para_1019"},{"text":"–","paragraph_id":"para_1020"},{"text":"provide, for the purposes of safeguarding national security, combating crime and safeguarding public security, for the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems;","paragraph_id":"para_1021"},{"text":"–","paragraph_id":"para_1022"},{"text":"allow, for the purposes of combating serious crime and, a fortiori, safeguarding national security, recourse to an instruction requiring providers of electronic communications services, by means of a decision of the competent authority that is subject to effective judicial review, to undertake, for a specified period of time, the expedited retention of traffic and location data in the possession of those service providers,","paragraph_id":"para_1023"},{"text":"provided that those measures ensure, by means of clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.","paragraph_id":"para_1024"},{"text":"2.","paragraph_id":"para_1025"},{"text":"Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights, must be interpreted as not precluding national rules which requires providers of electronic communications services to have recourse …","paragraph_id":"para_1026"},{"text":"–","paragraph_id":"para_1027"},{"text":"recourse to automated analysis is limited to situations in which a Member State is facing a serious threat to national security which is shown to be genuine and present or foreseeable, and where recourse to such analysis may be the subject of an effective review, either by a court or by an independe …","paragraph_id":"para_1028"},{"text":"–","paragraph_id":"para_1029"},{"text":"recourse to the real-time collection of traffic and location data is limited to persons in respect of whom there is a valid reason to suspect that they are involved in one way or another in terrorist activities and is subject to a prior review carried out either by a court or by an independent admin …","paragraph_id":"para_1030"},{"text":"3.","paragraph_id":"para_1031"},{"text":"Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), must be interpreted as not being applicable in the field of the …","paragraph_id":"para_1032"},{"text":"4.","paragraph_id":"para_1033"},{"text":"A national court may not apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality, which it is bound to make under that law, in respect of national legislation imposing on providers of electronic communications services – with a view to, inter alia …","paragraph_id":"para_1034"},{"text":"[Signatures]","paragraph_id":"para_1035"},{"text":"(\n *1\n ) Language of the case: French.","paragraph_id":"para_1036"}],"operative_part":"On those grounds, the Court (Grand Chamber) hereby rules:\n\nArticle 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and el …","word_count":34486,"cites":["C-511/18","C-512/18","C-520/18","C-203/15","C-698/15","C-293/12","C-594/12","C-317/04","C-318/04","C-207/16","C-300/11","C-187/16","C-715/17","C-718/17","C-719/17","C-414/16","C-274/99","C-311/18","C-601/15","C-294/16","C-467/18","C-492/18","C-235/17","C-78/18","C-73/07","C-92/09","C-93/09","C-70/18","C-70/10","C-360/10","C-484/14","C-521/17","C-275/06","C-142/18","C-193/18","C-342/12","C-465/00","C-138/01","C-139/01","C-473/12","C-585/18","C-624/18","C-625/18","C-188/10","C-189/10","C-573/17","C-581/10","C-629/10","C-401/18","C-24/19","C-411/17","C-69/14","C-234/17","C-752/18","C-276/01"],"cited_by":[],"sha256":"3a734571030bf5bda3b32c905bc3c3c89e43fc8c817e56827b7fbbda80ecb789","source_url":"https://publications.europa.eu/resource/celex/62018CJ0511.ENG.xhtml.ECR_62018CJ0511_EN_01.html","fetched_at":"2026-10-02T13:45:03.975+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/62018cj0511","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:62018cj0511","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:62018cj0511","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:62018cj0511","verification":{"stored_sha256":"3a734571030bf5bda3b32c905bc3c3c89e43fc8c817e56827b7fbbda80ecb789","recomputed_sha256":"3a734571030bf5bda3b32c905bc3c3c89e43fc8c817e56827b7fbbda80ecb789","intact":true,"checked_at":"2026-10-14T12:04:18.291Z"}},"hash":"sha256:3356f0bbd4f1e208447b6946938e12879fa062fefc2a081bc83fbf186107bc79","version":"legal-2026-10-14","expires":"2026-10-15T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-14+legal-2026-10-14+2026-10-14T08:26:07","content_hash":"sha256:3356f0bbd4f1e208447b6946938e12879fa062fefc2a081bc83fbf186107bc79","revalidate_after":"2026-10-14T13:04:19.884Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62018cj0511","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:62018cj0511"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:62018cj0511"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:62018cj0511"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-02T09:10:49.062Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3A62018cj0511&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":59278}}