Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story...

Case C-301/06 | Court of Justice of the European Union | Grand Chamber | 10 February 2009

Practice takeaways: ① A measure may pursue law-enforcement objectives while still fall within the EU’s internal-market competence if its substantive rules principally regulate private economic operators. ② The legal basis of an EU measure is determined by objective factors, particularly its aim and content. ③ The Data Retention Directive regulated what communications providers had to retain, not police access to or use of those data. ④ The Court therefore held that the Directive predominantly concerned the functioning of the internal market. ⑤ Critically, the Court did not decide whether the Directive violated fundamental rights. That issue would return five years later in Digital Rights Ireland, where the Court declared the Directive invalid.

Ireland v. Parliament and Council involved the same Data Retention Directive that the CJEU would famously invalidate five years later in Digital Rights Ireland. But the two cases asked fundamentally different questions.

In Ireland, the issue was who within the EU’s then-existing constitutional structure had authority to adopt the Directive, and under which Treaty provision.

Ireland argued that a measure requiring communications providers to retain data so that it could later be used to investigate serious crime belonged to the EU’s then “third pillar” governing police and judicial cooperation in criminal matters—not to the Community’s internal-market powers. (Judgment, paras. 28–31.)

The Court disagreed.

Looking principally at what the Directive actually regulated, the Court concluded that its provisions were directed at the activities of communications providers in the internal market. The Directive harmonized their obligations concerning what data had to be retained, for how long, how it had to be protected, and how it had to be stored. It did not harmonize the subsequent access to or use of those data by police and judicial authorities. (Judgment, paras. 79–85.)

That distinction was enough to sustain the Directive’s internal-market legal basis.

But it did not sustain the Directive against a fundamental-rights challenge. The Court expressly said that Ireland’s action concerned “solely” the choice of legal basis and not any possible infringement of fundamental rights arising from the Directive’s interference with privacy. (Judgment, para. 57.)

That unanswered question became the heart of Digital Rights Ireland.

What happened

Directive 2006/24/EC—the Data Retention Directive—required Member States to ensure that providers of publicly available electronic communications services and public communications networks retained specified categories of communications data.

The retained information included data capable of identifying the source and destination of a communication, its date, time and duration, the type of communication, the equipment used, and the location of mobile communications equipment. The Directive prohibited retention of the content of communications and generally required retention for between six months and two years. (Judgment, paras. 11–16.)

Its history, however, exposed the constitutional problem.

In 2004, France, Ireland, Sweden and the United Kingdom had initially proposed dealing with communications-data retention through a framework decision based on provisions governing police and judicial cooperation in criminal matters. The Commission took a different view as to the parts governing providers’ retention obligations. It considered the categories of data to be retained and retention periods matters falling within Community competence. The Commission subsequently proposed a directive based on Article 95 EC, the Treaty provision governing approximation of national laws for the establishment and functioning of the internal market. (Judgment, paras. 18–20.)

The Council ultimately followed that route. Ireland and Slovakia voted against adoption of the Directive. (Judgment, paras. 21–23.)

Ireland then brought an action for annulment.

Its central argument was straightforward: the Directive was really about fighting crime.

Ireland argued that the Directive’s sole—or at least predominant—objective was facilitating the investigation, detection and prosecution of serious crime, including terrorism. Its proper legal basis therefore lay in Title VI of the EU Treaty governing police and judicial cooperation in criminal matters, rather than Article 95 EC governing the internal market. (Judgment, paras. 28–31.)

Why the case matters

Ireland is important for two related reasons.

• First, it illustrates how the Court determines the proper legal basis of EU legislation when a measure sits at the intersection of different regulatory objectives.
• Second, Ireland is essential context for understanding Digital Rights Ireland.

It is tempting to describe Ireland as the case in which the CJEU “upheld” the Data Retention Directive and Digital Rights Ireland as the case in which it later changed its mind and invalidated it.

That is misleading.

The Court expressly confined Ireland to the Directive’s legal basis. It did not decide whether requiring broad retention of communications metadata was compatible with privacy or other fundamental rights. (Judgment, paras. 56–57.)

The two judgments therefore address different dimensions of validity.

Key holding

The Court reached several connected conclusions.

• Legal basis depends on the aim and content of the measure. The choice must rest on objective factors amenable to judicial review, particularly the legislation’s aim and substantive content. (Judgment, para. 60.)
• Divergent national retention laws affected the internal market. Member States had imposed substantially different retention requirements, creating significant economic implications for communications providers and potentially distorting the internal market. (Judgment, paras. 66–72.)
• The Directive principally regulated service providers. It harmonized obligations to retain data, categories of retained data, retention periods, data protection and security, and storage conditions. (Judgment, paras. 79–82.)
• Police access and use were different matters. The Directive did not harmonize access to retained data by law-enforcement authorities or their subsequent use or exchange of those data. (Judgment, para. 83.)
• The Directive therefore predominantly concerned the internal market. Article 95 EC was the appropriate legal basis. (Judgment, paras. 84–85.)
• Fundamental-rights validity remained undecided. Ireland had challenged only the Directive’s legal basis, not possible infringements of privacy resulting from the retention regime. (Judgment, para. 57.)

The Court’s analysis

1. Aim and content determine the legal basis

The Court began with the principle that the legal basis for EU legislation must rest on objective factors capable of judicial review, particularly the measure’s aim and content. Article 95 EC could support harmonization where divergent national rules affected—or were likely to affect—the internal market. (Judgment, paras. 60–65.)

