G.D. v The Commissioner of the Garda Síochána and Others

1.

This request for a preliminary ruling – to which can be added the requests in Joined Cases C‑793/19, SpaceNet, and C‑794/19, Telekom Deutschland, in which I am also delivering the Opinion ( 2 ) today – demonstrates, once again, the concern raised in some Member States by the Court’s case-law on the retention of and access to personal data generated in the electronic communications sector.

2.

In the Opinions in Cases C‑511/18 and C‑512/18, La Quadrature du Net and Others, ( 3 ) and C‑520/18, Ordre des barreaux francophones et germanophone and Others, ( 4 ) I stated that the following were, at that time, the most important milestones in that case-law:

3.

In 2018, a number of courts of certain Member States submitted requests for a preliminary ruling to the Court, expressing their uncertainties concerning whether those judgments (of 2014, 2016 and 2018) might deprive national authorities of a necessary tool for safeguarding national security and fighting crime and terrorism.

4.

Four of those requests for a preliminary ruling resulted in the judgments in Privacy International ( 10 ) and La Quadrature du Net and Others, ( 11 ) both of 6 October 2020, which essentially confirmed the case-law laid down in the judgment in Tele2 Sverige, while introducing a number of supplementary qualifications.

5.

As a result of their origin (the Grand Chamber of the Court of Justice), their content and their intention of explaining in detail, in a dialogue with the referring courts, the grounds which, nevertheless, justified the views set out therein, those two ‘recapitulatory’ judgments of 6 October 2020 might be expected to have resolved the debate. Any other request for preliminary ruling on the same subject would therefore warrant a reasoned order pursuant to Article 99 of the Rules of Procedure of the Court of Justice.

6.

However, prior to 6 October 2020, the Registry of the Court had received three other requests for a preliminary ruling (in this case and in Joined Cases C-793/19 and C-794/19), which again called into question the case-law laid down in connection with Article 15(1) of Directive 2002/58.

7.

The Court made each of the referring courts aware of the judgments of 6 October 2020, in case it should wish to withdraw its request for a preliminary ruling. When the referring court insisted on maintaining its request, as I shall explain below, ( 12 ) it was decided not to apply Article 99 of the Rules of Procedure and that the Grand Chamber of the Court of Justice would reply to it.

8.

According to Article 5(1) (‘Confidentiality of the communications’):

‘Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so in accordance with Article 15(1). This paragraph shall not prevent technical storage which is necessary for the conveyance of a communication without prejudice to the principle of confidentiality.’

9.

Article 6 (‘Traffic data’) provides:

‘1.   Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1).

2.   Traffic data necessary for the purposes of subscriber billing and interconnection payments may be processed. Such processing is permissible only up to the end of the period during which the bill may lawfully be challenged or payment pursued.

…’

10.

Article 15 (‘Application of certain provisions of Directive 95/46/EC’) ( 13 ) provides in paragraph 1:

‘Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.’

11.

The Supreme Court’s presentation of national law in paragraph 3 of its order for reference is as follows:

12.

Appendix I to the order for reference includes some additional information about the provisions of the 2011 Act. According to that information:

13.

G.D. was sentenced in 2015 to life imprisonment for murder. During the appeal proceedings before the Irish Court of Appeal, he unsuccessfully contested the admissibility of certain incriminating evidence based on telephony data retained under national law.

14.

In parallel to the criminal appeal, G.D. commenced civil proceedings ( 14 ) before the High Court (Ireland) in order to challenge the validity of a number of provisions of the 2011 Act, pursuant to which the telephony data concerned was retained and could be accessed.

15.

By judgment of 6 December 2018, the High Court granted G.D.’s application seeking a declaration that Section 6(1)(a) of the 2011 Act was inconsistent with Article 15(1) of Directive 2002/58, in conjunction with Articles 7, 8 and 52(1) of the Charter.

16.

The Irish Government appealed against that judgment to the Supreme Court (Ireland), which has referred the following questions to the Court of Justice for a preliminary ruling:

17.

The Supreme Court states that evidence of the kind tendered in the criminal proceedings against G.D. is decisive for the detection and prosecution of certain categories of serious offence. It points out that, if the universal retention of metadata were not permitted, even with any conditions of access which may be in place, it would not be possible to identify or properly prosecute the perpetrators of many such offences.

