Implications of invalidity of Data Retention Directive to telecom operators

Obligation for telecom operators to retain traffic and location data for combating crime purposes had been controversial ever since the adoption of the Data Retention Directive in 2006 because of its inherent negative impact on the fundamental right to privacy and personal data protection. However, the awaited judgment of the CJEU in April this year, which declared the Directive invalid, did not so far resolve the ambiguity of the issue. Namely, having in mind that half a year later, some countries did not amend their national data retention legislations (yet) to comply with the aforementioned CJEU judgment, telecom operators as addresses of this obligation are in uncertain legal situation which could be called “lose-lose” situation. Also, the emphasis from the question of proportionality between data privacy and public security is shifted to the question of existence of valid legal basis for data processing (retaining data and providing them to authorities) in the new legal environment in which national and EU law are still not in compliance. In this paper the author examines the implications of the CJEU judgment to national EU legislation, telecom operators and data subjects, providing comparative analysis of national data retention legislation status in EU member states. The existence of valid legal basis for data processing is examined within EU law sources, including within proposed EU General Data Protection Regulation and opinions of the relevant data protection bodies (e.g. Article 29 Working Party).