27/07/2023, 22:38 CURIA - Documents 34 According to the referring court, although the exclusion of certain means of communication or certain categories of data and the limitation of the retention period are not sufficient to eliminate all risk of establishing a comprehensive profile of the persons concerned, that risk would be at least considerably reduced in the context of the implementation of the national legislation at issue in the main proceedings. 35 In the third place, that legislation contains strict limitations as regards the protection of retained data and access thereto. Thus, first, it ensures the effective protection of retained data against the risks of abuse and against any unlawful access to those data. Secondly, the data retained can be used only for the purposes of fighting serious crime or for the prevention of a specific risk to a person’s physical integrity, life or freedom or to the continued existence of the Federal Republic or a Land. 36 In the fourth place, the interpretation of Article 15(1) of Directive 2002/58 to the effect that any data retention without a reason is generally incompatible with EU law could conflict with the Member States’ obligation to act, arising from the right to security enshrined in Article 6 of the Charter. 37 In the fifth place, the referring court considers that an interpretation of Article 15 of Directive 2002/58 as precluding the general retention of data would considerably restrict the discretion of the national legislature in an area concerning the prosecution of crimes and public security, which, in accordance with Article 4(2) TEU, remains the sole responsibility of each Member State. 38 In the sixth place, the referring court considers that it is necessary to take into account the case-law of the European Court of Human Rights and notes that that court has held that Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (‘the ECHR’) does not preclude national provisions providing for the bulk interception of cross-border flows of data, in view of the threats currently facing many States and the technological tools which terrorists and criminals may now use in order to commit wrongdoings. 39 In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling: ‘In the light of Articles 7, 8 and 11 and Article 52(1) of the [Charter], on the one hand, and of Article 6 of the [Charter] and Article 4 [TEU], on the other hand, is Article 15 of Directive [2002/58] to be interpreted as precluding national legislation which obliges providers of publicly available electronic communications services to retain traffic and location data of end users of those services where: (1) (2) that obligation does not require a specific reason in terms of location, time or region, the following data are the subject of the retention obligation in the provision of publicly available telephone services – including the transmission of SMS, multimedia messages or similar messages and unanswered or unsuccessful calls: (a) the telephone number or other identifier of the calling and called parties as well as, in the case of call switching or forwarding, of every other line involved, (b) the date and time of the start and end of the call or – in the case of the transmission of a short message, multimedia message or similar message – the times of dispatch and receipt of the message, and an indication of the relevant time zone, (c) information regarding the service used, if different services can be used in the context of the telephone service, (d) and also, in the case of mobile telephone services (i) the International Mobile Subscriber Identity of the calling and called parties, (ii) the international identifier of the calling and called terminal equipment, https://curia.europa.eu/juris/document/document_print.jsf;jsessionid=A4432EEFFE3535A201E714AE6441EE66?mode=DOC&pageIndex=1&docid=265881… 10/28