Answer given by Ms Malmström on behalf of the Commission
Member States' national legislation is not directly concerned by the judgment of the Court of Justice of the European Union (CJEU) in Joined Cases C-293/12 and C-594/12 invalidating the Data Retention Directive.
Under EC law, in the absence of an EU Data Retention Directive, Member States may still maintain or set up new data retention schemes, under the conditions of Article 15(1) of the e-privacy Directive(1). Article 15(1) of the e-Privacy Directive allows Member States to adopt legislative measures providing for the retention of data for a limited period justified on the grounds including prevention, investigation, detection and prosecution of criminal offences, provided that such a restriction is a necessary, appropriate and proportionate measure within a democratic society. Such measures must be in accordance with the general principles of Union law, including fundamental rights. Member States' national legislation on data retention remains compatible with EC law to the extent that it complies with these criteria. Each Member State has to carefully assess whether there is a need to change its national legislation.
Directive 2002/58/EC of the European Parliament and of the Council of 12.7.2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications); OJ L 201, 31.7.2002, p. 37‐47 [link is to text as amended in 2009].