Short answer
EU law does not permit routine general and indiscriminate retention of everyone's communications traffic and location data for ordinary crime control. The ePrivacy Directive protects communications confidentiality, and national restrictions under Article 15(1) must be clear, strictly necessary, proportionate and accompanied by safeguards under Charter Articles 7, 8, 11 and 52.
Different objectives permit different measures. A serious, genuine and present or foreseeable national-security threat can justify temporary general retention of traffic and location data under effective review. Serious crime and serious public-security threats can support targeted retention based on objective personal or geographic criteria, general retention of source IP addresses for a limited period, and expedited preservation of data already held. Basic subscriber identity may be retained more broadly. The categories cannot be treated as interchangeable.
Access is a separate interference and requires its own purpose, necessity and safeguards. Access to traffic or location data capable of revealing precise private-life patterns is generally reserved for serious crime or serious public-security threats and normally needs prior review by a court or independent administrative body. A prosecutor directing the investigation is not sufficiently independent for that control.
Police access to data stored on a seized phone falls principally under the Law Enforcement Directive and the Charter. It can be a serious interference and requires a precise legal basis, data minimisation, proportionality and normally prior independent authorisation, but EU law does not categorically restrict every phone search to serious crime.
Communications secrecy is the starting rule
Article 5 of Directive 2002/58/EC requires Member States to ensure the confidentiality of communications and related traffic data on public communications networks and services. Listening, tapping, storage or other interception or surveillance by persons other than users is prohibited without user consent, except where lawfully authorised under Article 15(1).
Traffic data can reveal who communicated with whom, when, for how long and through which network. Location data can reconstruct movement. Linked over time, those data can disclose social relationships, habits, workplaces, religion, health, political activity and intimate life even without message content.
General retention of traffic and location data cannot become the rule and confidentiality the exception. —
Article 15 permits legislative restrictions for specified objectives, including national security, defence, public security and prevention, investigation, detection and prosecution of crime. A restriction must be necessary, appropriate and proportionate in a democratic society. The measure must state who is affected, what data are involved, the period, access conditions, security, oversight and deletion with enough precision to constrain discretion.
General retention is not justified by ordinary serious crime
In Tele2 Sverige and Watson, joined cases C-203/15 and C-698/15, the Court held that EU law precludes general and indiscriminate retention of all traffic and location data for fighting crime. Such data concern all users and communications without any connection to a threat and produce a particularly serious interference.
La Quadrature du Net, joined cases C-511/18, C-512/18 and C-520/18, refined the permitted toolbox rather than abandoning that rule. For combating serious crime and preventing serious threats to public security, legislation may provide, subject to strict safeguards, for:
- targeted retention of traffic and location data using objective, non-discriminatory categories of persons or geographic criteria;
- general and indiscriminate retention of source IP addresses assigned to an internet connection for a strictly necessary period;
- general retention of users' civil-identity data; and
- expedited preservation of traffic and location data held by providers, including data initially retained for another lawful purpose.
Targeting must genuinely relate to the objective. Geographic retention can focus on places with an objectively high incidence or risk of serious crime, such as transport hubs or critical infrastructure, but cannot quietly cover almost the entire population indefinitely. Periods must be no longer than strictly necessary and renewable only after a fresh assessment.
Expedited preservation is not a power to generate historic data that never existed. It freezes data already stored lawfully so they are not deleted while competent authorities pursue access through the required procedure.
National security has a narrow exceptional route
National security remains the responsibility of Member States, but a law ordering communications providers to process, retain or transmit user data falls within the ePrivacy framework. Labelling the measure “intelligence” does not automatically remove it from EU law.
Where a Member State faces a serious threat to national security that is genuine and present or foreseeable, La Quadrature du Net permits an instruction for general and indiscriminate retention of traffic and location data. The instruction must be limited in time to what is strictly necessary, although renewable if the threat persists, and subject to effective review by a court or independent administrative body whose decision is binding.
Real-time collection and automated analysis are even more intrusive. They require objective criteria, strict limits to persons or situations linked to the threat, prior independent authorisation, security and audit. An open-ended system for all users without a demonstrable threat is not saved by invoking national security.
