Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications netw

Directive 2006/24/EC (the Data Retention Directive) required the providers of publicly available electronic communications services or public communications networks to retain traffic and location data belonging to individuals or legal entities.  Such data included the calling telephone number and name and address of the subscriber or register user, user IDs (a unique identifier assigned to each person who signs with an electronic communications service), Internet protocol addresses, the numbers dialed, and call forwarding or call transfer records. The retention period was to last for a minimum period of six months and up to two years, and the sole purpose of processing and storing the data was to prevent, investigate, detect, and prosecute serious crimes, such as organized crime and terrorism. The content of the communications of individuals was not retained.

In April 2014, the Grand Chamber of the European Court of Justice declared the Data Retention Directive invalid on the ground that European Union legislators had exceeded the limits of proportionality in forging the Directive.  In particular, the Court held that the Directive entailed serious interference with the rights to privacy and personal data protection of individuals guaranteed by the Charter of Fundamental Rights, and also failed to establish limits on access by competent national authorities, such as prior review by a judicial or an independent administrative authority.  Because the ECJ did not specify otherwise, the Data Retention Directive is void ab initio. No proposal has so far been tabled by the Commission to replace the annulled Data Retention Directive.