The European Court of Justice today ruled that the EU legislation on mass surveillance contravenes European law. The case was brought before the Court by EDRi member Digital Rights Ireland, together with the Austrian Working Group on Data Retention.

After eight years, this affront to the fundamental rights of European citizens has finally been declared illegal. Eight years of abuses of personal data and eight years of reassurances from EU Member States and the Commission that the measure was legal

said Joe McNamee, Executive Director of European Digital Rights.

In today’s press release, the Court stated that

by requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data.

In its judgement, the Court states that the Directive “applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime.” In particular, the Court critised the untargeted nature of the surveillance measure. It highlighted the absence of any objective criterion by which to determine the limits of the access of the competent national authorities to the data.

In short,

Directive 2006/24 does not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter.

Judgement

Press release (pdf)

Implementation Report (pdf)