Court allows retention of call and e-mail data Ireland had argued that national governments rather than the European Commission should have decided on law.

The European Union’s highest court has upheld a law that forces telecoms companies to retain information on phone calls and e-mails, ruling that the European Commission was correct to ground the law on a desire to regulate the internal market.

The European Court of Justice (ECJ) said the data-retention directive, adopted in 2006 to help police investigate terrorists and serious cross-border crimes, ensures that the obligations and costs imposed on telecoms companies are the same throughout the EU, thereby allowing for the “functioning of the internal market”.

The Irish government, which had brought the challenge, argued in court that the purpose of collecting the data was criminal investigation and that a different legal basis should therefore have been used, with the proposal agreed between national governments. If a law is based on an internal market basis, it has to be proposed by the Commission and approved by both the Council of Ministers and the European Parliament.

The Irish government also pointed out that in 2006 the ECJ had struck down an agreement between the EU and the US on the exchange of information on airline passengers because the wrong legal basis had been used – the legal basis regulating the internal market was used, rather than one concerning criminal investigation.

But the Court rejected this argument, saying that unlike the decision on passenger name records, which concerned the transfer of personal data “within a framework instituted by the public authorities in order to ensure public security”, the law on retaining data covered the activities of service providers in the internal market and did not contain “any rules governing the activities of public authorities for law-enforcement purposes”.

The ECJ added that the original EU legislation on data protection from 1995 was introduced under a legal basis regulating the internal market. The directive was aimed at telecoms operators alone and did not regulate the activities of police officers, it said.

The case will have little practical effect on the data-retention directive since it has been implemented by all 27 member states. Ireland was ordered to pay costs.