{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-623-17-62017cj0623","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-623-17-62017cj0623)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-23","fingerprint":"ewai:eu:b67bfc","proof":"sha256:1d7c08a906624c83c7302877af60e8f9cc17337481b5d4fa0e0090d2465d168e","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-623-17-62017cj0623","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62017CJ0623","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Grand Chamber)","paragraphs":[]},{"title":"6 October 2020 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"Privacy International","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37","para_38","para_39","para_40","para_41","para_42","para_43","para_44","para_45","para_46","para_47","para_48","para_49","para_50","para_51","para_52","para_53","para_54","para_55","para_56","para_57","para_58","para_59"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_62"]},{"title":"2","paragraphs":["para_64"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"Directive 95/46","paragraphs":[]},{"title":"3","paragraphs":["para_69","para_70"]},{"title":"2.   This Directive shall not apply to the processing of personal data:","paragraphs":["para_72","para_73","para_74","para_75"]},{"title":"Directive 2002/58","paragraphs":[]},{"title":"4","paragraphs":[]},{"title":"Recitals 2, 6, 7, 11, 22, 26 and 30 of Directive 2002/58 state:","paragraphs":["para_79","para_80","para_81"]},{"title":"(6)","paragraphs":["para_83"]},{"title":"(7)","paragraphs":["para_85","para_86"]},{"title":"(11)","paragraphs":["para_88","para_89"]},{"title":"(22)","paragraphs":["para_91","para_92"]},{"title":"(26)","paragraphs":["para_94","para_95"]},{"title":"(30)","paragraphs":["para_97"]},{"title":"5","paragraphs":[]},{"title":"Article 1 of Directive 2002/58, entitled ‘Scope and aim’, provides:","paragraphs":["para_100","para_101","para_102"]},{"title":"6","paragraphs":[]},{"title":"According to Article 2 of that directive, entitled ‘Definitions’:","paragraphs":["para_105"]},{"title":"The following definitions shall also apply:","paragraphs":[]},{"title":"(a)","paragraphs":["para_108"]},{"title":"(b)","paragraphs":["para_110"]},{"title":"(c)","paragraphs":["para_112"]},{"title":"(d)","paragraphs":["para_114","para_115"]},{"title":"7","paragraphs":[]},{"title":"Article 3 of that directive, entitled ‘Services concerned’, provides:","paragraphs":["para_118"]},{"title":"8","paragraphs":[]},{"title":"Under Article 5 of Directive 2002/58, entitled ‘Confidentiality of the communications’:","paragraphs":["para_121","para_122","para_123"]},{"title":"9","paragraphs":[]},{"title":"Article 6 of Directive 2002/58, entitled ‘Traffic data’, provides:","paragraphs":["para_126","para_127","para_128","para_129","para_130"]},{"title":"10","paragraphs":["para_132","para_133"]},{"title":"11","paragraphs":["para_135","para_136"]},{"title":"Regulation 2016/679","paragraphs":[]},{"title":"12","paragraphs":[]},{"title":"Article 2 of Regulation 2016/679 provides:","paragraphs":["para_140"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_143"]},{"title":"(b)","paragraphs":["para_145","para_146"]},{"title":"(d)","paragraphs":["para_148","para_149"]},{"title":"13","paragraphs":[]},{"title":"Article 4 of that regulation provides:","paragraphs":["para_152","para_153"]},{"title":"(2)","paragraphs":["para_155","para_156"]},{"title":"14","paragraphs":[]},{"title":"Under Article 23(1) of that regulation:","paragraphs":["para_159"]},{"title":"(a)","paragraphs":["para_161"]},{"title":"(b)","paragraphs":["para_163"]},{"title":"(c)","paragraphs":["para_165"]},{"title":"(d)","paragraphs":["para_167"]},{"title":"(e)","paragraphs":["para_169"]},{"title":"(f)","paragraphs":["para_171"]},{"title":"(g)","paragraphs":["para_173"]},{"title":"(h)","paragraphs":["para_175"]},{"title":"(i)","paragraphs":["para_177"]},{"title":"(j)","paragraphs":["para_179"]},{"title":"15","paragraphs":[]},{"title":"Under Article 94(2) of Regulation 2016/679:","paragraphs":["para_182"]},{"title":"United Kingdom law","paragraphs":[]},{"title":"16","paragraphs":["para_185","para_186","para_187","para_188","para_189","para_190","para_191","para_192","para_193"]},{"title":"17","paragraphs":["para_195","para_196"]},{"title":"(a)","paragraphs":["para_198"]},{"title":"(b)","paragraphs":["para_200"]},{"title":"(i)","paragraphs":["para_202"]},{"title":"(ii)","paragraphs":["para_204"]},{"title":"(c)","paragraphs":["para_206","para_207"]},{"title":"(6)   … “traffic data”, in relation to any communication, means—","paragraphs":[]},{"title":"(a)","paragraphs":["para_210"]},{"title":"(b)","paragraphs":["para_212"]},{"title":"(c)","paragraphs":["para_214"]},{"title":"(d)","paragraphs":["para_216","para_217"]},{"title":"18","paragraphs":["para_219"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"19","paragraphs":["para_222"]},{"title":"20","paragraphs":["para_224"]},{"title":"21","paragraphs":["para_226"]},{"title":"22","paragraphs":["para_228"]},{"title":"23","paragraphs":["para_230"]},{"title":"24","paragraphs":["para_232"]},{"title":"25","paragraphs":["para_234"]},{"title":"26","paragraphs":["para_236"]},{"title":"27","paragraphs":["para_238"]},{"title":"28","paragraphs":["para_240"]},{"title":"29","paragraphs":["para_242","para_243"]},{"title":"(a)","paragraphs":["para_245"]},{"title":"(b)","paragraphs":["para_247"]},{"title":"(c)","paragraphs":["para_249"]},{"title":"(d)","paragraphs":["para_251"]},{"title":"(e)","paragraphs":["para_253"]},{"title":"(1)","paragraphs":["para_255"]},{"title":"(2)","paragraphs":["para_257"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"Question 1","paragraphs":[]},{"title":"30","paragraphs":["para_261"]},{"title":"31","paragraphs":["para_263"]},{"title":"32","paragraphs":["para_265"]},{"title":"33","paragraphs":["para_267"]},{"title":"34","paragraphs":["para_269"]},{"title":"35","paragraphs":["para_271"]},{"title":"36","paragraphs":["para_273"]},{"title":"37","paragraphs":["para_275"]},{"title":"38","paragraphs":["para_277"]},{"title":"39","paragraphs":["para_279"]},{"title":"40","paragraphs":["para_281"]},{"title":"41","paragraphs":["para_283"]},{"title":"42","paragraphs":["para_285"]},{"title":"43","paragraphs":["para_287"]},{"title":"44","paragraphs":["para_289"]},{"title":"45","paragraphs":["para_291"]},{"title":"46","paragraphs":["para_293"]},{"title":"47","paragraphs":["para_295"]},{"title":"48","paragraphs":["para_297"]},{"title":"49","paragraphs":["para_299"]},{"title":"Question 2","paragraphs":[]},{"title":"50","paragraphs":["para_302"]},{"title":"51","paragraphs":["para_304"]},{"title":"52","paragraphs":["para_306"]},{"title":"53","paragraphs":["para_308"]},{"title":"54","paragraphs":["para_310"]},{"title":"55","paragraphs":["para_312"]},{"title":"56","paragraphs":["para_314"]},{"title":"57","paragraphs":["para_316"]},{"title":"58","paragraphs":["para_318"]},{"title":"59","paragraphs":["para_320"]},{"title":"60","paragraphs":["para_322"]},{"title":"61","paragraphs":["para_324"]},{"title":"62","paragraphs":["para_326"]},{"title":"63","paragraphs":["para_328"]},{"title":"64","paragraphs":["para_330"]},{"title":"65","paragraphs":["para_332"]},{"title":"66","paragraphs":["para_334"]},{"title":"67","paragraphs":["para_336"]},{"title":"68","paragraphs":["para_338"]},{"title":"69","paragraphs":["para_340"]},{"title":"70","paragraphs":["para_342"]},{"title":"71","paragraphs":["para_344"]},{"title":"72","paragraphs":["para_346"]},{"title":"73","paragraphs":["para_348"]},{"title":"74","paragraphs":["para_350"]},{"title":"75","paragraphs":["para_352"]},{"title":"76","paragraphs":["para_354"]},{"title":"77","paragraphs":["para_356"]},{"title":"78","paragraphs":["para_358"]},{"title":"79","paragraphs":["para_360"]},{"title":"80","paragraphs":["para_362"]},{"title":"81","paragraphs":["para_364"]},{"title":"82","paragraphs":["para_366"]},{"title":"Costs","paragraphs":[]},{"title":"83","paragraphs":["para_369"]},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_371","para_372","para_373","para_374"]},{"title":"Lenaerts","paragraphs":[]},{"title":"Silva