LUXEMBOURG (Reuters) -- EU governments cannot hold indiscriminately personal data unless there is a serious threat to national security, Europe’s top court said on Tuesday, dealing a setback to EU countries banking on mass data retention laws to combat crime and safeguard national security.
The ruling by the Court of Justice of the European Union (CJEU) comes after major attacks by Islamist militants in France, Belgium and Britain in recent years.
Governments argue that access to data, especially that collected by telecoms operators, can help prevent such incidents, while operators and civil rights activists oppose such access.
The latest case was triggered after Deutsche Telekom unit Telekom Deutschland and internet service provider SpaceNet AG which challenged Germany’s data retention law arguing it breached EU rules.
The German court subsequently sought the advice of the CJEU which said such data retention can only be allowed under very strict conditions.
“The Court of Justice confirms that EU law precludes the general and indiscriminate retention of traffic and location data, except in the case of a serious threat to national security,” the judges said.
“However, in order to combat serious crime, the member states may, in strict compliance with the principle of proportionality, provide for, inter alia, the targeted or expedited retention of such data and the general and indiscriminate retention of IP addresses,” they said.
According to eco – Association of the Internet Industry, which backs SpaceNet, Germany’s blanket data storage requirement costs the industry millions of euros.
The cases are C-793/19 SpaceNet and C-794/19 Telekom Deutschland.