Photo: Ruling could complicate their surveillance activities by regional governments.
Public debate about data collection has raged since Edward Snowden, a contract employee for the U.S. National Security Agency shown here in a June 9, 2013 photo provided by the Guardian newspaper in London, leaked official documents indicating the extent of government surveillance in the U.S. and U.K. Photo: Associated Press
By Jenny Gross
Dec. 21, 2016 10:36 a.m. ET
LONDON—European governments can’t require internet companies to retain data indiscriminately, the European Union’s top court said Wednesday in a ruling that could complicate their efforts to expand surveillance powers.
The decision by the Court of Justice of the European Union is the latest blow to law enforcement authorities in Europe who say they need access to communications data to fight terrorism and other crime. The ruling is a boost for privacy advocates and paves the way for further legal challenges against surveillance laws in EU countries, including the U.K., where sweeping new measures will come into effect next year.
The ruling says surveillance laws that allow for “general and indiscriminate” retention of electronic communications are unlawful because they allow authorities to draw conclusions about people’s private lives.
The verdict came in reply to legal challenges against new data retention laws in Sweden and in Britain, which just passed measures requiring communications companies to keep records of every website and messaging services that individuals have accessed for a year.
A debate over data collection by governments has flared in Europe and the U.S. since Edward Snowden, the former U.S. National Security Agency contractor, leaked documents that shone an uncomfortable spotlight on surveillance powers in the U.S. and the U.K.
While intelligence authorities say they need broader surveillance powers to keep pace with advances in technology to combat threats from terrorists and other criminals, privacy advocates say bulk collection of data is ineffective and unlawful.
Over the last decade, data-retention laws in several countries, including Germany, have been struck down on privacy grounds.
Last year, a court in The Hague said a Dutch data retention law, which requires telecom providers to collect and store data for as long as 12 months, violates citizens’ right to privacy and the right to protection of personal data. In 2014, the ECJ stuck down the bloc’s data retention directive, paving the way for the appeals that gave rise to this case.
The ruling raises questions about whether parts of Britain’s controversial law could be overturned. Privacy advocates, including British lawmaker Tom Watson who filed the lawsuit, said the judgment proves elements of the U.K. law are unlawful.
David Davis, the minister who is overseeing Britain’s exit from the EU, had jointly challenged the U.K. government with Mr. Watson but dropped out when he was appointed to Prime Minister Theresa May’s cabinet in July.
“Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the government the power to arbitrarily seize our phone records or emails to use as they see fit,” Mr. Watson said in a statement after the ruling.
The U.K. government said it was disappointed with the judgment. A spokeswoman said the government is considering the judgment’s potential implications and that it would ensure plans are in place so that officials can continue to acquire data in a way that is consistent with EU law.
Julian King, the European Commissioner for the Security Union, said officials will need to look at the ruling in detail to see what impact it will have on the bloc’s rules and counterterror efforts.
“There are implications that the member state directly concerned will no doubt be looking at. And there may be wider implications that we need to look at but it’s too early to say,” he said in a press conference.
The ruling also raises questions about transferring data between the U.K. and other European countries once the U.K. leaves the EU, a potential complication for law enforcement authorities.
Sam Schechner in Paris and Laurence Norman and Julian E. Barnes in Brussels contributed to this article.