de Lapuerta","paragraphs":[]},{"title":"Bonichot","paragraphs":[]},{"title":"Arabadjiev","paragraphs":[]},{"title":"Prechal","paragraphs":[]},{"title":"Safjan","paragraphs":[]},{"title":"Xuereb","paragraphs":[]},{"title":"Rossi","paragraphs":[]},{"title":"Malenovský","paragraphs":[]},{"title":"Bay Larsen","paragraphs":["para_385"]},{"title":"Toader","paragraphs":[]},{"title":"Jürimäe","paragraphs":[]},{"title":"Lycourgos","paragraphs":[]},{"title":"Piçarra","paragraphs":["para_390"]},{"title":"A. Calot Escobar","paragraphs":[]},{"title":"Registrar","paragraphs":[]},{"title":"K. Lenaerts","paragraphs":[]},{"title":"President","paragraphs":["para_395"]}],"paragraphs":[{"text":"62017CJ0623","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"6 October 2020 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Providers of electronic communications services – General and indiscriminate transmission of traffic data and location data – Safeguarding of national security – Directive 2002/58/EC – Scope – …","paragraph_id":"para_4"},{"text":"In Case C‑623/17,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Investigatory Powers Tribunal (United Kingdom), made by decision of 18 October 2017, received at the Court on 31 October 2017, in the proceedings","paragraph_id":"para_6"},{"text":"Privacy International","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Secretary of State for Foreign and Commonwealth Affairs,","paragraph_id":"para_9"},{"text":"Secretary of State for the Home Department,","paragraph_id":"para_10"},{"text":"Government Communications Headquarters,","paragraph_id":"para_11"},{"text":"Security Service,","paragraph_id":"para_12"},{"text":"Secret Intelligence Service,","paragraph_id":"para_13"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_14"},{"text":"composed of K. Lenaerts, President, R. Silva de Lapuerta, Vice-President, J.-C. Bonichot, A. Arabadjiev, A. Prechal, M. Safjan, P.G. Xuereb and L.S. Rossi, Presidents of Chambers, J. Malenovský, L. Bay Larsen, T. von Danwitz (Rapporteur), C. Toader, K. Jürimäe, C. Lycourgos and N. Piçarra, Judges,","paragraph_id":"para_15"},{"text":"Advocate General: M. Campos Sánchez-Bordona,","paragraph_id":"para_16"},{"text":"Registrar: C. Strömholm, Administrator,","paragraph_id":"para_17"},{"text":"having regard to the written procedure and further to the hearing on 9 and 10 September 2019,","paragraph_id":"para_18"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"Privacy International, by B. Jaffey QC and T. de la Mare QC, by D. Cashman, Solicitor, and by H. Roy, avocat,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the United Kingdom Government, by Z. Lavery, D. Guðmundsdóttir and S. Brandon, acting as Agents, by G. Facenna QC and D. Beard QC, and by C. Knight and R. Palmer, Barristers,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Belgian Government, by P. Cottin and J.-C. Halleux, acting as Agents, and by J. Vanpraet, advocaat, and E. de Lophem, avocat,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Czech Government, by M. Smolek, J. Vláčil and O. Serdula, acting as Agents,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the German Government, initially by M. Hellmann, R. Kanitz, D. Klebs and T. Henze, and subsequently by J. Möller, M. Hellmann, R. Kanitz and D. Klebs, acting as Agents,","paragraph_id":"para_29"},{"text":"–","paragraph_id":"para_30"},{"text":"the Estonian Government, by A. Kalbus, acting as Agent,","paragraph_id":"para_31"},{"text":"–","paragraph_id":"para_32"},{"text":"Ireland, by M. Browne, G. Hodge and A. Joyce, acting as Agents, and by D. Fennelly, Barrister,","paragraph_id":"para_33"},{"text":"–","paragraph_id":"para_34"},{"text":"the Spanish Government, initially by L. Aguilera Ruiz and M.J. García-Valdecasas Dorrego, and subsequently by L. Aguilera Ruiz, acting as Agents,","paragraph_id":"para_35"},{"text":"–","paragraph_id":"para_36"},{"text":"the French Government, initially by E. de Moustier, E. Armoët, A.-L. Desjonquères, F. Alabrune, D. Colas and D. Dubois, and subsequently by E. de Moustier, E. Armoët, A.-L. Desjonquères, F. Alabrune and D. Dubois, acting as Agents,","paragraph_id":"para_37"},{"text":"–","paragraph_id":"para_38"},{"text":"the Cypriot Government, by E. Symeonidou and E. Neofytou, acting as Agents,","paragraph_id":"para_39"},{"text":"–","paragraph_id":"para_40"},{"text":"the Latvian Government, initially by V. Soņeca and I. Kucina, and subsequently by V. Soņeca, acting as Agents,","paragraph_id":"para_41"},{"text":"–","paragraph_id":"para_42"},{"text":"the Hungarian Government, initially by G. Koós, M.Z. Fehér, G. Tornyai and Z. Wagner, and subsequently by G. Koós and M.Z. Fehér, acting as Agents,","paragraph_id":"para_43"},{"text":"–","paragraph_id":"para_44"},{"text":"the Netherlands Government, by C.S. Schillemans and M.K. Bulterman, acting as Agents,","paragraph_id":"para_45"},{"text":"–","paragraph_id":"para_46"},{"text":"the Polish Government, by B. Majczyna, J. Sawicka and M. Pawlicka, acting as Agents,","paragraph_id":"para_47"},{"text":"–","paragraph_id":"para_48"},{"text":"the Portuguese Government, by L. Inez Fernandes, M. Figueiredo and F. Aragão Homem, acting as Agents,","paragraph_id":"para_49"},{"text":"–","paragraph_id":"para_50"},{"text":"the Swedish Government, initially by A. Falk, H. Shev, C. Meyer-Seitz, L. Zettergren and A. Alriksson, and subsequently by H. Shev, C. Meyer-Seitz, L. Zettergren and A. Alriksson, acting as Agents,","paragraph_id":"para_51"},{"text":"–","paragraph_id":"para_52"},{"text":"the Norwegian Government, by T.B. Leming, M. Emberland and J. Vangsnes, acting as Agents,","paragraph_id":"para_53"},{"text":"–","paragraph_id":"para_54"},{"text":"the European Commission, initially by H. Kranenborg, M. Wasmeier, D. Nardi and P. Costa de Oliveira, and subsequently by H. Kranenborg, M. Wasmeier, and D. Nardi, acting as Agents,","paragraph_id":"para_55"},{"text":"–","paragraph_id":"para_56"},{"text":"the European Data Protection Supervisor, by T. Zerdick and A. Buchta, acting as Agents,","paragraph_id":"para_57"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 15 January 2020,","paragraph_id":"para_58"},{"text":"gives the following","paragraph_id":"para_59"},{"text":"Judgment","paragraph_id":"para_60"},{"text":"1","paragraph_id":"para_61"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 1(3) and Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ( …","paragraph_id":"para_62"},{"text":"2","paragraph_id":"para_63"},{"text":"The request has been made in proceedings between Privacy International and the Secretary of State for Foreign and Commonwealth Affairs (United Kingdom), the Secretary of State for the Home Department (United Kingdom), Government Communications Headquarters (United Kingdom) (‘GCHQ’), the Security Ser …","paragraph_id":"para_64"},{"text":"Legal context","paragraph_id":"para_65"},{"text":"European Union law","paragraph_id":"para_66"},{"text":"Directive 95/46","paragraph_id":"para_67"},{"text":"3","paragraph_id":"para_68"},{"text":"Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ), was repealed, with effect from 25 May 2018, by Regulation (EU) 2016/679 …","paragraph_id":"para_69"},{"text":"‘1.   