Corporate Data Retention Requirements Limited by European Court

    Jan 10, 2017

    European Union (EU) countries cannot enact laws that impose a blanket requirement on companies to retain personal data and make it available to law enforcement authorities, the Court of Justice of the European Union (CJEU) stated in a December 21 ruling. The decision stems from data retention cases referred to the Court from Sweden and the United Kingdom seeking interpretations of Article 15 of the European Privacy Directive regarding the processing of personal data and the protection of privacy in the electronic communications sector.

    According to the court, EU governments can require electronic communications services providers to retain traffic and location data only for specific law enforcement-related purposes.  “The Court states that any national legislation to that effect must be clear and precise and must provide for sufficient guarantees of the protection of data against risks of misuse,” the CJEU said in a press release. “The legislation must indicate in what circumstances and under which conditions a data retention measure may, as a preventive measure, be adopted, thereby ensuring that the scope of that measure is, in practice, actually limited to what is strictly necessary.”

    The court also ruled that access to retained data must be subject to prior review by either a court or an independent body, except in cases of urgency. The ruling also has implications for other privacy and data security regimes, such as the EU-U.S. Privacy Shield, because it requires that national legislation make provisions for that data to be retained within the EU.


    The online Global Policy Brief is intended to help you stay current on international news and events. Further information about the issue is accessed by clicking on the link provided at the end of each summary.

    Want to sign up to receive an email version of the Global Policy Brief? It's free! Just tell us a little about yourself and you'll receive a monthly dose of the latest in legislation, regulation, and more.

    © 2017, ARMA International