18.

In that connection, the Supreme Court has made the following findings:

19.

The request for a preliminary ruling was received at the Registry of the Court on 25 March 2020.

20.

Written observations were lodged by G.D., the Commissioner of the Garda Síochána, the Belgian, Czech, Cypriot, Danish, Spanish, Estonian, Finnish, French, Netherlands, Polish, Portuguese and Swedish Governments, and the European Commission.

21.

The referring court was invited to state its views on the possible withdrawal of the reference for a preliminary ruling following the judgment in La Quadrature du Net, and it indicated, by letter received at the Registry on 27 October 2020, that it intended to continue with the reference. ( 15 )

22.

The hearing, held jointly with that in Joined Cases C‑793/19, SpaceNet, and C‑794/19, Telekom Deutschland, took place on 13 September 2021. It was attended by those who had lodged written observations (with the exception of the Belgian, Czech and Portuguese Governments) and the European Data Protection Supervisor.

23.

Most of the parties who have entered an appearance in the proceedings agree that the six questions referred for a preliminary ruling by the Supreme Court on the subject of Article 15(1) of Directive 2002/58 can be grouped together in three blocks, relating to:

24.

In my view, all those questions were answered in full in the judgments in La Quadrature du Net, and of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications). ( 16 )

25.

In relation to the judgment in La Quadrature du Net, after that judgment was notified to it, the referring court was particularly laconic in its reply to the Court.

26.

Having acknowledged that that judgment assists in clarifying EU law, the referring court merely stated that ‘the type of case which underlies the proceedings in which the reference of the Supreme Court has been made differs significantly from the type of situations which underlay the proceedings giving rise to that judgment.’ ( 17 )

27.

Those assertions of the referring court, made after its request for a preliminary ruling, do not call into question the case-law laid down in La Quadrature du Net (as some of the governments intervening in the proceedings have done) or seek clarifications concerning the content of that judgment.

28.

Although the ‘situations which underlay’ ( 18 ) the proceedings giving rise to the judgment in La Quadrature du Net differed from that underlying this reference for a preliminary ruling, the important point is that the case-law laid down in general terms in that judgment by the Court of Justice applies erga omnes and is binding on all the courts of the Member States in relation to the interpretation of Directive 2002/58.

29.

As regards access to retained data, I also believe that the judgment in Prokuratuur, which was given after the national court’s decision to continue with the reference for a preliminary ruling, dispels the uncertainties raised in the reference.

30.

In those circumstances, and unlike the approach I have taken in the Opinion in SpaceNet and Deutsche Telekom, ( 19 ) I shall confine myself in this Opinion to establishing the consequences for this reference for a preliminary ruling, as it was originally formulated, which flow from the judgments in La Quadrature du Net and Prokuratuur.

31.

The referring court essentially asks:

32.

As I also argue in the Opinion in SpaceNet and Telekom Deutschland, ( 20 ) the answer to those questions cannot differ from the answer given by the Court in the judgment in La Quadrature du Net, which reviewed the case-law in that regard.

33.

It is important to recall, first, the case-law laid down by the Court in that judgment, paragraph 168 of which summarises it as follows:

‘Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding legislative measures which, for the purposes laid down in Article 15(1), provide, as a preventive measure, for the general and indiscriminate retention of traffic and location data. By contrast, Article 15(1), read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not preclude legislative measures that:

provided that those measures ensure, by means of clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.’

34.

The central idea of the Court’s case-law in relation to Directive 2002/58 is that the users of electronic communications services are entitled to expect, in principle, that their communications and data relating thereto will remain anonymous and may not be recorded, unless they have agreed otherwise. ( 21 )

35.

Article 15(1) of Directive 2002/58 permits exceptions to the obligation to ensure the confidentiality of personal data and to the corresponding obligations. The judgment in La Quadrature du Net examines at length the balance struck between those exceptions and the fundamental rights whose exercise may be affected. ( 22 )

36.