This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_70"},{"text":"2.   This Directive shall not apply to the processing of personal data:","paragraph_id":"para_71"},{"text":"–","paragraph_id":"para_72"},{"text":"in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI [TEU] and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,","paragraph_id":"para_73"},{"text":"–","paragraph_id":"para_74"},{"text":"by a natural person in the course of a purely personal or household activity.’","paragraph_id":"para_75"},{"text":"Directive 2002/58","paragraph_id":"para_76"},{"text":"4","paragraph_id":"para_77"},{"text":"Recitals 2, 6, 7, 11, 22, 26 and 30 of Directive 2002/58 state:","paragraph_id":"para_78"},{"text":"‘(2)","paragraph_id":"para_79"},{"text":"This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by [the Charter]. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of [the Charter].","paragraph_id":"para_80"},{"text":"…","paragraph_id":"para_81"},{"text":"(6)","paragraph_id":"para_82"},{"text":"The Internet is overturning traditional market structures by providing a common, global infrastructure for the delivery of a wide range of electronic communications services. Publicly available electronic communications services over the Internet open new possibilities for users but also new risks for their personal data and privacy.","paragraph_id":"para_83"},{"text":"(7)","paragraph_id":"para_84"},{"text":"In the case of public communications networks, specific legal, regulatory and technical provisions should be made in order to protect fundamental rights and freedoms of natural persons and legitimate interests of legal persons, in particular with regard to the increasing capacity for automated storage and processing of data relating to subscribers and users.","paragraph_id":"para_85"},{"text":"…","paragraph_id":"para_86"},{"text":"(11)","paragraph_id":"para_87"},{"text":"Like [Directive 95/46], this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by [EU] law. Therefore it does not alter the existing balance between the individual’s right to privacy and the possibility for Member States t …","paragraph_id":"para_88"},{"text":"…","paragraph_id":"para_89"},{"text":"(22)","paragraph_id":"para_90"},{"text":"The prohibition of storage of communications and the related traffic data by persons other than the users or without their consent is not intended to prohibit any automatic, intermediate and transient storage of this information in so far as this takes place for the sole purpose of carrying out the …","paragraph_id":"para_91"},{"text":"…","paragraph_id":"para_92"},{"text":"(26)","paragraph_id":"para_93"},{"text":"The data relating to subscribers processed within electronic communications networks to establish connections and to transmit information contain information on the private life of natural persons and concern the right to respect for their correspondence or concern the legitimate interests of legal …","paragraph_id":"para_94"},{"text":"…","paragraph_id":"para_95"},{"text":"(30)","paragraph_id":"para_96"},{"text":"Systems for the provision of electronic communications networks and services should be designed to limit the amount of personal data necessary to a strict minimum. …’","paragraph_id":"para_97"},{"text":"5","paragraph_id":"para_98"},{"text":"Article 1 of Directive 2002/58, entitled ‘Scope and aim’, provides:","paragraph_id":"para_99"},{"text":"‘1.   This Directive provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in [the European Union].","paragraph_id":"para_100"},{"text":"2.   The provisions of this Directive particularise and complement [Directive 95/46] for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.","paragraph_id":"para_101"},{"text":"3.   This Directive shall not apply to activities which fall outside the scope of [the TFEU], such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law.’","paragraph_id":"para_102"},{"text":"6","paragraph_id":"para_103"},{"text":"According to Article 2 of that directive, entitled ‘Definitions’:","paragraph_id":"para_104"},{"text":"‘Save as otherwise provided, the definitions in [Directive 95/46] and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) [( OJ 2002 L 108, p. 33 )] shall apply.","paragraph_id":"para_105"},{"text":"The following definitions shall also apply:","paragraph_id":"para_106"},{"text":"(a)","paragraph_id":"para_107"},{"text":"“user” means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;","paragraph_id":"para_108"},{"text":"(b)","paragraph_id":"para_109"},{"text":"“traffic data” means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;","paragraph_id":"para_110"},{"text":"(c)","paragraph_id":"para_111"},{"text":"“location data” means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;","paragraph_id":"para_112"},{"text":"(d)","paragraph_id":"para_113"},{"text":"“communication” means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information;","paragraph_id":"para_114"},{"text":"…’","paragraph_id":"para_115"},{"text":"7","paragraph_id":"para_116"},{"text":"Article 3 of that directive, entitled ‘Services concerned’, provides:","paragraph_id":"para_117"},{"text":"‘This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in [the European Union], including public communications networks supporting data collection and identification devices.’","paragraph_id":"para_118"},{"text":"8","paragraph_id":"para_119"},{"text":"Under Article 5 of Directive 2002/58, entitled ‘Confidentiality of the communications’:","paragraph_id":"para_120"},{"text":"‘1.   Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or o …","paragraph_id":"para_121"},{"text":"…","paragraph_id":"para_122"},{"text":"3.   Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear …","paragraph_id":"para_123"},{"text":"9","paragraph_id":"para_124"},{"text":"Article 6 of Directive 2002/58, entitled ‘Traffic data’, provides:","paragraph_id":"para_125"},{"text":"‘1.   Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).","paragraph_id":"para_126"},{"text":"2.   Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued.","paragraph_id":"para_127"},{"text":"3.   For the purpose of marketing electronic communications services or for the provision of value added services, the provider of a publicly available electronic communications service may process the data referred to in paragraph 1 to the extent and for the duration necessary for such services or …","paragraph_id":"para_128"},{"text":"…","paragraph_id":"para_129"},{"text":"5.   Processing of traffic data, in accordance with paragraphs 1, 2, 3 and 4, must be restricted to persons acting under the authority of providers of the public communications networks and publicly available electronic communications services handling billing or traffic management, customer enquiri …","paragraph_id":"para_130"},{"text":"10","paragraph_id":"para_131"},{"text":"Article 9 of that directive, entitled ‘Location data other than traffic data’, provides, in paragraph 1 thereof:","paragraph_id":"para_132"},{"text":"‘Where location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communications services, can be processed, such data may only be processed when they are made anonymous, or with the consent of the users or subscribers t …","paragraph_id":"para_133"},{"text":"11","paragraph_id":"para_134"},{"text":"Article 15 of that directive, entitled ‘Application of certain provisions of [Directive 95/46]’, states, in paragraph 1 thereof:","paragraph_id":"para_135"},{"text":"‘Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democr …","paragraph_id":"para_136"},{"text":"Regulation 2016/679","paragraph_id":"para_137"},{"text":"12","paragraph_id":"para_138"},{"text":"Article 2 of