As a result, Austrian law has been changed with the repeal of regulations that allow police and justice ministries to store information relevant to criminal investigations for up to six months.
Certain types of data storage in Austria have now been abolished by the Austrian constitutional court (VfGH). On Friday, relevant regulations were repealed, effective immediately. According to the VfGH, the regulations were a "serious infringement of basic rights".
Last year, the European Court of Justice (ECJ) already ruled that the guidelines in question were against EU law. The ECJ said that the EU guideline in question – which allows data storage for up to six months for criminal investigations – was incompatible with the Charter of Fundamental Rights of the EU.
Data protection rights advocates welcomed the decision. The Austrian justice and interior ministries said they accepted the ruling, but new measures to fight crime were now needed.
In particular, states within the EU have been introducing legislation requiring phone companies and Internet Service Providers (ISPs) to keep records on the activities of all of their customers – including logs of all calls, locations of mobile phones for each user, records of web pages visited and emails sent and received – for periods of up to two years.
The court's opinion held that the measure "entails a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary."
The ECJ further said that the retention of data for the purpose of their possible transmission to the competent national authorities genuinely satisfies an objective of general interest, namely the fight against serious crime and, ultimately, public security.
However, the Court is of the opinion that, by adopting the Data Retention Directive, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality.
Damningly, the court added that the directive failed to offer sufficient safeguards "against the risk of abuse and against any unlawful access to use of the data".
The ECJ has issued rulings that affect Austrians before, including a ruling in April that supported the freedom to provide services, in the case of gambling machines which had been seized from four different operators for being used without a license.
In each case, such rulings apparently are being based on the Charter of Fundamental Rights of the European Union, and are being used to override Austrian legislation.
According to a report from Bloomberg, the ruling makes Austria the first country in the EU to implement the ECJ ruling.
Austria's now defunct data retention legislation required telecommunications, e-mail and Internet service providers to save data, such as login names, Internet protocol addresses, user names and addresses, login and logout times and the addresses of incoming and outgoing e-mails, for six months.
The law didn't require the content of e-mails or phone calls to be stored.