The European Union’s highest court has done what courts in the U.S. have thus far refused to do: Rule firmly against mass data collection.
In a landmark decision, the European Court of Justice Tuesday struck down the EU’s data-retention law, which required telecommunications companies to store communication data on EU citizens for two years.
Data collected under the law included call time and duration, location, and other traffic data that enabled law enforcement to identify individual users. As with the National Security Agency‘s controversial phone metatdata collection program, the contents of communications were not collected. Regardless, the court found the data collection to infringe on EU citizens’ privacy rights.
“Those data, taken as a whole, may provide very precise information on the private lives of the persons whose data are retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, activities carried out, social relationships and the social environments frequented,” the court said in a statement.
Furthermore, “by requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data,” the court said.
The court found that mass data collection for the purposes of curtailing terrorism and other serious crime falls in line with EU law, but decided that this particular legislation was too broad.
The decision is seen as a blow to law enforcement tasked with combating organized crime and terrorism, but a boon to personal privacy, the advocates of which have campaigned agains the EU data-retention law since its inception in 2006 following the bombings in Madrid and London.
“After eight years, this affront to the fundamental rights of European citizens has finally been declared illegal,” Joe McNamee, Executive Director of advocacy group European Digital Rights, said in a statement. “Eight years of abuses of personal data and eight years of reassurances from EU Member States and the Commission that the measure was legal.”
The court’s decision does not immediately abolish mass data collection across the EU. Twenty six of the 28 EU member states have enacted their own data collection laws. The ruling does, however, open those laws to greater legal challenges.