Digital Rights Ireland

The European Court of Justice Already Struck Down a Law Like Bill C-22. Here Is What It Found.

On April 8, 2014, the Court of Justice of the European Union (CJEU) handed down its decision in Digital Rights Ireland (joined cases C-293/12 and C-594/12), striking down the EU's Data Retention Directive as invalid. The Directive had required telecoms in member states to retain user metadata — phone numbers, IP addresses, location data, device identifiers — for six months to two years, on every customer, with police access on a production-order standard. The CJEU found this regime to be a "particularly serious" interference with the fundamental rights to private life and personal data protection under Articles 7 and 8 of the EU Charter, and that the interference failed proportionality because (1) the retention applied to all persons without distinction, (2) there was no relationship between the retained data and the threat the regime was meant to address, and (3) safeguards on access were insufficient. The ruling does not bind Canadian courts. The reasoning is highly persuasive and will be central to any future Canadian Charter challenge to Bill C-22.