Official Journal of the European Union

C 15/16

(Case C-350/21) (1)

(Reference for a preliminary ruling - Processing of personal data in the electronic communications sector - Confidentiality of communications - Providers of electronic communications services - General and indiscriminate retention of traffic and location data for a period of six months - Combating serious crime - Access to the retained data - Informing the data subjects - Right to a remedy - Directive 2002/58/EC - Article 15(1) and (2) - Directive (EU) 2016/680 - Articles 13 and 54 - Charter of Fundamental Rights of the European Union - Articles 7, 8, 11 and 47 and Article 52(1))

(2023/C 15/16)

Language of the case: Bulgarian

Referring court

Party in the main proceedings

Operative part of the judgment

1.Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union

must be interpreted as precluding (i) national legislation that provides, by way of prevention, for the purpose of combating serious crime and preventing serious threats to public security, for general and indiscriminate retention of traffic and location data, even if that legislation limits that general and indiscriminate retention to a period of six months and provides for a certain number of safeguards as regards retention of and access to the data in question; and (ii) national legislation that does not provide, in a clear and precise manner, that the access to the retained data is limited to what is strictly necessary for achieving the objective pursued by that retention.

2.Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights, and Articles 13 and 54 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data,

must be interpreted as precluding national legislation that provides for access, on the part of the national authorities competent to undertake criminal investigations, to lawfully retained traffic and location data, without guaranteeing that the persons whose data have been accessed by those national authorities are informed thereof to the extent provided for under EU law, and without those persons having any remedy against unlawful access to those data.

Language of the case: Bulgarian

* * *

ECLI:EU:C:2025:140