Reference for a preliminary ruling - Processing of personal data in the electronic communications sector - Confidentiality of communications - Providers of electronic communications services - General and undifferentiated retention of traffic data and location data for a period of six months - Combating serious crime - Access to the data retained - Information to be given to the data subjects - Right to a remedy - Directive 2002/58/EC - Article 15, paragraphs 1 and 2 - Directive (EU) 2016/680 - Articles 13 and 54 - Charter of Fundamental Rights of the European Union - Articles 7, 8, 11 and 47 as well as Article 52(1). Case C-350/21.
On those grounds, the Court (Sixth Chamber) ruled:
Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of fundamental rights of the European Union
must be interpreted as precluding :
national legislation providing, as a preventive measure, for the purpose of combating serious crime and preventing serious threats to public security, for the general and undifferentiated retention of traffic data and location data, even if that legislation limits such general and undifferentiated retention to a period of six months and provides for a number of guarantees as regards the retention of and access to the data in question;
national legislation that does not provide, in a clear and precise manner, that access to the stored data is limited to what is strictly necessary to achieve the purpose of the storage.
- Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights, and Articles 13 and 54 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, on the protection of individuals with regard to the processing of personal data by the competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA,
must be interpreted as meaning that :
they preclude national legislation providing for access by national authorities responsible for criminal investigations to lawfully stored traffic data and location data without ensuring that the persons whose data have been accessed by those national authorities are informed to the extent provided for by Union law, and without providing them with a remedy against unlawful access to those data.