Bulk interception of communications in the European Union

The two legal layers

EU law on interception has always been split across two instruments, and the split is the first thing to understand:

1. The ePrivacy Directive (2002/58/EC) provides that the confidentiality of communications may not be interfered with without a legislative basis.
2. Directive 2000/584/EC is that legislative basis. It sets the conditions under which member states may authorise interception.

So a lawful interception in the EU is not a matter of national practice alone. It is national practice measured against a directive that was itself adopted under the Treaty.

The conditions the Directive imposes

Article 5 of Directive 2000/584/EC is the operative provision. It requires that:

• interception be authorised in advance by a legislative instrument;
• the authorisation be granted only for the categories of serious crime defined by national law;
• the authorisation be subject to the opinion of a competent supervisory body and to control by a competent national authority;
• the authorisation be necessary and proportionate for the purpose for which it was requested.

The two-stage structure — a legislative basis for the offence category, then an individual authorisation for a specific target — is what separates a targeted interception power from a bulk one. The wording of Article 5 does not obviously require a target.

Digital Rights Ireland

In Case C-362/08, the Court of Justice held that EU law could not, as such, require a Member State to adopt legislation mandating indiscriminate interception. The judgment is why the phrase “indiscriminate interception” appears in almost every subsequent debate on the subject: it is the standard the Court applied to a directive that purported to require domestic legislation.

Whether a given national measure satisfies that standard is decided nationally and is frequently litigated, so the answers differ between member states and over time.

The 2023 recast

Directive (EU) 2023/2773 recast the 2000 framework. The material change is scope: the recast brings within the framework not only interception in transit but also data stored by a provider in one member state and accessible from another. That is the provision which raises the cross-border question directly, and its relationship with Digital Rights Ireland is actively contested.

Sources

• Directive 2000/584/EC — the interception framework. Article numbers cited above refer to this text.
• Digital Rights Ireland (C-362/08) — the judgment.
• Directive (EU) 2023/2773 — the recast.
• Article 8 ECHR — the separate Council of Europe obligation, which binds non-EU parties to the Convention and is enforced by Strasbourg rather than Luxembourg.