Posted on Oct 6, 2020 at 6:24 PMUpdated Oct 6, 2020 6:58 PM
The European Union reaffirms its opposition in principle to mass surveillance. In a long-awaited ruling on Tuesday, the EU Court of Justice confirms that it is illegal for a member state to collect and store the connection data of the population massively and in an undifferentiated manner.
If the situation needed this clarification, it was because several countries did not see it that way. In France, for example, the law requires telecom operators and Internet service providers to keep all technical connection data for one year.
It’s not about the content of the conversations, but about the metadata: who is connecting to what? Who calls who? What day, what time? For how long ? From where? … So many indications which allow to know a lot about a person and his habits and which can be useful in the context of a police investigation or intelligence services, but also for example in the fight led by the Hadopi against the illegal downloading of works protected by copyright.
Deep sea fishing
Only, “These obligations of transmission and general and undifferentiated storage of such data constitute particularly serious interference with the fundamental rights guaranteed by the Charter [des droits fondamentaux de l’Union européenne] “, write the judges of Luxembourg.
” It is not a surprise. This is the fourth judgment of the Court of Justice of the European Union which goes in the same direction ”, specifies Me Romain Perray, associate lawyer at McDermott Will & Emery. As early as 2014, European judges had invalidated the entirety of a 2006 directive which allowed massive collection, on the same basis.
In 2016, in the Tele2 judgment, they ruled that the national texts organizing this same type of data collection were not valid either. And in 2018, they reaffirmed the same principle, which Me Romain Perray sums up as follows: “You are not allowed to go big game fishing. “
La Quadrature du Net – one of the associations that brought the case to European justice – nevertheless speaks of a “victorious defeat”. Because, despite the reaffirmed principle, the Court also opens the door to many derogations – for example “In situations where the Member State concerned faces a serious threat to national security which is real and current or foreseeable ”.
For La Quadrature du Net, “If the Court affirms that France can no longer impose this general retention of connection data, it reveals a certain number of important exception regimes. This decision is a defeat in the sense that these exceptions reduce the protection of privacy and will inevitably lead to abuse ”.