1. Introduction

1.1 The extent to which it is permissible for public authorities both to require private telephony service providers to retain certain data about communications and, potentially, to disclose that information to investigating and prosecuting authorities, has been a significant issue within the European Union for a number of years. In particular, a directive dealing with such matters, Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly

available electronic communication services or of public communications networks and amending Directive 2002/58/EC (“the 2006 Directive”), was found by the Court of Justice of the European Union (“CJEU”) to be in breach of rights guaranteed by the Charter of Fundamental Rights of the European Union (“the Charter”) and thus deemed invalid (see, Digital Rights Ireland Limited v. Minister for Communications, Marine and Natural Resources & Ors and Kärntner Landesregierung and Others (Joined Cases C-293/12 and C-594/12), ECLI:EU:C:2014:238, (“Digital Rights”)). …1.7 The defendants/appellants (“the State”) have appealed to this Court against the finding of the High Court. The net issue for this Court is, therefore, confined to the question of the validity or otherwise of the 2011 Act, having regard to the 2002 Directive properly interpreted in the light of the Charter. ….3.9 The CJEU, as already noted, determined in Digital Rights that the 2006 Directive was inconsistent with EU law and, in particular, the Charter. The key passages from the judgment of the CJEU in Digital Rights are as follows:- “24. It follows from Article 1 and recitals 4, 5, 7 to 11, 21 and 22 of Directive 2006/24 that the main objective of that directive is to harmonise Member States’ provisions concerning the retention, by providers of publicly available electronic communications services or of public communications networks, of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the prevention, investigation, detection and prosecution of serious crime, such as organised crime and terrorism, in compliance with the rights laid down in Articles 7 and 8 of the Charter. … 37. It must be stated that the interference caused by Directive 2006/24 with the fundamental rights laid down in Articles 7 and 8 of the Charter is, as the Advocate General has also pointed out, in particular, in paragraphs 77 and 80 of his Opinion, wide-ranging, and it must be considered to be particularly serious. Furthermore, as the Advocate General has pointed out in paragraphs 52 and 72 of his Opinion, the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance.”

3.10 Turning to assess the justification of this interference, the Court considered that such an interference did not adversely affect the essence of those rights guaranteed by Articles 7 and 8 of the Charter. … 3.11 The CJEU then considered the proportionality of the interference with these rights, ultimately concluding that by adopting Directive 2006/24, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter. … 53. In that regard, it should be noted that the protection of personal data resulting from the explicit obligation laid down in Article 8(1) of the Charter is especially important for the right to respect for private life enshrined in Article 7 of the Charter. … 60. Secondly, not only is there a general absence of limits in Directive 2006/24 but Directive 2006/24 also fails to lay down any objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference. On the contrary, Directive 2006/24 simply refers, in Article 1(1), in a general manner to serious crime, as defined by each Member State in its national law. … 65. It follows from the above that Directive 2006/24 does not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. It must therefore be held that Directive 2006/24 entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary. 66. Moreover, as far as concerns the rules relating to the security and protection of data retained by providers of publicly available electronic communications services or of public communications networks, it must be held that Directive 2006/24 does not provide for sufficient safeguards, as required by Article 8 of the Charter, to ensure effective protection of the data retained against the risk of abuse and against any unlawful access and use of that data…” 3.12 Obviously the validity or otherwise of various national measures which predated the decision of the CJEU in Digital Rights came into question thereafter. In the first major case on that topic, Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and Others (Joined Cases C-203/15 and C- 698/15), ECLI:EU:C:2016:970 (“Tele2 Sverige”), the CJEU approached the question of the validity of national measures governing data retention in the light of the 2002 Directive, interpreted in accordance with the terms of the Charter, … 108. However, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data, for the purpose of fighting serious crime, provided that the retention of data is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary. …3.13 In response to a further question referred, the CJEU set out the correct approach to be taken by national courts in determining whether national legislation satisfies the requirements of Article 15(1) of the 2002 Directive, read in light of Articles 7, 8, 11 and 52(1) of the Charter, with respect to the access of the competent national authorities to retained data, at paras. 118-123:- …123. In any event, the Member States must ensure review, by an independent authority, of compliance with the level of protection guaranteed by EU law with respect to the protection of individuals in relation to the processing of personal data, that control being expressly required by Article 8(3) of the Charter and constituting, in accordance with the Court’s settled case-law, an essential element of respect for the protection of individuals in relation to the processing of personal data. If that were not so, persons whose personal data was retained would be deprived of the right, guaranteed in Article 8(1) and (3) of the Charter, to lodge with the national supervisory authorities a claim seeking the protection of their data (see, to that effect, the Digital Rights judgment, paragraph 68, and the judgment of 6 October 2015, Schrems, C 362/14, EU:C:2015:650, paragraphs 41 and 58).”

