Smartphones english
© AFP
The European Court of Justice has ruled that countries cannot make phone or internet providers indiscriminately monitor and retain customers' internet and phone data, even to fight crime.

The judgement moves the EU further away from countries such as the US and China, which integrate mass surveillance into their domestic security arrangements.

However, the Court also said that there may be exceptions to this rule when a country is facing "a serious threat to national security that proves to be genuine and present or forseeable".

The ruling is the result of four cases in France, Belgium and Britain in which governments have called for the extension of surveillance tools for the protection of their citizens.

The Court was addressing laws that require phone and internet companies "to carry out the general and indiscriminate retention of traffic data and location data as a preventive measure".

This could not be allowed stand, the Court said, because
"those obligations to forward and to retain such data in a general and indiscriminate way constitute particularly serious interferences with the fundamental rights guaranteed by the Charter [of Fundamental Rights Of The European Union], where there is no link between the conduct of the persons whose data is affected and the objective pursued by the legislation at issue".
The Court outlined some of the conditions in which exceptions to the anti-surveillance ruling might be allowed.

"In situations where the Member State concerned is facing a serious threat to national security that proves to be genuine and present or foreseeable, the directive on privacy and electronic communications, read in the light of the Charter, does not preclude recourse to an order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data," it said.

However, the Court said that in such exceptions, the order to monitor traffic or data must only be "for a period that is limited in time to what is strictly necessary". More pointedly, the reasons and context for the decision "must be subject to effective review either by a court or by an independent administrative body whose decision is binding, in order to verify that one of those situations exists and that the conditions and safeguards laid down are observed".

Surveillance is a sensitive international issue between the EU and other jurisdictions. In the summer, the ECJ ruled that data protection regulators had to start issuing orders to stop the transfer of EU citizens' personal data to countries like the US where insufficient regulatory tools were being relied on to protect our personal information from surveillance.

Last month, the issue flared up in Ireland when the Irish Data Protection Commissioner, Helen Dixon, issued a preliminary order to Facebook to cease the transfer of personal data from the EU to the US, based on its current transfer legality. Facebook has applied to the High Court for judicial review of Ms Dixon's order.