Privacy Map

European Union. Surveillance / law enforcement access. Directive (EU) 2006/24/EC

Data Retention DirectiveData Retention Directive 2006/24/EC

Repealed/superseded

§1Summary

Synopsis

Directive 2006/24/EC required Member States to oblige providers of publicly available electronic communications services and public networks to retain traffic and location data, but not the content of communications, for between six months and two years, so that it could be available for the investigation of serious crime. On 8 April 2014 the Court of Justice declared the Directive invalid in Digital Rights Ireland, finding that the blanket retention it imposed was disproportionate in light of Articles 7 and 8 of the Charter of Fundamental Rights. National laws made under it were left to be assessed separately.

Key themes
  • communications data retention
  • traffic and location data
  • serious crime
  • proportionality
  • Charter Articles 7 and 8
Unique features

The first EU law ever to be struck down in full for breach of the Charter's privacy and data protection rights. It derogated from Articles 5, 6 and 9 of Directive 2002/58/EC.

SaaS relevance

Historical only; invalidated by the Court of Justice in 2014. Later case law still limits national retention laws for telecoms providers.

§2Obligations

Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Retention period of not less than six months and not more than two years

§3Dates

Key dates
  • Adopted
  • In force
  • Ended
  • Adopted 15 March 2006; published 13 April 2006; in force 3 May 2006; Member States to apply by 15 September 2007; declared invalid by the Court of Justice on 8 April 2014 (Digital Rights Ireland, Joined Cases C-293/12 and C-594/12)

§4Text and authority

Text
Authority
National authorities (no EU-level regulator)

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

End date confirmed from the judgment: Digital Rights Ireland, Joined Cases C-293/12 and C-594/12, Grand Chamber, 8 April 2014, which answers that Directive 2006/24 is invalid. In force date is the 20th day after publication on 13 April 2006 (Article 16), which agrees with Wikipedia (3 May 2006). The judgment does not appear to limit the effects in time; I did not find any such limitation in the passages searched, so the end date is the judgment date.