Regulation 2016/679 provides:","paragraph_id":"para_139"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_140"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_141"},{"text":"(a)","paragraph_id":"para_142"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_143"},{"text":"(b)","paragraph_id":"para_144"},{"text":"by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;","paragraph_id":"para_145"},{"text":"…","paragraph_id":"para_146"},{"text":"(d)","paragraph_id":"para_147"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.","paragraph_id":"para_148"},{"text":"…’","paragraph_id":"para_149"},{"text":"13","paragraph_id":"para_150"},{"text":"Article 4 of that regulation provides:","paragraph_id":"para_151"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_152"},{"text":"…","paragraph_id":"para_153"},{"text":"(2)","paragraph_id":"para_154"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_155"},{"text":"…’","paragraph_id":"para_156"},{"text":"14","paragraph_id":"para_157"},{"text":"Under Article 23(1) of that regulation:","paragraph_id":"para_158"},{"text":"‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligat …","paragraph_id":"para_159"},{"text":"(a)","paragraph_id":"para_160"},{"text":"national security;","paragraph_id":"para_161"},{"text":"(b)","paragraph_id":"para_162"},{"text":"defence;","paragraph_id":"para_163"},{"text":"(c)","paragraph_id":"para_164"},{"text":"public security;","paragraph_id":"para_165"},{"text":"(d)","paragraph_id":"para_166"},{"text":"the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;","paragraph_id":"para_167"},{"text":"(e)","paragraph_id":"para_168"},{"text":"other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;","paragraph_id":"para_169"},{"text":"(f)","paragraph_id":"para_170"},{"text":"the protection of judicial independence and judicial proceedings;","paragraph_id":"para_171"},{"text":"(g)","paragraph_id":"para_172"},{"text":"the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;","paragraph_id":"para_173"},{"text":"(h)","paragraph_id":"para_174"},{"text":"a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);","paragraph_id":"para_175"},{"text":"(i)","paragraph_id":"para_176"},{"text":"the protection of the data subject or the rights and freedoms of others;","paragraph_id":"para_177"},{"text":"(j)","paragraph_id":"para_178"},{"text":"the enforcement of civil law claims.’","paragraph_id":"para_179"},{"text":"15","paragraph_id":"para_180"},{"text":"Under Article 94(2) of Regulation 2016/679:","paragraph_id":"para_181"},{"text":"‘References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of [Directive 95/46] shall be construed as references to the European Data Protection Board established by this Regulation.’","paragraph_id":"para_182"},{"text":"United Kingdom law","paragraph_id":"para_183"},{"text":"16","paragraph_id":"para_184"},{"text":"Section 94 of the Telecommunications Act 1984, in the version applicable to the facts in the main proceedings (‘the 1984 Act’), entitled ‘Directions in the interests of national security etc.’, provides:","paragraph_id":"para_185"},{"text":"‘(1)   The Secretary of State may, after consultation with a person to whom this section applies, give to that person such directions of a general character as appear to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom.","paragraph_id":"para_186"},{"text":"(2)   If it appears to the Secretary of State to be necessary to do so in the interests of national security or relations with the government of a country or territory outside the United Kingdom, he may, after consultation with a person to whom this section applies, give to that person a direction requiring him (according to the circumstances of the case) to do, or not to do, a particular thing specified in the direction.","paragraph_id":"para_187"},{"text":"(2A)   The Secretary of State shall not give a direction under subsection (1) or (2) unless he believes that the conduct required by the direction is proportionate to what is sought to be achieved by that conduct.","paragraph_id":"para_188"},{"text":"(3)   A person to whom this section applies shall give effect to any direction given to him by the Secretary of State under this section notwithstanding any other duty imposed on him by or under Part 1 or Chapter 1 of Part 2 of the Communications Act 2003 and, in the case of a direction to a provider of a public electronic communications network, notwithstanding that it relates to him in a capacity other than as the provider of such a network.","paragraph_id":"para_189"},{"text":"(4)   The Secretary of State shall lay before each House of Parliament a copy of every direction given under this section unless he is of [the] opinion that disclosure of the direction is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or the commercial interests of any person.","paragraph_id":"para_190"},{"text":"(5)   A person shall not disclose, or be required by virtue of any enactment or otherwise to disclose, anything done by virtue of this section if the Secretary of State has notified him that the Secretary of State is of the opinion that disclosure of that thing is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or the commercial interests of some other person.","paragraph_id":"para_191"},{"text":"…","paragraph_id":"para_192"},{"text":"(8)   This section applies to [the Office of Communications (OFCOM)] and to providers of public electronic communications networks.’","paragraph_id":"para_193"},{"text":"17","paragraph_id":"para_194"},{"text":"Section 21(4) and (6) of the Regulation of Investigatory Powers Act 2000 (‘the RIPA’) provides:","paragraph_id":"para_195"},{"text":"‘(4)   … “communications data” means any of the following—","paragraph_id":"para_196"},{"text":"(a)","paragraph_id":"para_197"},{"text":"any traffic data comprised in or attached to a communication (whether by the sender or otherwise) for the purposes of any postal service or telecommunication system by means of which it is being or may be transmitted;","paragraph_id":"para_198"},{"text":"(b)","paragraph_id":"para_199"},{"text":"any information which includes none of the contents of a communication (apart from any information falling within paragraph (a)) and is about the use made by any person—","paragraph_id":"para_200"},{"text":"(i)","paragraph_id":"para_201"},{"text":"of any postal service or telecommunications service; or","paragraph_id":"para_202"},{"text":"(ii)","paragraph_id":"para_203"},{"text":"in connection with the provision to or use by any person of any telecommunications service, of any part of a telecommunication system;","paragraph_id":"para_204"},{"text":"(c)","paragraph_id":"para_205"},{"text":"any information not falling within paragraph (a) or (b) that is held or obtained, in relation to persons to whom he provides the service, by a person providing a postal service or telecommunications service.","paragraph_id":"para_206"},{"text":"…","paragraph_id":"para_207"},{"text":"(6)   … “traffic data”, in relation to any communication, means—","paragraph_id":"para_208"},{"text":"(a)","paragraph_id":"para_209"},{"text":"any data identifying, or purporting to identify, any person, apparatus or location to or from which the communication is or may be transmitted,","paragraph_id":"para_210"},{"text":"(b)","paragraph_id":"para_211"},{"text":"any data identifying or selecting, or purporting to identify or select, apparatus through which, or by means of which, the communication is or may be transmitted,","paragraph_id":"para_212"},{"text":"(c)","paragraph_id":"para_213"},{"text":"any data comprising signals for the actuation of apparatus used for the purposes of a telecommunication