1.

In recent years the Court of Justice has maintained a consistent line of case‑law on the retention of and access to personal data, which includes the following landmark rulings:

2.

The authorities in some Member States are concerned by these judgments (particularly by the second of them) because, in their view, the result is to deprive them of an instrument which they consider essential to the safeguarding of national security and countering terrorism. That is why some of those Member States argue that the case‑law in question should be overturned or qualified.

3.

That same concern has been highlighted by certain courts of the Member States in four references for preliminary rulings, ( 7 ) on all of which I deliver my Opinions today.

4.

Primarily, the four cases pose the problem of the application of Directive 2002/58 to activities related to national security and counter-terrorism. If that directive were to apply in this field, one would then have to clarify the extent to which Member States can restrict the privacy rights that it protects. Finally, it will be necessary to examine to what extent the various national laws (the legislation of the United Kingdom, ( 8 ) Belgium ( 9 ) and France ( 10 )) on this subject comply with EU law as interpreted by the Court of Justice.

5.

I refer to the relevant point of my Opinion in Joined Cases C‑511/18 and C‑512/18.

6.

Pursuant to section 94, the Secretary of State may give an operator of a public electronic communications network such general or specific directions as appear to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom.

7.

Section 1 provides as follows:

‘(1)   The Secretary of State may by notice require a public telecommunications operator to retain relevant communications data if the Secretary of State considers that the requirement is necessary and proportionate for one or more of the purposes falling within paragraphs (a) to (h) of section 22(2) of the Regulation of Investigatory Powers Act 2000 [(“RIPA”)] .

(2)   A retention notice may—

(3)   The Secretary of State may by regulations make further provision about the retention of relevant communications data.

(4)   Such provision may, in particular, include provision about—

…

(5)   The maximum period provided for by virtue of subsection (4)(b) must not exceed 12 months beginning with such day as is specified in relation to the data concerned by regulations under subsection (3).

(6)   A public telecommunications operator who retains relevant communications data by virtue of this section must not disclose the data except—

(7)   The Secretary of State may by regulations make provision, which corresponds to any provision made (or capable of being made) by virtue of subsection (4)(d) to (g) or (6), in relation to communications data which is retained by telecommunications service providers by virtue of a code of practice under section 102 of the Anti-terrorism, Crime and Security Act 2001.’

8.

Section 21 provides:

‘…

(4)   In this Chapter “communications data” means any of the following—

…

(6)   In this section “traffic data”, in relation to any communication, means—

…’

9.

Section 22 provides that:

‘(1)   This section applies where a person designated for the purposes of this Chapter believes that it is necessary on grounds falling within subsection (2) to obtain any communications data.

(2)   It is necessary on grounds falling within this subsection to obtain communications data if it is necessary—

(4)   Subject to subsection (5), where it appears to the designated person that a postal or telecommunications operator is or may be in possession of, or be capable of obtaining, any communications data, the designated person may, by notice to the postal or telecommunications operator, require the operator—

(5)   The designated person shall not grant an authorisation under subsection (3) or give a notice under subsection (4), unless he believes that obtaining the data in question by the conduct authorised or required by the authorisation or notice is proportionate to what is sought to be achieved by so obtaining the data.’

10.

Under section 65, a complaint may be made to the Investigatory Powers Tribunal if there is reason to believe that data has been acquired inappropriately.

11.

According to the referring court, the main proceedings concern the acquisition and use by the United Kingdom Security and Intelligence Agencies (‘SIAs’) of bulk communications data.

12.

That data relates to ‘who’ is using the telephone and internet, and to ‘when, where, how and with whom’ they are using it. It includes the location of mobile and fixed-line telephones from which calls are made or received, and the location of computers used to access the internet. It does not include the content of the communications, which may only be obtained under a court order.

13.

The applicant in the main proceedings (Privacy International, a non‑governmental human rights organisation) has commenced proceedings in the referring court, on the grounds that the acquisition and use of the aforesaid data by the SIAs are in breach of the respect for private life enshrined in Article 8 of the European Convention on Human Rights (‘ECHR’) and are contrary to EU law.

14.

The defendant authorities ( 13 ) argue that the exercise of their powers in this field is lawful and essential, in particular, in order to protect national security.

15.

According to the information in the order for reference, the SIAs, pursuant to directions given by the Secretary of State under section 94 of the 1984 Act, receive bulk communications data via the operators of public electronic communications networks.

16.

That data includes traffic and location data, as well as information on users’ social, business and financial activities, communications and travel. Once the data is in their possession, the SIAs retain it securely and use techniques (such as filtering and aggregation) that are non-targeted, that is, not directed at specific, known targets.

17.

The referring court finds as a fact that those techniques are essential to the work of the SIAs in countering serious threats to public security, particularly terrorism, espionage and nuclear proliferation. The SIAs’ capabilities to acquire and use the data are essential to the protection of the national security of the United Kingdom.

18.

In the view of the referring court, the measures at issue are consistent with national law and with Article 8 of the ECHR. However, it has doubts about their compatibility with EU law, in view of the Tele2 Sverige and Watson judgment.

19.

In that context, the referring court refers the following questions to the Court of Justice for a preliminary ruling:

20.

The background to those questions is set out as follows by the referring court:

21.

The reference for a preliminary ruling was lodged at the Registry of the Court on 31 October 2017.

22.

Written observations have been submitted by the Belgian, Cypriot, Czech, Estonian, French, German and Hungarian Governments, Ireland, the Latvian, Netherlands, Norwegian, Polish, Portuguese, Spanish, Swedish and United Kingdom Governments, and by the European Commission.

23.

