Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no…

The Data Retention Directive (2006/24/EC) was a legal framework that required Member States to

ensure that providers of publicly available electronic communications services or of public

communications networks retained certain data for a period of between six months and two years,

for the purpose of the prevention, investigation, detection and prosecution of serious

crime1. However, on 8 April 2014, the Court of Justice of the European Union (CJEU) declared the

Directive invalid, as it entailed a wide-ranging and particularly serious interference with the

fundamental rights to respect for private life and to the protection of personal data, without limiting

the access of the competent national authorities to the data retained to what was strictly

necessary2. The CJEU also found that the Directive did not provide sufficient safeguards to ensure

effective protection of the data against the risk of abuse and against any unlawful access and use of

the data2. Therefore, the Directive is no longer part of EU law.

Reference:

Directive 2006/24/EC of the European Parliament and of the Council

Court of Justice of the European Union PRESS RELEASE No 54/14

I hope this helps you understand the GDPR and data retention better. If you have any other

questions, please feel free to ask me.