According to the Court, the general and indiscriminate retention of traffic and location data can be justified only by the objective of safeguarding national security, the importance of which ‘goes beyond that of the other objectives referred to in Article 15(1) of Directive 2002/58’. ( 23 )

37.

In that case (national security), the Court held that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, ‘does not, in principle, preclude a legislative measure which permits the competent authorities to order providers of electronic communications services to retain traffic and location data of all users of electronic communications systems for a limited period of time, as long as there are sufficiently solid grounds for considering that the Member State concerned is confronted with a serious threat … to national security which is shown to be genuine and present or foreseeable’. ( 24 )

38.

Admittedly, those requirements lead to a more rigorous and stricter regime than that which follows from the case-law of the European Court of Human Rights (ECtHR) in relation to Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR). The fact that ‘the meaning and scope’ of the rights in the Charter which correspond to rights in the ECHR must be the same as those laid down by the ECHR does not prevent EU law from providing more extensive protection, in accordance with Article 52(3) in fine of the Charter.

39.

Moreover, the case-law of the ECtHR in its judgments of 25 May 2021, Big Brother Watch and Others v. United Kingdom ( 25 ) and Centrum för Rätvisa v. Sweden, ( 26 ) and of 4 December 2015, Zakharov v. Russia, ( 27 ) concerns situations which, as was the prevailing view at the hearing, are not comparable to that at issue in this reference for a preliminary ruling. The solution to these must be sought by applying national provisions which are deemed to be consistent with the exhaustive rules laid down in Directive 2002/58, as interpreted by the Court.

40.

Whatever the view regarding reliance on national security, in the judgment in La Quadrature du Net, as a ground for lifting, under certain conditions, the prohibition on the general and indiscriminate retention of traffic and location data (in my opinion, the limits set by the Court are excessively broad), the requirements set out in paragraphs 137 to 139 of that judgment must be met.

41.

In any other circumstances, it will be necessary to consider whether the national legislation is underpinned by sufficiently selective criteria such that it complies with the conditions which, in accordance with the case-law of the Court, can justify a particularly serious interference with the fundamental rights concerned, such as the retention of data.

42.

There would be a failure to respect the meaning of the judgment in La Quadrature du Net if the statements made therein concerning national security could be applied to offences, including serious offences, which do not threaten national security but rather public security and other interests protected by law.

43.

This is why the Court carefully differentiated between national legislative measures which provide for the preventive, general and indiscriminate retention of traffic and location data in order to safeguard national security (paragraphs 134 to 139 of the judgment in La Quadrature du Net) and measures for combating crime and safeguarding public security (paragraphs 140 to 151 of that judgment). The two types of measure cannot have the same scope or else that distinction would be rendered meaningless.

44.

Measures providing for the retention of traffic and location data for the purposes of combating serious crime are, I repeat, set out in paragraphs 140 to 151 of the judgment in La Quadrature du Net. In addition to these, and having the same purpose, are measures authorising the preventive retention of IP addresses and of data relating to a person’s civil identity (paragraphs 152 to 159 of that judgment) and the ‘expedited retention’ of traffic and location data (paragraphs 160 to 166 of that judgment).

45.

The referring court asks, in particular, about the effect of ‘the fact that data may be retained lawfully by service providers for their own commercial purposes, and may be required to be retained for reasons of national security excluded from the provisions of [Directive 2002/58]’.

46.

The judgment in La Quadrature du Net links the data which those operators store for commercial purposes with the purpose for which the data were collected and only permits the ‘expedited retention’ of those data in the terms set out in paragraphs 160 to 166 of that judgment, cited above.

47.

National security requirements permit, in the manner and subject to the guarantees and restrictions set out in the judgment in La Quadrature du Net, the general and indiscriminate retention of traffic and location data. However, the same does not occur in relation to the aim of prosecuting offences, including serious offences, as referred to in Section 6(1)(a) of the 2011 Act, with which the reference for a preliminary ruling is concerned.

48.

As regards the difficulties created by the targeted retention of traffic and location data, ( 28 ) I refer, in addition, to points 43 to 50 of my Opinion in SpaceNet and Telekom Deutschland.

49.

