Abstract
Recent technological developments have brought into question the protection of personal data and individual privacy. This contribution focuses on the harmonisation of ‘data retention’ rules in the European Union (EU), in particular, the controversy surrounding the adoption and implementation of the Data Retention Directive (2006/24/EC). It first considers the initiation of secondary EU legislation on data retention and the human rights implications of the retention of ‘traffic data’ for the purpose of law enforcement. It then discusses challenges against domestic implementation legislation that have been initiated by NGOs. The analysis leads to the conclusion that harmonisation of the length of time that telecom operators and internet providers must retain data, along with other measures regarding the prosecution of crime, have not been met with success. These measures have rather generated uncertainty as to the form that data retention should take vis-à-vis the permissible degree of centralisation of power to the EU and the adoption of legislation that allows for abuses of retained data contrary to the rule of law and fundamental rights. With an ECJ preliminary ruling pending on the constitutionality of Directive 2006/24/EC, this debate is all more interesting.