Exam CIPP-E topic 1 question 12 discussion

Correct answer is A. B is incorrect because the ePrivacy Directive does not fully harmonize the rules on data retention across all member states. It sets some general principles and allows for data retention under certain conditions, but it gives individual member states the discretion to establish their own specific regulations.

The correct answer is A. The ePrivacy Directive allows individual EU member states to engage in such data retention. The retention of communications traffic data for law enforcement purposes in the EU is primarily governed by the ePrivacy Directive. This directive allows individual EU member states to implement their own rules regarding data retention, which means that each country can decide how to handle the retention of such data within its jurisdiction12. The annulment of the Data Retention Directive by the Court of Justice of the European Union (CJEU) in 2014 did not make data retention permissible; rather, it invalidated the directive due to concerns over privacy and data protection3. This left the regulation of data retention to be addressed by national laws under the framework of the ePrivacy Directive. The GDPR, while comprehensive in its data protection rules, does not specifically address the retention of communications traffic data for law enforcement purposes

A. The ePrivacy Directive allows individual EU member states to engage in such data retention. This answer recognizes that the ePrivacy Directive provides the legal framework within which member states can legislate on data retention, subject to compliance with fundamental rights as interpreted by the CJEU. CJEU Rulings: The CJEU has clarified through cases like Digital Rights Ireland and Tele2 Sverige/Watson that blanket and indiscriminate data retention is not permissible under EU law. Any data retention must be targeted, necessary, and proportionate, with adequate safeguards to protect individuals' rights

The retention of communications traffic data for law enforcement purposes is addressed in different ways by European data protection law. The ePrivacy Directive allows individual EU member states to engage in such data retention but does not harmonize the rules concerning this across all states

"To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph."

Answer is A