Since the Court cannot be asked to take on a regulatory role and spell out which categories of data can be retained and for how long, ( 29 ) nor would it be appropriate for the Court, when interpreting Article 15(1) of Directive 2002/58, to take on the role of legislature by inserting into that provision intermediate categories between national security and public security, in order to apply to the latter the requirements attached to the former.

50.

As the Court has held, ‘the list of objectives set out in the first sentence of Article 15(1) of that directive is exhaustive, as a result of which a legislative measure adopted under that provision must correspond, genuinely and strictly, to one of those objectives’. ( 30 )

51.

The proposal that the Commission put forward at the hearing ( 31 ) (the introduction of a tertium genus of infringements) would extend to the point of uncertainty the sole ground capable of justifying the general and indiscriminate retention of traffic and location data (national security), placing threats to national security on the same footing as threats resulting from serious crime.

52.

The difficulties which were made clear when this was debated at the hearing, in relation to defining the offences that could make up that tertium genus, confirm that that is not a task to be carried out by a court.

53.

It should also be noted that, in describing ‘activities capable of seriously destabilising the … structures of a country’ and which, to that extent, jeopardise ‘the essential functions of the State and the fundamental interests of society’, the Court has referred to ‘the fundamental constitutional, political, economic or social structures’ of that country. ( 32 )

54.

On that basis, the Irish legislation described by the referring court does not differ significantly from the legislation examined in the proceedings giving rise to the judgment in La Quadrature du Net. Whatever the rules for access to data laid down in the 2011 Act (which are the subject of Question 3) are, the rules on data retention laid down in that Act are similar to those analysed in that judgment and therefore they also infringe Article 15(1) of Directive 2002/58.

55.

The Irish legislation, for reasons which go further than those attached to the safeguarding of national security, allows the preventive, general and indiscriminate retention of the traffic and location data of all subscribers for a period of two years.

56.

In summary, I suggest that Questions 1, 2 and 4 referred by the Supreme Court should be answered in the same terms as the ruling given by the Court in La Quadrature du Net.

57.

The referring court asks what criteria it should take into account in order to determine whether the national rules on access to retained data provide for the prior scrutiny required by the case-law of the Court, or whether an ex post judicial or independent scrutiny would suffice.

58.

The judgment in Prokuratuur also responded to that question. In order to ensure compliance with the conditions to be satisfied by legislation governing access to retained data, ( 33 )‘it is essential that access of the competent national authorities to retained data be subject to a prior review carried out either by a court or by an independent administrative body, and that the decision of that court or body be made following a reasoned request by those authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime’. ( 34 )

59.

The Court held that ‘one of the requirements for that prior review is that the court or body entrusted with carrying it out must have all the powers and provide all the guarantees necessary in order to reconcile the various interests and rights at issue. As regards a criminal investigation in particular, it is a requirement of such a review that that court or body must be able to strike a fair balance between, on the one hand, the interests relating to the needs of the investigation in the context of combating crime and, on the other, the fundamental rights to privacy and protection of personal data of the persons whose data are concerned by the access’. ( 35 )

60.

If the prior review is entrusted to an independent authority, that authority ‘must have a status enabling it to act objectively and impartially when carrying out its duties and must, for that purpose, be free from any external influence’. ( 36 )

61.

Specifically, ‘the requirement of independence that has to be satisfied by the authority entrusted with carrying out the prior review … means that that authority must be a third party in relation to the authority which requests access to the data, in order that the former is able to carry out the review objectively and impartially and free from any external influence. In particular, in the criminal field, … the requirement of independence entails that the authority entrusted with the prior review, first, must not be involved in the conduct of the criminal investigation in question and, second, has a neutral stance vis-à-vis the parties to the criminal proceedings’. ( 37 )

62.

According to the description of the Irish provisions provided by the referring court, access to retained data does not appear to be subject to prior review by a court or an independent authority and is instead at the discretion of a Garda officer of a certain rank, who decides whether or not to submit the request to the service providers.

63.

It is for the referring court to examine whether the officer to whom the national legislation entrusts the prior review of access to retained traffic and location data has the status of an ‘independent authority’ and the nature of a ‘third party’, as required by the case-law of the Court of Justice.

64.