system for effecting (in whole or in part) the transmission of any communication, and","paragraph_id":"para_214"},{"text":"(d)","paragraph_id":"para_215"},{"text":"any data identifying the data or other data as data comprised in or attached to a particular communication.","paragraph_id":"para_216"},{"text":"…’","paragraph_id":"para_217"},{"text":"18","paragraph_id":"para_218"},{"text":"Sections 65 to 69 of the RIPA lay down the rules on the functioning and jurisdiction of the Investigatory Powers Tribunal (United Kingdom). Under section 65 of the RIPA, a complaint may be made to the Investigatory Powers Tribunal if there is reason to believe that data has been acquired inappropriately.","paragraph_id":"para_219"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_220"},{"text":"19","paragraph_id":"para_221"},{"text":"At the beginning of 2015, the existence of practices for the acquisition and use of bulk communications data by the various security and intelligence agencies of the United Kingdom, namely GCHQ, MI5 and MI6, was made public, including in a report by the Intelligence and Security Committee of Parliam …","paragraph_id":"para_222"},{"text":"20","paragraph_id":"para_223"},{"text":"The referring court examined the lawfulness of those practices in the light, first of all, of national law and the provisions of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), and, subsequently, of EU law. In a jud …","paragraph_id":"para_224"},{"text":"21","paragraph_id":"para_225"},{"text":"The referring court found that those measures for the acquisition and use of data were consistent with national law and, since 2015, subject to issues that remained under consideration concerning the proportionality of those measures and the transfer of data to third parties, with Article 8 ECHR. In …","paragraph_id":"para_226"},{"text":"22","paragraph_id":"para_227"},{"text":"As regards the lawfulness of the acquisition and use measures at issue in the main proceedings in the light of EU law, the referring court examined, in a judgment of 8 September 2017, whether those measures fell within the scope of EU law and, if so, whether they were compatible with EU law. That co …","paragraph_id":"para_228"},{"text":"23","paragraph_id":"para_229"},{"text":"In that regard, in its request for a preliminary ruling, the referring court states that, pursuant to section 94 of the 1984 Act, the Secretary of State may give providers of electronic communications services such general or specific directions as appear to him to be necessary in the interests of n …","paragraph_id":"para_230"},{"text":"24","paragraph_id":"para_231"},{"text":"According to the referring court, the regime at issue in the main proceedings differs from that resulting from the Data Retention and Investigatory Powers Act 2014, at issue in the case which gave rise to the judgment of 21 December 2016, Tele2 ( C‑203/15 and C‑698/15 , EU:C:2016:970 ), since the la …","paragraph_id":"para_232"},{"text":"25","paragraph_id":"para_233"},{"text":"The referring court adds that the databases compiled by the security and intelligence agencies are subject to bulk, unspecific, automated processing, with the aim of discovering unknown threats. To that end, the referring court states that the sets of metadata thus compiled should be as comprehensiv …","paragraph_id":"para_234"},{"text":"26","paragraph_id":"para_235"},{"text":"The referring court also states that, according to Privacy International, the regime at issue in the main proceedings is unlawful in the light of EU law, while the defendants in the main proceedings consider that the obligation to transfer data provided for by that regime, access to that data and it …","paragraph_id":"para_236"},{"text":"27","paragraph_id":"para_237"},{"text":"In that regard, the Investigatory Powers Tribunal considers, on the basis of the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 , paragraphs  56 to  59 ), concerning the transfer of passenger name record data for the purpose of protecting public …","paragraph_id":"para_238"},{"text":"28","paragraph_id":"para_239"},{"text":"Should the measures at issue in the main proceedings nevertheless fall within the scope of EU law, the referring court considers that the requirements set out in paragraphs 119 to 125 of the judgment of 21 December 2016, Tele2 ( C‑203/15 and C‑698/15 , EU:C:2016:970 ) appear inappropriate in the context of national security and would undermine the ability of the security and intelligence agencies to tackle some threats to national security.","paragraph_id":"para_240"},{"text":"29","paragraph_id":"para_241"},{"text":"In those circumstances, the Investigatory Powers Tribunal decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_242"},{"text":"‘In circumstances where:","paragraph_id":"para_243"},{"text":"(a)","paragraph_id":"para_244"},{"text":"the [security and intelligence agencies’] capabilities to use [bulk communications data] supplied to them are essential to the protection of the national security of the United Kingdom, including in the fields of counter-terrorism, counter-espionage and counter-nuclear proliferation;","paragraph_id":"para_245"},{"text":"(b)","paragraph_id":"para_246"},{"text":"a fundamental feature of the [security and intelligence agencies’] use of [bulk communications data] is to discover previously unknown threats to national security by means of non-targeted bulk techniques which are reliant upon the aggregation of [those data] in one place. Its principal utility lies in swift target identification and development, as well as providing a basis for action in the face of imminent threat;","paragraph_id":"para_247"},{"text":"(c)","paragraph_id":"para_248"},{"text":"the provider of an electronic communications network is not thereafter required to retain [the bulk communications data] (beyond the period of their ordinary business requirements), which [are] retained by the State (the [security and intelligence agencies]) alone;","paragraph_id":"para_249"},{"text":"(d)","paragraph_id":"para_250"},{"text":"the national court has found (subject to certain reserved issues) that the safeguards surrounding the use of [bulk communications data] by the [security and intelligence agencies] are consistent with the requirements of the ECHR; and","paragraph_id":"para_251"},{"text":"(e)","paragraph_id":"para_252"},{"text":"the national court has found that the imposition of the requirements specified in [paragraphs 119 to 125 of the judgment of 21 December 2016, Tele2 ( C‑203/15 and C‑698/15 , EU:C:2016:970 )], if applicable, would frustrate the measures taken to safeguard national security by the [security and intelligence agencies], and thereby put the national security of the United Kingdom at risk;","paragraph_id":"para_253"},{"text":"(1)","paragraph_id":"para_254"},{"text":"Having regard to Article 4 TEU and Article 1(3) of [Directive 2002/58], does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the [security and intelligence agencies] of a Member State fall within the scope of Union law and of [Directive 2002/58]?","paragraph_id":"para_255"},{"text":"(2)","paragraph_id":"para_256"},{"text":"If the answer to Question (1) is “yes”, do any of the [requirements applicable to retained communications data, set out in paragraphs 119 to 125 of the judgment of 21 December 2016, Tele2 ( C‑203/15 and C‑698/15 , EU:C:2016:970 )] or any other requirements in addition to those imposed by the ECHR, a …","paragraph_id":"para_257"},{"text":"Consideration of the questions referred","paragraph_id":"para_258"},{"text":"Question 1","paragraph_id":"para_259"},{"text":"30","paragraph_id":"para_260"},{"text":"By