Fundamental rights in CJEU data retention case law: Towards a balanced regime in response to Member States’ concerns?

Data retention laws in the EU Member States have been in a state of flux following Digital Rights Ireland and the annulment of Directive 2006/24/EC due to a violation of the fundamental rights to respect for private life and to the protection of personal data. For many Member States, it remained unclear what should be the impact of the directive’s invalidation on domestic data retention regimes. In subsequent case law, the CJEU has sought to clarify the requirements deriving from EU law for national data retention legislation. Whilst the CJEU has ruled that EU law precludes national rules that prescribe a general and indiscriminate retention of traffic and location data by providers of electronic communication services and networks, it has also carved out a number of important exceptions that may justify interference with fundamental rights. Relevant cases have attracted much attention, with several national governments submitting observations to the CJEU on what is admittedly a particularly complex and sensitive field of law. This contribution studies CJEU data retention case law and its evolution, examining the ways in which the CJEU has positioned itself vis-à-vis Member States’ arguments on the balance to strike between protecting fundamental rights, safeguarding national security and fighting serious crime.