Luxembourg: In the glass towers that house the Court of Justice of the European Union, a single question has refused to die for more than a decade: how long, and on what terms, may a democracy keep a record of everyone’s digital footprints on the chance that some of them might one day matter to a criminal investigation. As the Commission prepares fresh legislation to revive mandatory data retention across the bloc, that question is returning to the place where earlier answers were so emphatically given.
The history is unusually clear-cut for European law. In 2014 the Court struck down the EU’s Data Retention Directive in its Digital Rights Ireland judgment, ruling that forcing telecom operators to store the metadata of entire populations for up to two years amounted to a disproportionate interference with the rights to privacy and data protection. General and indiscriminate retention, the judges held, treats every citizen as a potential suspect, and the Charter of Fundamental Rights does not permit it.
In the years since, the Court has not so much reversed itself as carved out exceptions. A line of rulings has granted national governments increasing room to manoeuvre, distinguishing between categories of data and the seriousness of the threats invoked. Most strikingly, in its 2024 La Quadrature du Net judgment the Court accepted that the general retention of IP addresses, treated as less revealing than the full map of who contacted whom and from where, could be permitted even to pursue ordinary crime, provided strict technical safeguards keep the strands of a person’s identity separated.
That carefully built jurisprudence is now meeting a renewed political will to legislate. Frustrated by a patchwork of national rules that the courts keep trimming, and pressed by law-enforcement agencies who argue that serious crime and child-abuse investigations depend on access to historical metadata, the Commission opened a formal call for evidence in May 2025 and is expected to bring forward a draft framework. The ambition is to give the Union a durable, court-proof basis for retention rather than leaving each member state to improvise and litigate.
The difficulty is that the Court has spent ten years explaining exactly what it will not accept, and any new instrument must be built inside those walls. Privacy advocates warn that the appetite for a single EU-wide retention regime risks resurrecting precisely the blanket surveillance the judges buried in 2014, dressed in the language of safeguards. Police and prosecutors counter that targeted retention, limited to defined geographies or suspects, is unworkable against crimes whose perpetrators and victims cannot be known in advance.
The coming proposal will therefore be read less as a policy document than as a wager about where the line now sits. Will the Commission confine itself to the IP-address opening the Court has tentatively allowed, or test whether a decade of qualifications has softened the original prohibition far enough to permit something broader? Either way the answer will not be settled in a legislative chamber. It will travel, as every previous attempt has, back to Luxembourg, where the judges who have already drawn this map will decide whether the latest path respects it or strays once more onto ground the Charter places out of bounds.
This is a developing legislative process, and the precise scope of the forthcoming proposal remains to be confirmed.
