EU Court of Justice: indiscriminate and unlimited data retention is unjustified.

In the judgment issued on 20 September by the Court of Justice of the EU - invested by the German Federal Administrative Court with a request for preliminary interpretation - the Court established in joined cases C-793/19 and C-794/19 that the federal law June 22, 2004 on telecommunications is in conflict with Article 15 of Directive 2022/58 on the processing of personal data and on the protection of privacy in electronic communications, where it provides for data retention and generalized conservation obligations for the purposes of the fight against crime and indiscriminate of all data relating to traffic, the location of all subscribers and registered users and all electronic means of communication that generate them.

The ruling also appears important for the part in which the Court clarifies that Directive 2022/58 itself does not preclude national legislative measures which, in order to safeguard national security, fight serious crime and prevent serious threats to public security, provide for a targeted and non-discriminatory storage of traffic and location data, but they can also legitimately go so far as to provide, for example, the general and indiscriminate storage of IP addresses assigned to the source of an Internet connection or data relating to the civil identity of users of electronic communication systems.

The decision of the Grande Chambre is available here.