2. Divergent retention rules affected the internal market

Member States had adopted substantially different rules on what communications data providers had to retain and for how long. Those obligations imposed significant investment and operating costs, while further divergence was foreseeable. The Court therefore concluded that the differences could directly affect the internal market and justified harmonization. (Judgment, paras. 66–72.)

3. The Directive principally regulated service providers

The Directive was “essentially limited to the activities of service providers.” It harmonized retention obligations, categories of retained data, retention periods, security requirements, and storage conditions—all relating to data generated or processed in providing communications services. (Judgment, paras. 79–82.)

That gave the Directive its internal-market character.

4. Police access and use remained outside the Directive

Critically, the Directive did not harmonize law-enforcement access to retained data or how authorities could use or exchange them. Those matters remained outside its scope. The Court therefore distinguished between retention by commercial providers, which the Directive regulated, and access and use by public authorities, which it did not. (Judgment, paras. 82–85.)

5. The PNR precedent was different

Ireland relied on Parliament v. Council and Commission, involving the transfer of airline passenger data to U.S. authorities for public-security and law-enforcement purposes. But that case involved processing within a framework established by public authorities.

By contrast, the Data Retention Directive regulated service providers’ activities in the internal market and did not govern law-enforcement activities. The PNR precedent therefore did not control. (Judgment, paras. 86–92.)

The Advocate General’s Opinion

Advocate General Yves Bot reached the same ultimate conclusion as the Court: Article 95 EC was the proper legal basis for the Data Retention Directive.

He framed the case in expressly constitutional terms. Under the EU’s former three-pillar structure, the Court was being asked to draw the boundary between the Community pillar and the third pillar governing police and judicial cooperation in criminal matters. (Opinion, paras. 1–6.)

That framing helps explain why Ireland is not primarily a privacy judgment. The dispute was about the allocation of legislative competence within the pre-Lisbon European Union.

Bot also emphasized the distinction between the retention regime imposed on communications providers and the subsequent law-enforcement use of the retained information. Directive 2006/24 established obligations concerning data generated in supplying communications services, while access by competent national authorities remained governed separately.

His conclusion was therefore that the Community legislature had acted correctly in relying on Article 95 EC rather than Title VI of the EU Treaty. (Opinion, para. 6 and subsequent analysis.)

What the Court did—and did not—decide

This distinction is especially important in Ireland.

The Court did decide that Directive 2006/24 could properly be adopted under Article 95 EC because its harmonized obligations principally regulated communications providers and addressed divergences capable of affecting the internal market. (Judgment, paras. 66–85, 93.)

It did not decide whether indiscriminate retention of communications metadata for six months to two years was compatible with the fundamental rights to privacy and data protection.

Five years later: Digital Rights Ireland

The distinction left open in Ireland became decisive in Digital Rights Ireland.

The first case asked essentially:

Did the EU legislature have the proper legal basis to adopt the Data Retention Directive?

The answer was yes.

Digital Rights Ireland asked a very different question:

Were the retention obligations imposed by that Directive compatible with fundamental rights?

The answer was no.

That later litigation therefore did not reverse Ireland. It addressed the fundamental-rights question that Ireland had expressly left unresolved.

Conclusion

Ireland v. Parliament and Council is remembered less often than Digital Rights Ireland, but the two cases belong together.

Ireland established that the EU could harmonize communications providers’ data-retention obligations as an internal-market measure even though the reason governments wanted those data retained was the investigation and prosecution of serious crime.

The decisive distinction was between retention by providers and access and use by law enforcement.

But the judgment deliberately stopped there. It did not answer whether requiring providers to retain vast amounts of communications metadata was compatible with fundamental rights.

Five years later, the Court answered that question in Digital Rights Ireland.

The result is an important constitutional lesson:

Having the power to legislate is not the same thing as exercising that power lawfully.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

• Court of Justice of the European Union, Grand Chamber, Case C-301/06, Ireland v European Parliament and Council of the European Union, Judgment of 10 February 2009, ECLI:EU:C:2009:68.
• Opinion of Advocate General Yves Bot, Case C-301/06, Ireland v European Parliament and Council, delivered 14 October 2008, ECLI:EU:C:2008:558.

Useful reading from The de la Torre Review

• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” This should be the principal cross-reference. It picks up exactly where Ireland stopped: whether the retention regime itself complied with fundamental rights. Read the Article.
• “Parliament v Council: When Passenger Data Becomes a Security Measure.” Ireland expressly considered—and distinguished—Parliament v Council. That case concerned the transfer of commercially collected PNR data to U.S. authorities within a framework established for public-security and law-enforcement purposes. By contrast, the Data Retention Directive regulated retention obligations imposed on communications providers and did not govern subsequent access or use by law-enforcement authorities. The Court therefore concluded that the PNR ruling did not control the legal-basis analysis in Ireland. (Judgment, paras. 86–92.) Read the Article.
• “Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.” Useful for showing the Court’s later refinement of the proportionality analysis governing government access to retained communications data. Read the Article.
• “Rijkeboer: When the Right of Access Reaches Into the Past.” Although it concerns a very different retention problem, it provides useful context for the broader proposition that EU data-protection law does not treat retention as inherently good or bad; its justification depends on purpose, necessity and proportionality. Read the Article.