its first question, the referring court asks, in essence, whether Article 1(3) of Directive 2002/58, read in the light of Article 4(2) TEU, is to be interpreted as meaning that national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of that directive.","paragraph_id":"para_261"},{"text":"31","paragraph_id":"para_262"},{"text":"In that regard, Privacy International argues, in essence, that, having regard to the guidance derived from the case-law of the Court of Justice as regards the scope of Directive 2002/58, both the acquisition of data by the security and intelligence agencies from those providers under section 94 of t …","paragraph_id":"para_263"},{"text":"32","paragraph_id":"para_264"},{"text":"By contrast, the United Kingdom, Czech and Estonian Governments, Ireland, and the French, Cypriot, Hungarian, Polish and Swedish Governments contend, in essence, that Directive 2002/58 does not apply to the national legislation at issue in the main proceedings, as the purpose of that legislation is …","paragraph_id":"para_265"},{"text":"33","paragraph_id":"para_266"},{"text":"According to those governments, Directive 2002/58 cannot therefore be interpreted as meaning that national measures concerning the safeguarding of national security fall within its scope. Article 1(3) of that directive defines the scope of that directive and excludes from that scope, as was previous …","paragraph_id":"para_267"},{"text":"34","paragraph_id":"para_268"},{"text":"In that regard, it should be stated that, under Article 1(1) thereof, Directive 2002/58 provides, inter alia, for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communications sector.","paragraph_id":"para_269"},{"text":"35","paragraph_id":"para_270"},{"text":"Article 1(3) of that directive excludes from its scope ‘activities of the State’ in specified fields, including activities in areas of criminal law and in the areas of public security, defence and State security, including the economic well-being of the State when the activities relate to State secu …","paragraph_id":"para_271"},{"text":"36","paragraph_id":"para_272"},{"text":"In addition, Article 3 of Directive 2002/58 states that the directive is to apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the European Union, including public communications netw …","paragraph_id":"para_273"},{"text":"37","paragraph_id":"para_274"},{"text":"In that context, Article 15(1) of Directive 2002/58 states that Member States may adopt, subject to the conditions laid down, ‘legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 [of that directive]’ (judgment of 21 December 2016, Tele2, C‑203/15 and C‑698/15 , EU:C:2016:970 , paragraph  71 ).","paragraph_id":"para_275"},{"text":"38","paragraph_id":"para_276"},{"text":"Article 15(1) of Directive 2002/58 necessarily presupposes that the national legislative measures referred to therein fall within the scope of that directive, since it expressly authorises the Member States to adopt them only if the conditions laid down in the directive are met. Further, such measur …","paragraph_id":"para_277"},{"text":"39","paragraph_id":"para_278"},{"text":"It is in the light of, inter alia, those considerations that the Court has held that Article 15(1) of Directive 2002/58, read in conjunction with Article 3 thereof, must be interpreted as meaning that the scope of that directive extends not only to a legislative measure that requires providers of el …","paragraph_id":"para_279"},{"text":"40","paragraph_id":"para_280"},{"text":"Concerning a legislative measure such as section 94 of the 1984 Act, on the basis of which the competent authority may give the providers of electronic communications services a direction to disclose bulk data to the security and intelligence agencies by transmission, it should be noted that, pursua …","paragraph_id":"para_281"},{"text":"41","paragraph_id":"para_282"},{"text":"It follows that the disclosure of personal data by transmission, like the storage or otherwise making available of data, constitutes processing for the purposes of Article 3 of Directive 2002/58 and, accordingly, falls within the scope of that directive (see, to that effect, judgment of 29 January 2008, Promusicae, C‑275/06 , EU:C:2008:54 , paragraph  45 ).","paragraph_id":"para_283"},{"text":"42","paragraph_id":"para_284"},{"text":"In addition, having regard to the considerations set out in paragraph 38 above and the general scheme of Directive 2002/58, an interpretation of that directive under which the legislative measures referred to in Article 15(1) thereof were excluded from the scope of that directive because the objecti …","paragraph_id":"para_285"},{"text":"43","paragraph_id":"para_286"},{"text":"The concept of ‘activities’ referred to in Article 1(3) of Directive 2002/58 cannot therefore, as was noted, in essence, by the Advocate General in point 75 of his Opinion in Joined Cases La Quadrature du Net and Others ( C‑511/18 and C‑512/18 , EU:C:2020:6 ), to which he makes reference in point 24 of his Opinion in the present case, be interpreted as covering the legislative measures referred to in Article 15(1) of that directive.","paragraph_id":"para_287"},{"text":"44","paragraph_id":"para_288"},{"text":"Article 4(2) TEU, to which the governments listed in paragraph 32 above have made reference, cannot invalidate that conclusion. Indeed, according to the settled case-law of the Court, although it is for the Member States to define their essential security interests and to adopt appropriate measures …","paragraph_id":"para_289"},{"text":"45","paragraph_id":"para_290"},{"text":"It is true that, in the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 , paragraphs  56 to  59 ), the Court held that the transfer of personal data by airlines to the public authorities of a third country for the purpose of preventing and combati …","paragraph_id":"para_291"},{"text":"46","paragraph_id":"para_292"},{"text":"However, having regard to the findings set out in paragraphs 36, 38 and 39 above, that case-law cannot be transposed to the interpretation of Article 1(3) of Directive 2002/58. Indeed, as the Advocate General noted, in essence, in points 70 to 72 of his Opinion in Joined Cases La Quadrature du Net a …","paragraph_id":"para_293"},{"text":"47","paragraph_id":"para_294"},{"text":"Furthermore, it should be noted that Directive 95/46, which was at issue in the case that gave rise to the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 ), has been, pursuant to Article 94(1) of Regulation 2016/679, repealed and replaced by that …","paragraph_id":"para_295"},{"text":"48","paragraph_id":"para_296"},{"text":"By contrast, where the Member States directly implement measures that derogate from the rule that electronic communications are to be confidential, without imposing processing obligations on providers of electronic communications services, the protection of the data of the persons concerned is not c …","paragraph_id":"para_297"},{"text":"49","paragraph_id":"para_298"},{"text":"Having regard to the foregoing considerations, the answer to the first question is that Article 1(3), Article 3 and Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU, must be interpreted as meaning that national legislation enabling a State authority to require providers of e …","paragraph_id":"para_299"},{"text":"Question 2","paragraph_id":"para_300"},{"text":"50","paragraph_id":"para_301"},{"text":"By its second question, the referring court seeks, in essence, to ascertain whether Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, is to be interpreted as precluding national legislation enabling a State authority …","paragraph_id":"para_302"},{"text":"51","paragraph_id":"para_303"},{"text":"As a preliminary point, it should be borne in mind that, according to the information set out in the request for a preliminary ruling, section 94 of the 1984 Act permits the Secretary of State to require providers of electronic communications services, by way of directions, if he considers it necess …","paragraph_id":"para_304"},{"text":"52","paragraph_id":"para_305"},{"text":"Such a disclosure of data by transmission concerns all users of means of electronic communication, without its being specified whether that transmission must take place in real-time or subsequently. Once transmitted, that data is, according to the information set out in the request for a preliminary …","paragraph_id":"para_306"},{"text":"53","paragraph_id":"para_307"},{"text":"As is apparent from, inter alia, recitals 6 and 7 thereof, the purpose of Directive 2002/58 is to protect users of electronic communications services from risks for their personal data and privacy resulting from new technologies and, in particular, from the increasing capacity for automated storage …","paragraph_id":"para_308"},{"text":"54","paragraph_id":"para_309"},{"text":"To that end, Article 5(1) of Directive 2002/58 provides that ‘Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation’. That provi …","paragraph_id":"para_310"},{"text":"55","paragraph_id":"para_311"},{"text":"Thus, Article 5(1) of that directive enshrines the principle of confidentiality of both electronic communications and the related traffic data and requires, inter alia, that, in principle, persons other than users be prohibited from storing, without those users’ consent, those communications and tha …","paragraph_id":"para_312"},{"text":"56","paragraph_id":"para_313"},{"text":"The prohibition on the interception of communications and data relating thereto laid down in Article 5(1) of Directive 2002/58 therefore encompasses any instance of providers of electronic communications services making traffic data and location data available to public authorities, such as the security and intelligence agencies, as well as the retention of that data by those authorities, regardless of how that data is subsequently used.","paragraph_id":"para_314"},{"text":"57","paragraph_id":"para_315"},{"text":"Thus, in adopting that directive, the EU legislature gave concrete expression to the rights enshrined in Articles 7 and 8 of the Charter, so that the users of electronic communications services are entitled to expect, in principle, that their communications and data relating thereto will remain anonymous and may not be recorded, unless they have agreed otherwise (judgment of 6 October 2020, La Quadrature du Net and Others , C‑511/18, C‑512/18 and C‑520/18, paragraph 109).","paragraph_id":"para_316"},{"text":"58","paragraph_id":"para_317"},{"text":"However, Article 15(1) of Directive 2002/58 enables the Member States to introduce an exception to the obligation of principle, laid down in Article 5(1) of that directive, to ensure the confidentiality of personal data, and to the corresponding obligations, referred to, inter alia, in Articles 6 an …","paragraph_id":"para_318"},{"text":"59","paragraph_id":"para_319"},{"text":"That being said, the option to derogate from the rights and obligations laid down in Articles 5, 6 and 9 of Directive 2002/58 cannot permit the exception to the obligation of principle to ensure the confidentiality of electronic communications and data relating thereto and, in particular, to the pro …","paragraph_id":"para_320"},{"text":"60","paragraph_id":"para_321"},{"text":"In addition, it is apparent from the third sentence of Article 15(1) of Directive 2002/58 that the Member States are not permitted to adopt legislative measures to restrict the scope of the rights and obligations provided for in Articles 5, 6 and 9 of that directive unless they do so in accordance w …","paragraph_id":"para_322"},{"text":"61","paragraph_id":"para_323"},{"text":"Those same issues also arise for other types of data processing, such as the transmission of that data to persons other than users or access to that data with a view to its use (see, by analogy, Opinion 1/15 ( EU-Canada PNR Agreement ) of 26 July 2017, EU:C:2017:592 , paragraphs  122 and  123 and the case-law cited).","paragraph_id":"para_324"},{"text":"62","paragraph_id":"para_325"},{"text":"Thus, the interpretation of Article 15(1) of Directive 2002/58 must take account of the importance both of the right to privacy, guaranteed in Article 7 of the Charter, and of the right to protection of personal data, guaranteed in Article 8 thereof, as derived from the case-law of the Court, as wel …","paragraph_id":"para_326"},{"text":"63","paragraph_id":"para_327"},{"text":"However, the rights enshrined in Articles 7, 8 and 11 of the Charter are not absolute rights, but must be considered in relation to their function in society (see, to that effect, judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18 , EU:C:2020:559 , paragraph  172 and the case-law cited).","paragraph_id":"para_328"},{"text":"64","paragraph_id":"para_329"},{"text":"Indeed, as can be seen from Article 52(1) of the Charter, that provision allows limitations to be placed on the exercise of those rights, provided that those limitations are provided for by law, that they respect the essence of those rights and that, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.","paragraph_id":"para_330"},{"text":"65","paragraph_id":"para_331"},{"text":"It should be added that the requirement that any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned ( judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18 , EU:C:2020:559 , paragraph  175 and the case-law cited).","paragraph_id":"para_332"},{"text":"66","paragraph_id":"para_333"},{"text":"Concerning observance of the principle of proportionality, the first sentence of Article 15(1) of Directive 2002/58 provides that the Member States may adopt a measure derogating from the principle that communications and the related traffic data are to be confidential where such a measure is ‘neces …","paragraph_id":"para_334"},{"text":"67","paragraph_id":"para_335"},{"text":"In that regard, it should be borne in mind that the protection of the fundamental right to privacy requires, according to the settled case-law of the Court, that derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary. In addition, an ob …","paragraph_id":"para_336"},{"text":"68","paragraph_id":"para_337"},{"text":"In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will …","paragraph_id":"para_338"},{"text":"69","paragraph_id":"para_339"},{"text":"As regards the question whether national legislation, such as that at issue in the main proceedings, meets the requirements of Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, it should be noted that the transmission of traffic data and …","paragraph_id":"para_340"},{"text":"70","paragraph_id":"para_341"},{"text":"In addition, in accordance with the settled case-law of the Court, the transmission of traffic data and location data to a third party constitutes interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, regardless of how that data is subsequently used. In that regard, …","paragraph_id":"para_342"},{"text":"71","paragraph_id":"para_343"},{"text":"The interference with the right enshrined in Article 7 of the Charter entailed by the transmission of traffic data and location data to the security and intelligence agencies must be regarded as being particularly serious, bearing in mind inter alia the sensitive nature of the information which that …","paragraph_id":"para_344"},{"text":"72","paragraph_id":"para_345"},{"text":"It