In conducting that examination, the competent court must bear in mind that, in the judgment in Prokuratuur, it was held that a public prosecutor’s office of a Member State does not have the attributes of independence or of a ‘third party’ where it also carries out investigative functions in criminal proceedings.

65.

As regards the possibility of conducting the review mentioned by the referring court ex post, the judgment in Prokuratuur also provides the (negative) answer:

66.

Lastly, the Supreme Court asks whether:

67.

The answers to those questions are, once again, found in the judgment in La Quadrature du Net, which followed the traditional case-law in that respect.

68.

In Case C‑520/18, the Cour Constitutionnelle (Constitutional Court, Belgium) referred to the Court of Justice a question similar to that referred by the Irish Supreme Court in this reference for preliminary ruling. ( 40 )

69.

In responding to that question in the judgment in La Quadrature du Net, the Court, after recalling the requirements flowing from the principle of the primacy of EU law (paragraphs 214 and 215), reproduced its statement of the law regarding the limitation of the effects of its judgments: ‘Only the Court may, in exceptional cases, on the basis of overriding considerations of legal certainty, allow the temporary suspension of the ousting effect of a rule of EU law with respect to national law that is contrary thereto. Such a restriction on the temporal effects of the interpretation of that [EU] law, made by the Court, may be granted only in the actual judgment ruling upon the interpretation requested’. ( 41 )

70.

Immediately afterwards, the Court stated that, ‘unlike a breach of a procedural obligation such as the prior assessment of the impact of a project in the specific field of environmental protection, a failure to comply with Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, cannot be remedied by a procedure comparable to the procedure referred to in the preceding paragraph. Maintaining the effects of national legislation such as that at issue in the main proceedings would mean that the legislation would continue to impose on providers of electronic communications services obligations which are contrary to EU law and which seriously interfere with the fundamental rights of the persons whose data has been retained.’ ( 42 )

71.

On that basis, the Court concluded that ‘the referring court cannot apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which it is bound to make under that law in respect of the national legislation at issue in the main proceedings’. ( 43 )

72.

Those considerations are fully applicable to Questions 5 and 6 referred by the Supreme Court.

73.

First, it is immaterial that the national legislation at issue was enacted for the purpose of transposing Directive 2006/24 into national law. What matters in that regard is that the national provision complies in terms of its content with EU law as a whole, which is not the case here.

74.

Where the Court has declared a directive to be invalid on the grounds that it is incompatible with substantive provisions of the Treaties, that incompatibility with primary EU law also applies to national provisions which merely give effect to that directive.

75.

The referring court states that the 2011 Act was enacted to comply with Article 288 TFEU, by transposing Directive 2006/24 into Irish law. Nobody disputes that this is the case but, as I have just observed, what is relevant here is that that directive was invalid from the outset (this was the finding in the Digital Rights judgment), since it amounted to disproportionate interference with the rights recognised by Articles 7 and 8 of the Charter, and that the retention of traffic and location data must be governed by Directive 2002/58, as interpreted by the Court of Justice.

76.

Second, it is well known that preliminary rulings on interpretation given by the Court of Justice produce effects from the time when the provision of EU law interpreted came into force. ( 44 )

77.

While the temporal limitation of the effects of the interpretation of EU law given by the Court of Justice can be allowed only in the judgment ruling on the interpretation sought, it should be recalled that that did not occur in the Digital Rights judgment, which the referring court cites.

78.

Nor did it occur in:

79.

Third, this reference does not address the difficulties linked to the exclusion of evidence in criminal proceedings brought against an individual who was convicted of murder. Rather, this case concerns civil proceedings (as the Supreme Court describes them) which have to be resolved by an objective comparison of national law with EU law.

80.

This is emphasised by the national court: ‘In the appeal currently before this Court [the Supreme Court], the only issue is whether the High Court was correct in determining that s. 6(1)(a) of the [2011 Act] is inconsistent with EU law’. ( 45 )

81.

The reply to the ‘only issue’ is that Section 6(1)(a) of the 2011 Act does not comply with EU law and that there are no reasons to delay the effects of the judgment which must make that finding.

82.

In the light of the foregoing considerations, I suggest that the Court of Justice reply as follows to the Supreme Court (Ireland):