The Supreme Court has ruled that the retention of telecommunications data by providers is contrary to European Union regulations. This is a decision – a station that now affects several criminal cases.
The subject matter of the procedure was Law 183 (I) / 07 which requires telecommunications providers to retain user data for a period of six months and allows the Police to access this database.
According to the applicants' appeal, this law conflicts with European Law, Articles 15 and 17 of the Cyprus Constitution, Article 8 of the ECHR and the Charter of Fundamental Rights of the European Union.
The applicants' application adds, inter alia, that “the general and non-discriminatory retention of traffic and location data and related data necessary for the identification of the subscriber and / or user is inadmissible as incompatible with European Law and European case law, regardless of of the guarantees included in the Law in relation to the access to this data “as well as that the provisions of the law apply in a general way to all subscribers and no differentiation, restriction or exception is provided in relation to the intended purpose.
In addition, according to the applicants 'appeal, the law does not provide clear and precise rules governing the scope and application of the data retention measure, nor are there sufficient guarantees for the effective protection of subscribers' personal data.
It is noted that the applicants were represented by the law firms A. Pelekanos & Pelekanos D.E.P.E., Giannis Polychronis D.E.P.E. with V. Akama, Chr. Christofi with M. Kaoula and El. Stefanou with G. Nearchou.
On the other hand, the Legal Service stated as its main argument that “organized crime now plagues our country, so it is necessary to maintain telecommunications data” and that “telecommunications data is crucial for the detection of the perpetrator and the successful prosecution of him “.
At the same time, it objected that the national legislation provided for the necessary criteria set out in the case law of the Court of Justice of the European Union (ECJ) to ensure the need, on a pro rata basis, for derogating from the rights enshrined in Articles 7, 8 and 11 of the Charter. of the EU Fundamental Rights, taking into account the specific circumstances of the country, in terms of its size, population and geographical distribution of crime in it.
He also argued that the Law provides for strict data retention rules and penalties for violating them, while the Personal Data Protection Commissioner is designated as the supervisory authority for compliance with these rules.
The case was handled on behalf of the Legal Service by the Assistant Attorney General, Savvas Angelidis, with the Senior Lawyer of the Republic, D. Kyprianou, as well as the lawyer of the Republic, A. Aristides.
To the arguments of the Legal Service that “organized crime is now plaguing our country” and that “telecommunications data is crucial for the detection of the perpetrator and his successful prosecution”, the Supreme replied that “despite the guarantees of superiors, which most of them concern the access stage, it should not be forgotten that EU law treats data retention and access to them as completely separate and independent matters on their own terms, excluding, in any case, non-targeted retention “.
The decision adds that, “in relation to the issue of data retention under the Law, the explicitly required restrictions in the sense of targeting specific groups of individuals or locations are absent. In the absence of such restrictions, the Law is universally applicable to all subscribers and registered users of electronic media indiscriminately, throughout the territory of the Republic of Cyprus. The assessment of the validity of a measure, which, while affecting rights, may be justified in the pursuit of a legitimate aim, such as the suppression of a serious crime, ultimately results in a question of proportionality. That is to say, the measure must not fall short of the limits of what is absolutely necessary for the achievement of the legally intended purpose of the legislation. “Targeted data retention seems to be the goal.”
In its decision, the Supreme Court also states that “although the protection of telecommunications data is not absolute, the national legislature is obliged to implement the Directive in a way that is compatible with the EU Charter”.
The Supreme Court ruled that the disputed articles of the Law were contrary to Directive 2002/58 / EC and the applicable Union case law.
