Case C-594/12, Seitlinger – Austrian and EU data retention law
Are Articles 3, 4, 5, 6, 7, 8 and 9 of the EU’s data retention Directive 2006/24/EC compatible with Articles 7, 8 and 11 of the EU Charter of Fundamental Rights?
Facts
There are three actions to this reference from the Austrian Constitutional Court. Each concerns the EU’s data retention Directive and whether aspects of the Directive are compatible with EU fundamental rights law.
One action involves a Mr Seitlinger. He uses the telephone, the internet, and Email both for work purposes and in his private life. Consequently, the information which he sends and receives passes over public telecoms networks. Under the Austrian Telecommunications Act of 2003, his telecoms provider is legally required to collect and store data about his use of the telecoms network.
Mr Seitlinger realised that this collection and storage of data about him was in no way necessary for the technical purposes of getting the information from A to B on the network. Nor indeed was the collection and storage of this data even remotely necessary for billing purposes. And Mr Seitlinger had certainly not consented to this use of the data about him. The sole reason for all of this extra data being collected and stored was the Austrian Telecommunications Act of 2003.
Mr Seitlinger therefore brought an action in which he alleged that the statutory obligations on his telecoms provider were breaching his fundamental rights under Article 8 of the EU Charter.
A second piece of litigation which arrived at the Austrian Constitutional Court involved the government of the Austrian Land of Carinthia [Kärntner Landesregierung]. The Land had looked at the Austrian legislation and had taken the view that the way in which Austria had implemented the EU’s data retention directive had resulted in the mass violation of people’s fundamental rights. The Land was particularly concerned by the blanket storage of all data traffic, geo-location data, and data relating to the frequency and the timing of the conversations between individuals. It pointed out that all this data allowed inferences to be drawn about the content of what was being communicated. If people were aware that all of this data was being recorded, it would change the very patterns of their communication.
The Land also questioned the significance of the information that was being gleaned in this way, particularly when it came to reliability. Would not people wishing to avoid having data stored about them merely use prepaid mobile telephone cards? And when it came to the proportionality of the Austrian measures, this too was doubted by the Austrian Land. One of the stated aims of the legislation was the detection, investigation and prosecution of serious criminal offences but this seemed to be appropriate only to a very limited extent, and in comparison with the mass violation of fundamental rights, disproportionate. All in all, the Land could not square the EU’s data retention directive with Article 8 of the EU Charter.
A third action involved more than 11 100 private individuals. They too alleged that their fundamental rights under the EU Charter were being infringed.
On considering these three actions, and in light of the fact that the measures were intended for the detection of serious crime and bringing prosecutions, the 14 judges of the Austrian Constitutional Court were nevertheless were doubtful about the compatibility of the EU data protection rules with the EU Charter of Fundamental Rights. The President of the Constitutional Court explained that almost without exception, people’s data was being stored even though those individuals gave no rise for suspicion. And yet authorities were being informed about the private lives of people, and there was an increased risk of this information being misused.
Questions Referred
An unofficial translation of the questions asked by the Austrian Constitutional Court reads:
1 On the validity of the acts of the EU institutions:
Are Articles 3 to 9 of Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, compatible with Articles 7, 8 and 11 of the European Charter of Fundamental Rights
2 On the interpretation of the Treaties:
2.1 In light of the explanations to Article 8 EU Charter, which according to Article 52(7) of the Charter are incorporated to guide the interpretation of the Charter and duly regarded by the Constitutional Court; when assessing the justifications for infringements, is Directive 95/46/EC on the protection of individuals with regard to the processing of personal data
and on the free movement of such data, and Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, to be given equal weight bearing in mind Article 8(2) and Article 52(1) of the Charter?
2.2 What is the relationship between [the mention of] ‘Union law’ in the last sentence of Article 52(3) of the Charter and those directives falling within the area of data protection law?
2.3 In view of these, are the provisions and limitations in Directive 95/46/EC and Regulation (EC) 45/2001 for observing the fundamental data protection rights in the Charter, amended as a result of subsequent secondary legislation, to be borne in mind when interpreting Article 8 of the EU Charter?
2.4 In light of Article 52(4) of the Charter of the constitution for guaranteeing a higher level of protection in Article 53, does this have the consequence that the applicable limits under the Charter are to be more narrowly construed than the limitations permitted under secondary legislation?
2.5 In light of Article 52(3) of the Charter, Recital 5 of the preamble, and the explanations to Article 7 of the Charter, according to which the right enshrined in it corresponds to Article 8 ECHR, can the case law of the European Court of Human Rights on Article 8 ECHR offer perspectives on the interpretation of Article 8 of the Charter which influence the interpretation of the last-mentioned Articles?
Comment
Data retention laws have long been the subject of concern in several EU Member States.
Austria was hauled before the CJEU for its failure to implement the data retention directive in time (Case C-189/09, European Commission v Republic of Austria).
Germany has now become the object of an enforcement action for its alleged failure to implement the directive in time (Case C-329/12, European Commission v Federal Republic of Germany). The history to this action is of interest in so far as it stems largely from the fallout of a ruling of the German Constitutional Court back in 2010. In that case, the Constitutional Court had been asked not only to consider the legality of aspects of the German data retention legislation but also to make a reference to the CJEU in order to have the EU’s data retention directive declared invalid. The Constitutional Court refused to make a reference but then went on in the ruling to find that the German implementing provisions were unconstitutional under the German Constitution, and were thus void. As a result of the German Constitutional Court’s ruling, the German state decided to implement a part of the Directive by using planks of existing German legislation, and it then drafted new legislation to implement the rest of the Directive. However, the new draft legislation never came into force. And this has given the EU Commission the opportunity to claim that Germany has failed to meet its obligation to transpose the directive.
Data retention law has also been the subject of litigation brought not only by the Irish State but also against it. In Case C-301/06, Ireland sought to have the data retention Directive annulled for lacking the correct basis in the EC Treaty. The Grand Chamber of the CJEU held that the Directive was indeed properly enacted on the basis of Article 95 EC Treaty because differing rules on the retention of data would be likely to impact directly upon the functioning of the internal market. However, the CJEU expressly stated in paragraph 57 of its judgment that the scope of the action before it related solely to the choice of legal basis for the directive; it did not deal with any possible infringement arising from an interference with the exercise of the right to privacy. This observation has now been repeated in the context of recent litigation brought against the Irish State by Digital Rights Ireland – litigation which has also resulted in a fresh reference to the CJEU in which concerns about the data retention directive are expressed, see further Case C-293/12, Digital Rights Ireland – telecoms, privacy and freedom of expression.