Privacy & Information Security Law Blog

The Article 29 Working Party (the “Working Party”) recently released its August 1, 2014 statement providing recommendations on the actions that EU Member States should take in light of the European Court of Justice’s April 8, 2014 ruling invalidating the EU Data Retention Directive (the “Ruling”).

In particular, the Working Party’s statement provides recommendations on:

• Ensuring that the relevant retained data are differentiated and limited to what is strictly necessary for the purpose of fighting “serious crime” (i.e., no automatic bulk retention of all categories of data);
• Restricting government access to what is strictly necessary in terms of categories of data and data subjects, and also implementing substantive and procedural conditions for such access; and,
• Ensuring effective protection against unlawful access and abuse (e.g., by allowing an independent authority to assess compliance with EU data protection laws).

The Working Party’s statement also emphasizes that the Ruling does not directly affect the validity of existing national data retention measures. Accordingly, the Working Party urges the European Commission to provide guidance on how the Ruling should be interpreted at the European and Member State levels.