Following the CJEU’s landmark judgment from 6 October 2020 in La Quadrature du Net and Others (→ eucrim 2/2020, 3/2020, 184-186), the Portuguese Council Presidency wishes to make progress in drafting new EU legislation to harmonise the public authorities’ access to traffic and location data preserved by electronic communication service providers.

In a CATS meeting on 8 February 2021, several Member States, including Spain and France, as well as the EU Counter Terrorism Coordinator, took the position that “new EU legislation on data retention is urgently needed due to the legal vacuum existing at the time.” They proposed that the EU should take the following approach:

• Include measures, criteria, and safeguards for the protection of fundamental rights;
• Combine these measures with changes in secondary legislation such as the GDPR;
• Adapt the provisions of other instruments that affect the data retention regime (the ePrivacy Directive and the Digital Services Act), “in particular with a view to ensuring that the latter would not limit the scope of the future data retention regime.”

During the discussions, most Member States believed that the implementation of the CJEU’s guidelines in relation to targeted data retention are not only difficult to implement but could also “be ineffective and insufficient given the needs of law enforcement authorities.”

In a working paper issued on 19 February 2021, the Portuguese Council Presidency proposed to start with discussions on two situations where the CJEU holds surveillance measures to be permissible. First, targeted retention of traffic and location data if certain requirements are fulfilled. Second, retention of the IP address of the source of a communication and civil identity data, where the CJEU showed some flexibility towards general retention. To this end, the Portuguese Council Presidency posed several questions on these two topics and invited the Member States to comment on them.

In addition, the Portuguese Council Presidency took up the matter of data retention at the highest political level. In a discussion paper of 2 March 2021, it invited the national ministers of justice to express their views on the following issues:

• Should legislation be adopted to ensure a harmonized legal regime on data retention at the EU level, taking due account of the case law of the CJEU?
• If so, should a targeted or comprehensive approach be adopted?
• On the contrary, could data retention in the framework of police and judicial cooperation be based solely on national data retention laws (which are in line with the CFR and CJEU case law)?

At their informal meeting on 11 March 2021, the ministers of justice agreed to follow a common solution.