1. 

Approximation of laws – Telecommunications sector – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58 – Power of Member States to limit the scope of certain rights and obligations – National measures requiring providers of electronic communications services to retain, generally and indiscriminately, traffic and location data – Objective of combating serious crime and preventing serious threats to public security – Unlawful – Duration of the period of general and indiscriminate retention of those data – Existence of safeguards concerning the retention of and access to such data – Irrelevant – Requirement of proportionality

(Charter of Fundamental Rights of the European Union, Arts 7, 8, 11 and 52(1); European Parliament and Council Directive 2002/58, as amended by Directive 2009/136, Art. 15(1))

(see paragraphs 49-52, 56-60, 63-67, operative part 1)

2. 

Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – National legislation providing for access by criminal authorities to traffic and location data lawfully retained – Failure to respect the data subject’s right to be informed of the processing of such data concerning him or her – Absence of an effective remedy against unlawful access – Unlawful

(Charter of Fundamental Rights of the European Union, Arts 7, 8, 11 and 52(1); European Parliament and Council Directives 2002/58, as amended by Directive 2009/136, Art. 15(1) and (2), and 2016/680, Arts 13 and 54)

(see paragraphs 69-76, operative part 2)

1. 

Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union

must be interpreted as precluding

2. 

Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights, and Articles 13 and 54 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA,

must be interpreted as

precluding national legislation that provides for access, on the part of the national authorities competent to undertake criminal investigations, to lawfully retained traffic and location data, without guaranteeing that the persons whose data have been accessed by those national authorities are informed thereof to the extent provided for under EU law, and without those persons having any remedy against unlawful access to those data.