Czech Republic: Supreme Court overturns indiscriminate data retention

For years, millions of Czechs were subjected to a legally mandated surveillance measure that the Supreme Court has now classified as unlawful. In a ruling on January 8 (Case No.: 30 Cdo 2556/2025), the Nejvyšší soud confirmed that the national data retention regulation violates EU law. This marked the end of a long-standing legal process that journalist Jan Cibulka, with the support of the data protection organization IuRe, had pursued against the Ministry of Industry and Trade.

The core of the case was the obligation for telecommunications providers to proactively store connection and location data of all users for six months. While the content of communications was not recorded, the data revealed who communicated with whom, when, and from where. According to the court, these metadata allow sensitive inferences to be made about the private lives of almost all citizens. Police and intelligence services could access this information without the need for a specific threat to be present in individual cases.

The judges clarified that such indiscriminate and widespread storage is only permissible in exceptional cases, such as in the event of an immediate and real threat to national security. However, since the Czech law mandated data collection indiscriminately and without regard to the security situation, the ruling states that it violates the EU's E-Privacy Directive. The court rejected the state's argument that the current global security situation, such as the war in Ukraine, justified such surveillance.

Judges see obligation for damages

The Constitutional Court also held that the mere feeling of being monitored and the associated loss of control over one's own data constitute non-pecuniary damage that warrants compensation. For journalists like Cibulka, this intrusion is particularly serious, as the protection of informants could have been undermined by the uncontrolled data storage. As a result of the ruling, the Ministry is now obliged to issue a formal apology to the plaintiff.

The decision brings the Czech Republic closer to the data protection standards of other EU states, such as Germany or Belgium, where similar data retention laws have already been stopped or severely restricted by courts. Civil rights advocates are pushing for a swift legislative reform to end mass data collection and limit government access to what is strictly necessary.

In Germany, Federal Minister of Justice Stefanie Hubig (SPD) is currently pushing for the indiscriminate data retention of IP addresses. The EU Commission is also planning a new EU-wide initiative in this controversial area. The European Court of Justice (ECJ) already declared a previous relevant directive void years ago and has only partially relaxed its case law over time – for example, regarding IP addresses. The Luxembourg judges repeatedly emphasize that such an investigative tool, which is relevant to fundamental rights, must be limited to the absolutely necessary.

(mho)