Retention and access are different legal decisions
Lawful retention does not make later access lawful. Authorities must identify the objective, data categories, people affected and requested period. Access capable of drawing precise conclusions about private life is a serious interference and is generally justified only by combating serious crime or preventing serious threats to public security.
Prior review must normally be carried out by a court or independent administrative body after a reasoned request. The reviewer must be neutral toward the investigation and able to refuse or narrow access. In Prokuratuur, C-746/18, the Court held that a public prosecutor responsible for conducting the investigation and possible prosecution did not provide the required independent prior review.
Urgency can justify access before review only within a narrowly defined exception followed promptly by independent control. Authorities must later notify the affected person once notice no longer jeopardises the investigation, unless a lawful, reviewable restriction applies. Effective remedies require enough information to contest necessity and legality.
The seriousness assessment depends on what the requested dataset can reveal, not just its duration. A small dataset can be highly revealing; a request for basic identity behind an IP address may be less intrusive. Purpose limitation also matters: data retained for national security cannot automatically become a general criminal-investigation archive.
Content interception requires stricter controls
Intercepting message or call content directly affects the substance of communications and can engage journalistic-source, lawyer-client, medical and political-expression protections. EU law requires a clear and foreseeable legal basis, an authorised objective, targeting criteria, necessity, limited duration, independent approval and supervision, secure handling, minimisation, destruction and remedies.
Bulk or automated techniques must distinguish acquisition, filtering, human examination, retention and dissemination. Safeguards at only the final reading stage do not erase interference occurring when providers transmit or systems analyse the data. Protected professions and confidential communications require specific screening and escalation rules.
EU instruments do not provide a complete criminal-procedure code for every intelligence technique. The European Convention on Human Rights, national constitutions and sector-specific EU law can impose additional protection. The controlling EU question is whether the national measure falls within EU law, particularly because it regulates providers or processes personal data for law enforcement.
Searching a seized phone is a separate regime
Direct police access to photos, messages, contacts, applications and files stored on a device is not the same as ordering a communications provider to retain network metadata. Processing by competent authorities for criminal-law purposes is governed principally by Directive (EU) 2016/680, the Law Enforcement Directive, together with Charter Articles 7, 8 and 47.
In Bezirkshauptmannschaft Landeck, C-548/21, the Court held that even an attempted phone-data access is covered. Because a phone can provide an extensive portrait of private life, access may be serious or particularly serious. National law must define the offences and other factors relevant to authorisation, and the particular search must be proportionate.
Police phone access normally requires prior review by a court or independent authority. —
The Court did not impose a categorical serious-crime threshold for every phone search. A less serious offence may justify carefully limited access, but not an unrestricted forensic extraction. Relevant factors include offence seriousness, the suspected person's link, the data types and date range, search terms, less intrusive alternatives and special-category or privileged data.
Urgency may permit action without prior authorisation where law strictly defines the circumstances, but prompt later review is required. The person must be informed of the reasons once doing so will no longer prejudice the investigation, enabling an effective remedy.
What a compliant authorisation should show
A retention or access decision should identify:
- the legal basis and precise public-interest objective;
- whether the measure concerns content, traffic, location, IP, identity or device data;
- people, accounts, geography and time period;
- the evidential link or threat assessment;
- why a less intrusive measure is inadequate;
- the independent authorisation and urgency route, if used;
- privilege, source and special-category-data protections;
- security, logging, disclosure, retention and deletion; and
- notice and judicial remedy.
Courts reviewing evidence should separate the legality of retention, access and trial use. A defect may require exclusion or another effective remedy under national law and the Charter, especially where the defence cannot challenge provenance or the material materially affects the result.
Conclusion
EU law permits targeted digital investigation, not population-wide data stockpiles by default. The permissible measure depends on the objective and data: national security, serious crime, IP addresses, subscriber identity, network metadata, content and device files each receive different treatment. Across them, the recurring controls are precise law, strict necessity, proportionality, independent review, security, limited duration and an effective remedy.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.