On Tuesday, the European Court of Justice (ECJ) issued rulings that limit indiscriminate data retention in France and Germany.
The French case involves two suspects, VD and SR, accused of insider dealing, corruption, and money laundering, who challenged the legal basis cited by the French Financial Markets Authority (Autorité des marchés financiers) to obtain personal data from telephone calls that had been stored for a year in case the info might be useful for criminal investigators.
The ECJ, based in Luxembourg, found [PDF] that the EU's Market Abuse Directive and the Market Abuse Regulation cannot ignore the EU's Directive on privacy and electronic communication.
Those rules, the ECJ said, "do not authorize the general and indiscriminate retention by operators providing electronic communications services of traffic data for a year from the date on which they were recorded for the purpose of combating market abuse offenses including insider dealing."
Separately, German telecom firms SpaceNet and Telekom Deutschland challenged the German legal requirement that companies retain traffic and location data for all customers' communications.