A public hearing took place on 9 September 2019; it was held jointly with the hearings in Cases C‑511/18, C‑512/18 and C‑520/18, and was attended by the parties to the four references for a preliminary ruling, the governments listed above, the Commission and the European Data Protection Supervisor.

24.

In the Opinion which I also deliver today in Joined Cases C‑511/18 and C‑512/18, I explain why, in my view, Directive 2002/58 ‘applies, in principle, when electronic services providers are required by law to retain their subscribers’ data and to allow public authorities access to it. This position remains unchanged where the requirements are imposed on providers for reasons of national security’. ( 15 )

25.

In developing my arguments, I address the impact of the judgment of the Court of 30 May 2006, Parliament v Council and Commission, ( 16 ) and the Tele2 Sverige and Watson judgment, and argue for a holistic interpretation that covers both judgments. ( 17 )

26.

In that Opinion, having first stated that Directive 2002/58 applies, I examine the exception for national security included in it and the impact of Article 4(2) TEU. ( 18 )

27.

Without prejudice to the arguments set out below, I refer to what I have said in that Opinion and in my Opinion in Case C‑520/18.

28.

Under the legislation at issue in these proceedings, providers of electronic communications services are under an obligation not only to retain, but also to process the data they possess as a consequence of the service they provide to users of public communications networks in the European Union. ( 19 )

29.

Those operators are subject to a mandatory requirement to transmit that data to the SIAs. The point at issue here is whether, in view of its purpose, the effect of Article 15(1) of Directive 2002/58 is that that transmission can automatically be excluded from the scope of EU law.

30.

In my opinion, it cannot. The retention of that data and its subsequent transmission can be classed as processing of personal data performed by providers of electronic communications services, meaning that these activities naturally fall within the scope of Directive 2002/58.

31.

National security concerns cannot, as suggested by the referring court, prevail over that conclusion, with the result that the requirement at issue would not come within the scope of EU law. I reiterate that, in my view, providers are required to process data in connection with the provision of publicly available electronic communications services in public communications networks in the European Union, which is precisely the scope of application of Directive 2002/58, as set out in Article 3(1) of the directive.

32.

Once that premiss has been established, the next issue for debate is not the activities of the SIAs (which, as I have noted above, could fall outside the scope of EU law if they did not affect electronic communications operators), but the retention and subsequent transmission of the data held by those operators. From this perspective, at stake are the fundamental rights guaranteed by the European Union.

33.

Once again, the key factor in resolving this debate is the requirement for general and indiscriminate retention of data to which the public authorities are given access.

34.

As the referring court places particular emphasis in this case on the activities of the SIAs connected with national security, I would like to reproduce some of the points I made on this issue in my Opinion in Joined Cases C‑511/18 and C‑512/18, which is also delivered today:

…

…

…

35.

The referring court has focused on the interpretation given by the Court in the Tele2 Sverige and Watson judgment, and describes the difficulties that it believes would arise if that interpretation were to be applied in this case.

36.

The Tele2 Sverige and Watson judgment set out the conditions that must be satisfied by national legislation that establishes a requirement to retain traffic and location data for subsequent access by public authorities.

37.

Just as in Cases C‑511/18 and C‑512/18, and for similar reasons, I believe that the national legislation cited in this reference does not satisfy the conditions established in the Tele2 Sverige and Watson judgment, because it involves general and indiscriminate retention of personal data that readily provides a detailed account of the life of the persons involved, for a lengthy period of time.

38.

In the Opinion in those two cases I consider whether it would be possible to qualify or expand on the case-law set out in that judgment, in view of its consequences for counter-terrorism or the protection of the State from other similar threats to national security.

39.

Again, I reproduce some of the points made in that Opinion where, in essence, I argue that, while that case-law can be qualified, its essential content should be endorsed:

40.

In the event that the answer to the first question is ‘yes’, the referring court asks a second question. In these circumstances, it would like to know what ‘other requirements in addition to those imposed by the ECHR’ or arising from the Tele2 Sverige and Watson judgment should be imposed.

41.

In that regard, it asserts that the imposition of the requirements in the Tele2 Sverige and Watson judgment ‘would frustrate the measures taken to safeguard national security by the SIAs’.

42.

As I suggest that the answer to the first question is ‘no’, there is no need to address the second question. As noted by the referring court, this latter question is conditional upon a finding that the ‘bulk acquisition and automated processing techniques’ applied to the personal data of all users in the United Kingdom, which the operators of electronic communications services would be required to transmit to the SIAs, is compatible with EU law.

43.

If the Court of Justice were to consider it necessary to reply to the second question, I believe that the Court should endorse the conditions in the Tele2 Sverige and Watson judgment referred to above as regards:

44.

I reiterate that it would suffice to confirm these mandatory requirements, for the reasons I have set out in the Opinions in Joined Cases C‑511/18 and C‑512/18 and Case C‑520/18, and that there is no need to establish ‘any other’ additional requirements as alluded to by the referring court.

45.

In the light of the above, I recommend that the Court of Justice should reply to the Investigatory Powers Tribunal (United Kingdom) in the following terms:

Article 4 TEU and Article 1(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) should be interpreted as precluding national legislation which imposes an obligation on providers of electronic communications networks to provide the security and intelligence agencies of a Member State with ‘bulk communications data’ which entails the prior general and indiscriminate collection of that data.

As a subsidiary issue:

Access on the part of the security and intelligence agencies of a Member State to data transmitted by the providers of electronic communications networks must comply with the conditions established in the judgment of 21 December 2016, Tele2 Sverige and Watson (C‑203/15 and C‑698/15, EU:C:2016:970).