EU court cites “constant surveillance,” strikes down data collection law

Europe’s highest court declared on Tuesday that a directive requiring phone and internet companies to retain data for up to two years violated citizens’ fundamental rights to privacy and to control personal data.

The ruling by the European Court of Justice means national governments will have to rewrite data collection laws that the EU requested after terrorist bombings in London and Madrid in 2006.

While noting that authorities had a genuine national interest in collecting the data, the court said the current rules exceed what is needed to fight crime, and leave citizens “feeling that their private lives are the subject of constant surveillance.”

The now-invalid EU directive required phone and internet companies to retain traffic and location about their subscribers for six months to two years. In striking it down, the court complained about the law’s lack of procedures to restrict access to the data, and its failure to inform citizens about who is holding their information.

The decision also complains that the law does not require data collected from phone and internet companies to remain in the EU — an apparent acknowledgment about ongoing concern over European countries sharing data with U.S. intelligence services.

The court decision represents a victory for privacy advocates in Germany and elsewhere, who have been vocal about surveillance issues, especially in light of ongoing leaks from Edward Snowden, the former NSA contractor who disclosed how the United States had co-opted phone and internet companies to participate in large-scale spying.

In the U.S., meanwhile, President Obama is reviewing the country’s own data collection policies. Currently, phone companies are required to turn over their data to the NSA for five years, a process that Obama proposes to scale back.

Tuesday’s court ruling came after the governments of Ireland and Austria filed a legal challenge asking the court to decide if the court complied with the Charter of Fundamental Rights of the EU. The outcome may lead to further lawsuits as privacy advocates challenge laws at the national level, although the ECJ is expected to suspend the decision to provide time for governments to revise their data collection rules.