No undifferentiated collection of login data
The connection data makes it possible to identify anyone who has contributed to the creation of content, such as their IP address, geolocation, telephone records or the numbers of their frequently called contacts. This personal information is very useful during an investigation and can be used to identify the perpetrator of an offence or to gather evidence.
However, the Court of Justice of the European Union has just ruled that Member States are not entitled to impose on operators a general and indiscriminate obligation to transmit and store the connection data of Internet users.
The law of 24 July 2015 offers French intelligence services the possibility of having the connection data of a person identified as a threat transmitted to them in real time. This is an obligation that weighs on operators and worries many associations about the powers conferred on the intelligence services. This is why the Quadrature du Net referred the matter to the Council of State, which considered that French legislation was in breach of European law.
The Court of Justice of the European Union was asked by the court responsible for investigative powers in the United Kingdom, the Council of State and the Belgian Constitutional Court to examine the validity of the data retention regime in the light of European law.
And this new decision only confirms the principles already laid down in April 2014 in its Tele2 Sverige AB ruling. "The Directive of 12 July 2002 [...] precludes national legislation which, for the purposes of combating crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication," the Court of Justice ruled.
These obligations of generalised and undifferentiated transmission and storage constitute "particularly serious interference with the fundamental rights guaranteed by the Charter" such as the right to respect for private life.
In short, the judicial and intelligence authorities can no longer request the transmission of connection data to electronic communications service providers, with a few exceptions. Indeed, in the case of a "serious threat to national security" or "terrorist activities", States may require operators to retain connection data.
Nevertheless, two conditions are laid down: "The decision providing for this injunction, for a period temporarily limited to what is strictly necessary, must be subject to effective control, either by a court or by an independent administrative entity," the court ruled. The body in charge of the control will have to verify "the existence of one of these situations as well as the respect of the conditions and guarantees provided".
A decision with very important consequences for the judicial and intelligence services, in particular on ongoing proceedings that could be stopped dead in their tracks or their acts declared null and void.
Source : L'Usine Digitale
