The decision follows a two-day hearing on the legality of the UK’s bulk data collection program, after it was challenged by watchdog group Privacy International. The group accused the British authorities of using “vague” claims about national security to justify the bulk storage of data for up to 14 years.
The ruling is the result of four cases in France, Belgium and Britain in which governments have called for the extension of surveillance tools for the protection of their citizens.
The panel of 15 judges ruled that the indiscriminate and mass collection of telephone, internet and web communications traffic is not compatible with European law. The ECJ said governments could resort to such practices only if they face a “serious threat to national security.” However, even in the extreme circumstances in which bulk data collection is deemed warranted, such surveillance programs should be limited to a period that is “strictly necessary,” the court explained.
The ruling comes several months after the ECJ determined that an EU-US pact that regulated the flow of EU user data to the United States was invalid, stating that US national security laws were insufficient for shielding Europeans from American government snooping.
Judgments in Case C-623/17