should also be noted that the transmission of traffic data and location data to public authorities for security purposes is liable, in itself, to infringe the right to respect for communications, enshrined in Article 7 of the Charter, and to deter users of means of electronic communication from e …","paragraph_id":"para_346"},{"text":"73","paragraph_id":"para_347"},{"text":"Lastly, given the significant amount of traffic data and location data that can be retained continuously by a general retention measure and the sensitive nature of the information which that data may provide, the mere retention of that data by the providers of electronic communications services entails a risk of abuse and unlawful access.","paragraph_id":"para_348"},{"text":"74","paragraph_id":"para_349"},{"text":"As regards the objectives that may justify such interferences, and in particular the objective of safeguarding national security, at issue in the main proceedings, it should be noted, at the outset, that Article 4(2) TEU provides that national security remains the sole responsibility of each Member …","paragraph_id":"para_350"},{"text":"75","paragraph_id":"para_351"},{"text":"The importance of the objective of safeguarding national security, read in the light of Article 4(2) TEU, goes beyond that of the other objectives referred to in Article 15(1) of Directive 2002/58, inter alia the objectives of combating crime in general, even serious crime, and of safeguarding publi …","paragraph_id":"para_352"},{"text":"76","paragraph_id":"para_353"},{"text":"However, in order to satisfy the requirement of proportionality referred to in paragraph 67 above, according to which derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary, national legislation entailing interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter must meet the requirements stemming from the case-law cited in paragraphs 65, 67 and 68 above.","paragraph_id":"para_354"},{"text":"77","paragraph_id":"para_355"},{"text":"In particular, as regards an authority’s access to personal data, legislation cannot confine itself to requiring that authorities’ access to the data be consistent with the objective pursued by that legislation, but must also lay down the substantive and procedural conditions governing that use (see, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  192 and the case-law cited).","paragraph_id":"para_356"},{"text":"78","paragraph_id":"para_357"},{"text":"Accordingly, and since general access to all retained data, regardless of whether there is any link, at least indirect, with the aim pursued, cannot be regarded as being limited to what is strictly necessary, national legislation governing access to traffic data and location data must rely on object …","paragraph_id":"para_358"},{"text":"79","paragraph_id":"para_359"},{"text":"Those requirements apply, a fortiori, to a legislative measure, such as that at issue in the main proceedings, on the basis of which the competent national authority may require providers of electronic communications services to disclose traffic data and location data to the security and intelligenc …","paragraph_id":"para_360"},{"text":"80","paragraph_id":"para_361"},{"text":"Given that the transmission of traffic data and location data is carried out in a general and indiscriminate way, it is comprehensive in that it affects all persons using electronic communications services. It therefore applies even to persons for whom there is no evidence to suggest that their cond …","paragraph_id":"para_362"},{"text":"81","paragraph_id":"para_363"},{"text":"It follows that national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission exceeds the limits of what is strictly necessary and cannot be consi …","paragraph_id":"para_364"},{"text":"82","paragraph_id":"para_365"},{"text":"In the light of all the foregoing considerations, the answer to the second question is that Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation enabling a State aut …","paragraph_id":"para_366"},{"text":"Costs","paragraph_id":"para_367"},{"text":"83","paragraph_id":"para_368"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_369"},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_370"},{"text":"1.","paragraph_id":"para_371"},{"text":"Article 1(3), Article 3 and Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as am …","paragraph_id":"para_372"},{"text":"2.","paragraph_id":"para_373"},{"text":"Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as precluding national legislation enabling a State authority to requ …","paragraph_id":"para_374"},{"text":"Lenaerts","paragraph_id":"para_375"},{"text":"Silva de Lapuerta","paragraph_id":"para_376"},{"text":"Bonichot","paragraph_id":"para_377"},{"text":"Arabadjiev","paragraph_id":"para_378"},{"text":"Prechal","paragraph_id":"para_379"},{"text":"Safjan","paragraph_id":"para_380"},{"text":"Xuereb","paragraph_id":"para_381"},{"text":"Rossi","paragraph_id":"para_382"},{"text":"Malenovský","paragraph_id":"para_383"},{"text":"Bay Larsen","paragraph_id":"para_384"},{"text":"von Danwitz","paragraph_id":"para_385"},{"text":"Toader","paragraph_id":"para_386"},{"text":"Jürimäe","paragraph_id":"para_387"},{"text":"Lycourgos","paragraph_id":"para_388"},{"text":"Piçarra","paragraph_id":"para_389"},{"text":"Delivered in open court in Luxembourg on 6 October 2020.","paragraph_id":"para_390"},{"text":"A. Calot Escobar","paragraph_id":"para_391"},{"text":"Registrar","paragraph_id":"para_392"},{"text":"K. Lenaerts","paragraph_id":"para_393"},{"text":"President","paragraph_id":"para_394"},{"text":"(\n *1\n ) Language of the case: English.","paragraph_id":"para_395"}],"word_count":12438,"cites":["C-203/15","C-698/15","C-317/04","C-318/04","C-207/16","C-275/06","C-511/18","C-512/18","C-300/11","C-187/16","C-715/17","C-718/17","C-719/17","C-520/18","C-293/12","C-594/12","C-274/99","C-311/18","C-73/07","C-92/09","C-93/09"],"sha256":"c08d81f56a676ed205032ed6b3367195bfd58a797f01b3be8f5b6f306bd037a2","source_url":"https://publications.europa.eu/resource/celex/62017CJ0623.ENG.xhtml.ECR_62017CJ0623_EN_01.html","fetched_at":"2026-10-01T03:56:33.132+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-623-17-62017cj0623","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-623-17-62017cj0623","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-623-17-62017cj0623","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-623-17-62017cj0623"},"hash":"sha256:1d7c08a906624c83c7302877af60e8f9cc17337481b5d4fa0e0090d2465d168e","version":"legal-2026-10-23","expires":"2026-10-24T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-23+legal-2026-10-23+2026-10-23T10:36:22","content_hash":"sha256:1d7c08a906624c83c7302877af60e8f9cc17337481b5d4fa0e0090d2465d168e","revalidate_after":"2026-10-23T11:43:09.126Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-623-17-62017cj0623","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-623-17-62017cj0623"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-623-17-62017cj0623"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-623-17-62017cj0623"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":13},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-623-17-62017cj0623","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-30754207bc85eb4f44d64340ac14b3d1","response_hash":"sha256:1d7c08a906624c83c7302877af60e8f9cc17337481b5d4fa0e0090d2465d168e"}},"freshness":{"freshness_class":"stable","as_of":"2026-11-02T23:27:38.104Z","valid_for":604800,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-623-17-62017cj0623","note":"Oföränderligt objekt med hash. Får cachas länge.","tokens":24596}}