The Interdisciplinary Internet Institute

Today the District Court of The Hague ruled the Dutch Data Retention Act inoperable in summary proceedings. You can find the Dutch judgment here. And for those not reading Dutch, we have made a quick unofficial (!) English translation of the judgment, which you can download here.

For many EU Member States it was clear that since the EU Court of Justice on 8 April 2014 had ruled the Data Retention Directive invalid, with retroactive effect, the national implementation laws would also be invalid. The Dutch government opted for a different strategy. It retained (pun intended) the law as is, while thinking about amending the law in the future.

This was deemed an unacceptable course of action by Privacy First, The Dutch Lawyers Committee on Human Rights, The Dutch Association of Journalists and three companies that are providers of telecommunication services and public telecommunication networks. They sued the Dutch State, and today they won. 

Today the Court ruled in its summary proceedings that the Dutch Data Retention Act, which was directly based on the invalidated Directive, was in violation of articles 7 and 8 of the EU Charter of Fundamental Rights as it provided insufficient safeguards to counter the objections that the Court of Justice had against the Data Retention Directive.

The short and sweet of the ruling :

1. The invalidation of the Data Retention Directive does not imply that the Dutch Data Retention Act, which implemented the directive, is also invalid. The validity of the Dutch Act should be assessed independently. The Court: “The objections against the Data Retention Directive as voiced by the Court in its 8th of April 2014 ruling, include among other concerns the absence of certain safeguards for the security of and access to the stored data. Those objections could also be overcome by applicable provisions in other national legislation.”
2. Data retention may be needed. The Court: “The State has argued, without being challenged, that some of its extensive criminal cases could not have been resolved without the use of data retention. The starting point is therefore that the data retention obligation is necessary and effective. ”
3. No adequate steps were taken to counter the objections of the EU Court of Justice against the Data Retention Directive.
   1. There is no provision in the Dutch Legislation that requires that the storage of the data should be on EU territory. If the legislation is to be effective, then there should be such a provision.
   2. There are insufficient safeguards in place when it comes to accessing the data to combat serious crime. Lack of differentiation and applicability of to whom which persons/suspects and in which cases the data may be requested. The Court: “The State has argued that they do not lightly request the data and that in instances such as a bike theft (also an offence for which remand is permitted) no data will be requested. Fact is however, that the possibility to do just that exists and that there are no safeguards in place that limit the actual access to the data which is strictly necessary for the combatting of (only) serious crime.”
   3. There is no judicial or independed authorization required prior to getting access. This is all the more important as the CJEU considered this a compelling objection.

This all leads the court stating:

 “3.12.  All this leads to the conclusion that the [Dutch Data Retention Act] in its current form is a violation of the rights protected by articles 7 and 8 of the Charter which is not limited to the absolute necessary and thus needs to be qualified as an unacceptable. In light of this the [Dutch Data Retention Act] is unmistakably nonbinding. The provisional court is aware that making the [Dutch Data Retention Act] inoperable may have profound implications for the detection and prosecution of offences. That however does not justify the continuation of the aforementioned violation.”

Read the full unofficial, quick, translation of the judgment here.

data retention