Scores of NGOs, rights groups and academics have filed complaints with the European Commission that member states have ignored EU Court of Justice (CJEU) rulings on mass surveillance.
UK groups Privacy International, Liberty and the Open Rights Group (ORG) joined the complainants, who want to end the practice of blanket and indiscriminate retention of communications data.
This was ruled unlawful by the CJEU in 2014 and 2016, yet member states continue to allow the practice and have been reluctant to share plans on how they propose to comply, according to the groups.
Although the standoff does not concern the content of communications, the groups argue that data on who we interact with, as well as how, when and where, is nevertheless highly sensitive.
It’s claimed that as many as 17 member states still allow non-targeted bulk data retention, despite the court’s rulings.
In 2016, the CJEU ruled that “national legislation such as that at issue in the main proceedings therefore exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society.”
Tomaso Falchetta, head of advocacy and policy at Privacy International, claimed that the joint action should not have been necessary.
“Governments have already been told clearly and unequivocally through two key rulings that they must stop blanket and indiscriminate retention of personal data,” he added. “In a world when more and more data can be generated, collected, shared, and exploited by governments and companies alike, strong privacy protections must be enforced.”
ORG executive director, Jim Killock, argued that the EU court was completely clear about blanket data collection.
“Governments do not get to pick and choose what courts tell them. When they do, they undermine the rule of law itself,” he added.
Complaints have been filed in 11 EU Member States: Belgium, the Czech Republic, France, Germany, Ireland, Italy, Poland, Portugal, Spain, Sweden and the United Kingdom.