LUXEMBOURG (CN) — The EU’s highest court dealt a blow to a missing persons case closed with dental records and incriminating texts, ruling Tuesday that a 2011 Irish law allowing the retention of traffic and location data violated European Union privacy regulations.
In a decision likely to have far-reaching repercussions for law enforcement across the bloc, the European Court of Justice concluded that the collection of phone metadata evidence used at Graham Dwyer's trial was "too general and indiscriminate.”
Ireland's Supreme Court referred the underlying case, asking the Luxembourg-based ECJ to weigh in on the 2011 Irish Retention of Data Act that required service providers to keep certain metadata for two years. While the EU had a 2006 Data Retention Directive that was the precursor to Ireland's statute, the court struck down that directive as excessive in 2014. A subsequent decision in 2020 involving complaints brought by privacy advocacy groups further restricted when authorities could require companies to keep data.
The Court of Justice confirmed Tuesday that EU law prohibits “general and indiscriminate” data retention, and that national governments must ensure “the persons whose personal data are affected have sufficient guarantees that those data will be effectively protected against the risk of abuse.”
Dwyer was convicted in 2015 for the killing of day care worker Elaine O’Hara three years earlier. After O'Hara went missing, her death was presumed a suicide until a dog walker found parts of her body. Nearby, a bag with handcuffs, leg restraints, a ball gag, a leather mask and a knife was also found. Dental records eventually confirmed that the remains were those of O'Hara.
Phone data obtained by the police showed that O'Hara had an ongoing sexual relationship with Dwyer, a well-known architect whom she met through the fetish sex website Alt.com. Text messages that Dwyer had sent the woman sealed his conviction. “I want to stick my knife in flesh while I am sexually aroused… I would like to stab a girl to death some time," he wrote.
Tuesday's ruling follows an advisory opinion last year from the Court of Justice, which held that only serious threats to national emergency and precious few other circumstances give national governments a basis for data retention. Information can be kept only to safeguard “the essential functions of the State and the fundamental interests of society,” Advocate General Manuel Campos Sánchez-Bordona wrote in his nonbinding 2021 opinion.
Likewise, the ruling from the full court this morning notes that there are some exemptions to the ban on broad data retention. Some information, such as targeted traffic and location data, can be retained for “the purposes of combating serious crime and preventing serious threats to public security,” the court wrote.
It’s not clear if the ECJ’s decision will help Dwyer in his pursuit to overturn his conviction. In a briefing following the hearing, a spokesperson for the court said it was the responsibility of national courts to determine whether or not the evidence is admissible.
"It is expected that the Supreme Court’s judgment will bring clarity in this important area to inform the necessary legislation,” Irish Minister of Justice Helen McEntee said in a statement following the ruling.
The case will now return to the Irish Supreme Court for a final ruling.
Follow @mollyquell
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
Additional Reads
-
-
Los Angeles assistant prosecutor faces felony charges April 24, 2024