On 3 October 2017, the Irish government published the general scheme of the Communications (Retention of Data) Bill 2017 (the "Bill"). The Bill is a response to recent judgments of the Court of Justice of the European Union (the "CJEU"), specifically the 2014 Digital Rights Ireland case and the 2016 Tele2/Watson case.
The Bill concerns the retention of metadata by communications service providers. Metadata includes IP addresses, time stamps, call durations, and the size of communications.
The Bill does not cover the retention of the actual content of communications. Nevertheless, the content of communications are likely to be captured by data protection legislation.
In 2014, the Digital Rights Ireland case was referred from the Irish High Court to the CJEU for a preliminary ruling on the validity of the EU Data Retention Directive 2006/24/EC (the "Directive"). In Ireland, the Directive was transposed into law by the Communications (Retention of Data) Act 2011 (the "2011 Act").
The Directive introduced laws compelling the storage of telecommunications data. It required the collection and retention of traffic and location data by companies such as mobile and broadband providers for a period of up to two years.
In Digital Rights Ireland, the CJEU acknowledged that the Directive had a legitimate objective in seeking to fight serious crime. However, it ultimately held the Directive breached EU law for allowing indiscriminate surveillance of EU citizens. The broad and far-reaching Directive breached fundamental European rights. The Directive did not limit the:
categories of individuals method of communications, or types of traffic data that were collected on foot of the Directive. Further, the Directive was silent as to the retention period for this type of data. While fundamental rights can be limited in circumstances where the limitation is necessary and proportionate to the objectives sought, the Directive did not comply with this principle.
The judgment left the 2011 Act, which had largely mirrored the Directive, with questionable legal standing. The CJEU had declared the Directive invalid, but no domestic repeal of the 2011 Act followed.
In 2015, the European Parliament's Legal Services published an opinion setting out specific guidance for legislating in the wake of the Digital Rights Ireland decision. The European Commission subsequently confirmed that "the decision of whether or not to introduce national data retention laws is...