Digital Rights Ireland as an Opportunity to Foster a Desirable Approximation of Data Retention Provisions

Directive 2006/24/EC sets out data retention rules and is a useful tool for the investigation, detection and prosecution of serious crimes. The implementation process has been complex mainly due to concerns about data privacy rights, and led to ‘patchwork’ approximation of data retention provisions within the EU. The CJEU's ruling in Digital Rights Ireland eventually invalidated the Directive so that EU policy makers must urgently reinvent the entire framework. In this context, this article argues that approximation is the most desirable policy option to ensure a balance between enhancing security and safeguarding data privacy rights, and assesses what form the new instrument could take. It explores selected factors that are likely to influence the policy design: unresolved issues at the time the Directive was negotiated; interplay between national/EU data retention frameworks; CJEU's stringent requirements set out in Digital Rights Ireland and Schrems; current progress of the Data Protection Package