…3.30 At least some of the issues earlier identified are to an extent dependent on the facts. The key assessment of the validity of a measure which undoubtedly impacts on rights but which may be justified in the pursuit of legitimate objectives comes down to a question of proportionality. The jurisprudence of the CJEU in that regard can be found in, for example, Schaible (Case C-101/12) EU:C:2013:661, where the Court was asked to assess the validity of provisions of Council Regulation (EC) No 21/2004, which imposed certain obligations on the keepers of sheep and goats in respect of their identification and registration, in Union law, in light of the freedom to conduct a business guaranteed under Article 16 of the Charter. In Schaible, it was recalled that the principle of proportionality requires that measures adopted by European Union institutions do not exceed the limits of what is appropriate and necessary in order to attain the objectives legitimately pursued by the legislation in question. In addition, where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued. The Court held that the aim of the measures, being to prevent the spread of infectious diseases, constituted a legitimate objective in the public interest. Having considered the alternative means of identification proposed by the applicant in the main proceedings, the CJEU concluded that the measures implemented under Regulation No 21/2004 were appropriate for attaining that objective, that the contested obligations were necessary to achieve that aim and that the disadvantages resulting from those obligations were not disproportionate to that objective pursued by the Regulation. …6.2 It is, of course, the case that the Irish Constitution, in common with the European Convention on Human Rights (“the Convention”) and the Charter, recognises significant privacy rights encompassing a right of privacy in relation to personal data. It has not been suggested to date (and, in my view, could not be suggested) that the separate identification of a right to protection of personal data in Article 8 of the Charter should lead to any divergent analysis of the issues involved when it is sought to challenge the introduction of evidence obtained under a statutory regime permitting retention of data generated by fixed and mobile telephony networks and internet usage …6.3 The Charter itself recognises the possibility of processing of such data on a legitimate basis laid down by law. The analysis, whether under the Charter, the Convention or the Constitution, of any measure provided for by law permitting retention and access to such data is essentially similar. First, it is necessary to consider whether the measure affects a protected right. If so, it is necessary to determine whether any such interference pursues a legitimate objective. Next, and again if so, it must be determined whether the interference is no greater than is necessary to achieve the lawful object and is proportionate in so doing.

...6.6 The analysis of the data protection regime implemented in Ireland under the provisions of the 2006 Directive has tended to treat the questions of retention and access as separate issues. It may be open to some doubt as to whether this is necessarily helpful or indeed truly possible. It is clear that the objective of retention is to permit access. It has no function otherwise. On the evidence adduced in this case, it is clear that the data retained in bulk is not itself related to any individual person holding rights under the Constitution, the Charter or the Convention. It is only when access is sought and obtained that it is possible to connect an individual to any specific retained data. …6.15 This contention is troubling from the perspective of Irish constitutional law and the analysis which an Irish court would apply under the Constitution, the Convention and the Charter. First, it appears to be based on a hypothesis which is not supported by any evidence and is indeed contradicted by such evidence as has been adduced in these proceedings. Second, it is apparent that any question of retention of data in advance by reference to geographical criteria would itself involve questions of profiling and differential treatment of individuals on the basis of location and/or their association with others. Assuming, however, that such a course of action would be permissible, it would in principle be something quite different to the regime established by the 2011 Act and would be more intrusive of the rights of the individuals concerned, who themselves may have no necessary connection to any suspected or anticipated crime. Such measures, described as targeted retention, would almost inevitably involve not merely retention but also access to relevant data, identification of the individual and normally access to the content of the communication concerned. 6.16 Most significantly, it is apparent, both as a matter of logic and as established by the evidence in this case, that any such measure cannot achieve the objective of permitting the investigation of serious crimes such as the subject matter of these proceedings, where there is no reason to suspect a particular individual or group in advance. The conclusion therefore that a regime of universal data retention in bulk is per se impermissible, irrespective of the terms of such retention or the conditions of access, would appear not to be a conclusion that the legitimate and important objective of investigating serious crime could be achieved by methods less intrusive of the rights of individuals, but rather a conclusion that the objective of investigating serious crime cannot justify the universal retention of bulk communications data however regulated or controlled. This is a value judgment but one not apparent from the Charter nor, it would appear, one which would be made either under the Convention or the Irish Constitution. In circumstances where the Charter refers to and embodies the common constitutional traditions of the Member States, it is arguable that it should not be interpreted in such a way as to impose such a value judgment on Member States at odds with their constitutional traditions, particularly in circumstances where Article 15(1) of 2002 Directive is permissive and does not require Member States to adopt any system of retention. Thus, a Member State whose traditions would lean against any system of universal retention is free to adopt such a course of action.

FROM THE DISSENT: Crime as human rights violations …9. Murder, rape and other serious crimes are fundamental violations of human rights, going so far as to remove all human rights by violent death. Article 47 of the Charter of Fundamental Rights of the European Union provides: “Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article.” Experience puts this following proposition beyond any doubt: without the secure retention of metadata and the potential to access and analyse it for strictly limited purposes related criminal investigation, the most serious crime against life and limb would remain undetected. Victims, including the survivors of victims’ families, would be deprived of their human right to access a court proceeding in pursuit of justice. Investigators would be shorn of an indispensable tool for detecting human rights violators. Justice must be an energetic search for the truth upon which alone any fair verdict against an accused person or any vindication of human rights violations can be based. Cutting out the truth in the form of useful and convincing evidence leads to the distortion of the legal process and its being severed from the good sense of the European peoples. Criminologists agree that the fear of detection is central to the deterrence of crime. Ireland has suffered, as the two examples given illustrate, from both organised crime and from terrorism. As the examples also elucidate, these threats to society are dampened by a detection approach which is moderate, protective of private rights and which is founded on the certainty of the legal order. …12. It is a matter for national courts to resolve any issues of compliance. Certainly under Article 8 of the Charter, everyone has the “right to the protection of personal data concerning him or her” and that same “must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law.” This right need not clash with rights to life or bodily integrity guaranteed under Articles 1, 3 and 6 of the Charter since Article 52 provides that any “limitation on the exercise” of any guaranteed right “must be provided for by law and respect the essence of those rights and freedoms.” Section 98 of the 1993 Act, s 53 of the 2005 Act and the other guarantees as to inertness and storage in Irish legislation demonstrate such respect. As Article 52 also provides: “Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.” Legitimate concerns about terrorism and really serious organised crime are behind the legislative provisions and Ministerial directions from the earliest stage. There is no other basis; such as governmental snooping. That does not happen. Further, there is no evidence that any Irish person feels that the inert storage of data with access only on the basis of law excites any fears. An absence of such protection for the population is, instead, a terrifying prospect.