AG Opinion: A new focus on data segregation
On 3 September 2026, Advocate General Maciej Szpunar delivered his Opinion in Académie Fiscale and Others (Case C-661/24) (the “Opinion”), a preliminary reference from the Belgian Constitutional Court concerning the compatibility of Belgium’s 2022 communications data retention legislation with Directive 2002/58/EC (the “ePrivacy Directive”) and the Charter of Fundamental Rights.
The key takeaway is that the Advocate General builds on the Court of Justice of the European Union’s (the “CJEU”) reasoning in La Quadrature du Net II, suggesting that the proportionality of a data retention regime should be assessed not only by reference to the categories of data retained, but also by the technical arrangements surrounding that retention. In other words, the severity of an interference with fundamental rights may depend not only on the data being retained, but also on whether technical safeguards prevent that data from being combined in a way that enables detailed profiling of individuals. The focus therefore shifts from simply asking what data is retained to also asking how that data is retained.
The Advocate General concluded that the Belgian legislation is incompatible with EU law because it permits retention of a broad range of traffic and location data without requiring technical arrangements that ensure genuine separation between different categories of retained data.
Could this Opinion raise new questions for Ireland’s data retention framework?
While the Opinion concerns Belgian legislation, it raises an interesting question as to whether Ireland’s Communications (Retention of Data) (Amendment) Act 2022 (the “2022 Act”) would satisfy the approach proposed by the Advocate General. The 2022 Act overhauled Ireland’s telecommunications data retention regime and updated the Communications (Retention of Data) Act 2011 (the “2011 Act”), in response to EU case law.[1] See our previous analysis on the overhaul of Irish data retention laws here.
Schedule 2 data, defined in the 2011 Act and retained under the 2022 Act, consists of traffic and location data rather than communication content. It includes metadata such as calling records, source and destination information, device identifiers and mobile location data.
The Irish data retention regime contains general requirements from which practical segregation expectations could be derived, including:
- Section 4 of the 2011 Act (carried forward to the 2022 Act) requires that retained data be protected by appropriate technical and organisational measures and be accessible only to authorised personnel; and
- Section 5 of the 2011 Act (carried forward to the 2022 Act) limits when a service provider can access the data it holds at all.
The Irish regime’s approach to protecting retained data is built around security-measure adequacy and access gating, not a specific structural segregation mandate. It does not contain express requirements regarding the segregation of different categories, nor does it prescribe the type of technical segregation measures specifically envisaged by the Advocate General.
The Opinion is not binding and the CJEU may not ultimately adopt the Advocate General’s approach. However, if it does, questions may arise as to whether the 2022 Act provides sufficiently prescriptive safeguards regarding storage and segregation of retained Schedule 2 data and there may be a need for amendments depending on the CJEU outcome.
What does this mean for telecoms providers?
Any move towards more prescriptive segregation requirements may require a review of existing retention systems and governance arrangements, with a view to ensuring that different categories of retained data are kept completely secure and are protected from unauthorised access. If this approach is adopted by the CJEU, telecoms providers could find themselves facing additional compliance obligations, increased technical investment and greater scrutiny of their retention practices. The debate may therefore shift beyond the legality of retention itself and towards whether providers can demonstrate that retained data is stored and managed in accordance with the safeguards required by EU law.
A parallel compliance challenge with the e-Evidence regime
As discussed in our previous analysis, the e-Evidence regime concerns authorities’ ability to obtain timely access to electronic evidence through European Production Orders and European Preservation Orders. Service providers may be required to preserve or produce stored data within strict statutory deadlines. The Opinion addresses a different stage of the process; rather than focusing on how authorities obtain access to data, it considers the circumstances in which data may be retained and the safeguards that must apply for the duration of the retention period.
These two developments illustrate parallel compliance challenges. The e-Evidence regime concerns access to stored data, whereas Académie Fiscale concerns the retention of communications data and the safeguards surrounding that retention. Together, they highlight the increasing regulatory focus on both the availability and governance of communications data.
Key takeaways
Although the CJEU is not bound by the Opinion, it is a case that telecoms providers should watch closely. The Opinion suggests that future assessments of communications data retention regimes may place greater emphasis on how retained traffic and location data is stored, segregated and governed, rather than focusing solely on whether retention itself is permissible.
This raises interesting questions regarding the continuing compatibility of the 2022 Act with EU law. While the 2022 Act introduced significant reforms, it does not appear to prescribe the type of “genuinely watertight separation” between different categories of retained data envisaged by the Advocate General.
If the CJEU ultimately adopts that approach, the decision may prompt renewed scrutiny of both the 2022 Act and telecoms providers’ retention practices. In turn, this may raise questions as to whether the Irish framework contains sufficiently detailed safeguards governing the storage and segregation of Schedule 2 data, potentially necessitating further legislative or regulatory reform to ensure continued alignment with evolving EU law requirements.
Contact us
Please contact Kate McKenna, Simon Shinkwin, Davinia Brennan or your regular Matheson contact with any queries.
[1] G.D. v The Commissioner of the Garda Síochána, Case C-140/20, EU:C:2022:258.
