By Jesper Lund, EDRi member IT-Pol, Denmark
With its judgments in April 2014 (Digital Rights Ireland ) and December 2016 (Tele2 ), the Court of Justice of the European Union (CJEU) ruled that blanket data retention was illegal under EU law. Rather than repealing their illegal data retention laws, EU Member States have instead adopted a tactic of ignoring the highest court of the European Union under the pretence of a “common reflection process” with an expert data retention working group under the Working Party on Information Exchange and Data Protection (DAPIX).

On 8 April 2014 the Court of Justice of the European Union (CJEU) found the the 2006 EU Directive on mandatory data retention was unlawful and had been so since the day it was passed. The judgment followed a critical Opinion of the Court's Advocate-General delivered on 12 December 2013.  The CJEU judgment is damning in its rejection of mass surveillance based on the retention of data on every communication by everyone resident in the whole EU.