EU Seeks to Revive Banned Mass Surveillance Law

The European Union is pushing to reintroduce a data retention law previously struck down by its highest court for enabling illegal mass surveillance. The European Commission has opened a public consultation to gather feedback on the proposal, which aims to mandate telecommunications companies to store user data for law enforcement purposes.

In 2014, the Court of Justice of the European Union (CJEU) annulled the Data Retention Directive, ruling that blanket collection of phone and internet data violated fundamental privacy rights. The decision, known as Digital Rights Ireland, found the directive lacked proportionality and sufficient safeguards, compromising citizens’ rights to privacy and data protection.

Despite the ruling, several EU member states, including France and Ireland, have maintained or introduced national laws allowing broad data retention. Subsequent CJEU rulings in 2020 and 2022 reinforced that indiscriminate data collection is permissible only under strict conditions, such as serious threats to national security.

The new proposal, driven by the High-Level Group on Access to Data for Effective Law Enforcement, seeks to create a standardized EU framework for data retention. The group, formed under the Swedish Presidency in 2023, argues that law enforcement needs consistent access to communications data to combat crime and terrorism.

Critics, including privacy advocates like Privacy International, warn that the plan risks repeating past violations of fundamental rights. They argue that mass data retention undermines privacy, freedom of expression, and the right to a fair trial, especially without robust oversight.

The European Commission’s consultation, launched in early 2025, invites input from citizens, businesses, and civil society groups. The process has sparked controversy, with some alleging it requires excessive personal information from participants, raising concerns about transparency.

Member states like Belgium have attempted targeted data retention systems, but these too have faced legal challenges for overreach. France and Denmark have openly resisted CJEU rulings, with the latter’s revised data retention law struck down after just six days in 2022.

Proponents of the law claim it balances security and privacy by incorporating stricter safeguards than previous frameworks. They point to rising cybercrime and terrorist threats as justification for enhanced law enforcement access to metadata.

Civil liberties groups argue that any revival of mass surveillance must include independent oversight and clear limits on data use. They cite the CJEU’s consistent stance that blanket retention is rarely justified under EU law.

The consultation’s outcome could shape the EU’s approach to surveillance for years, with potential clashes looming between member states and the CJEU. Privacy advocates urge citizens to participate to ensure the law respects fundamental rights.