For a long time, police and judiciary could go relatively unhindered with the use of digital investigation methods. The law did not set such high standards for privacy. Nor did European directives. Directive 2006/24, for example, left almost the entire EU population virtually unprotected from government surveillance and eavesdropping. The directive gave investigating authorities full scope to store and analyse all communications and traffic data of almost all EU citizens almost without limit. Even data that was not relevant for public security was allowed to be retained. Requirements regarding the investigation period and/or geographical area and/or circle of persons were not imposed. Nor were procedural conditions regarding access and (judicial) review against certain criteria. No restrictions were placed on the number of persons allowed to consult the data. 

Digital rights judgment

The European Court of Justice in Luxembourg in 2014 declared this directive (2006/24) in the 'Digital Rights' judgment invalid. It constituted too broad and too severe an interference with the fundamental rights of citizens. That it was in the general interestwould be that investigative agencies could access retained data is insufficient. Such a general objective does not make consulting retained data necessaryis to fight this battle. Individuals whose data has been retained should have sufficient guarantees that their personal data is protected against the risk of misuse and against any unauthorised consultation and use of that data. The ruling was good news for privacy and many legal provisions on data retention went off the table. In March 2021, the Court of Justice went even further in the 'Prokurature judgment'. 

Prokurature ruling

In this ruling, the ECJ ruled that public authorities should only be allowed to access traffic data to combat serious crime and prevent serious threats to public safety if the search of data was targeted and only over a limited period of time. And prior judicial review should take place. 

This is also a very important ruling for the Netherlands because, for example, in the current Article 126n Sv, a judicial review is not yet prescribed. Judicial reviews must now take place in advance. The judge may only grant a warrant if the suspicion relates to a 'serious crime' or in the French translation of the judgment 'criminalit'égrave'. In Dutch, this is also translated as ´serious crime´. But when is serious crime? Is the level of punishment the determining factor? Or the amount of damage? Should there be victims? Judges in the Netherlands think differently about this. For example, one judge in the Netherlands may consider a theft of valuables serious enough to grant an authorisation to tap telecoms data, while another may not.  

Cassation in the interest of the law

To clarify the interpretation of the term 'serious offence', cassation in the interest of the law was introduced in December 2021. In such a procedure, questions of law are put to the Supreme Court outside ongoing criminal proceedings. In turn, the Supreme Court could submit (preliminary) questions to the ECJ. It is very important to clarify when a fact is serious enough to justify violations of fundamental rights. For example, if the ECJ were to rule that, for example, drug offences are not serious enough to allow certain fundamental rights to be set aside, permissions may have been wrongly issued. The ruling could also be relevant to the outcome in Encrochat and Sky cases. To be continued, no doubt. 

Mr. D.M. Penn