03/02/2020 CURIA - Documents preliminary investigations that relate to, inter alia, offences punishable by a sentence of imprisonment of at least six months. The expression ‘placing electronic communications under surveillance’, under Paragraph 19 of Chapter 27 of the RB, means obtaining data without the knowledge of third parties that relates to a message transmitted by an electronic communications network, the electronic communications equipment located or having been located in a specific geographical area, and the geographical area(s) where specific electronic communications equipment is or has been located. According to what is stated by the referring court in Case C‑203/15, information on the content of a message may not be obtained on the basis of Paragraph 19 of Chapter 27 of the RB. As a general rule, placing electronic communications under surveillance may be ordered, under Paragraph 20 of Chapter 27 of the RB, only where there are reasonable grounds for suspicion that an individual has committed an offence and that the measure is particularly necessary for the purposes of the investigation: the subject of that investigation must moreover be an offence punishable by a sentence of imprisonment of at least two years, or attempts, preparation or conspiracy to commit such an offence. In accordance with Paragraph 21 of Chapter 27 of the RB, the prosecutor must, other than in cases of urgency, request from the court with jurisdiction authority to place electronic communications under surveillance. The security and protection of retained data Under Paragraph 3a of Chapter 6 of the LEK, providers of electronic communications services who are subject to an obligation to retain data must take appropriate technical and organisational measures to ensure the protection of data during processing. On the information provided by the referring court in Case C‑203/15, Swedish law does not, however, make any provision as to where the data is to be retained. United Kingdom law DRIPA Section 1 of DRIPA, headed ‘Powers for retention of relevant communications data subject to safeguards’, provides: The Secretary of State may by notice (a “retention notice”) require a public telecommunications operator to retain relevant communications data if the Secretary of State considers that the requirement is necessary and proportionate for one or more of the purposes falling within paragraphs (a) to (h) of section 22(2) of the Regulation of Investigatory Powers Act 2000 (purposes for which communications data may be obtained). A retention notice may: relate to a particular operator or any description of operators; require the retention of all data or any description of data; specify the period or periods for which data is to be retained; contain other requirements, or restrictions, in relation to the retention of data; make different provision for different purposes; relate to data whether or not in existence at the time of the giving, or coming into force, of the notice. The Secretary of State may by regulations make further provision about the retention of relevant communications data. (4) Such provision may, in particular, include provision about: requirements before giving a retention notice; the maximum period for which data is to be retained under a retention notice; the content, giving, coming into force, review, variation or revocation of a retention notice; the integrity, security or protection of, access to, or the disclosure or destruction of, data retained by virtue of this section; the enforcement of, or auditing compliance with, relevant requirements or restrictions; a code of practice in relation to relevant requirements or restrictions or relevant power; the reimbursement by the Secretary of State (with or without conditions) of expenses incurred by public telecommunications operators in complying with relevant requirements or restrictions; the [Data Retention (EC Directive) Regulations 2009] ceasing to have effect and the transition to the retention of data by virtue of this section. The maximum period provided for by virtue of subsection (4)(b) must not exceed 12 months beginning with such day as is specified in relation to the data concerned by regulations under subsection (3). ...’ Section 2 of DRIPA defines the expression ‘relevant communications data’ as meaning ‘communications data of the kind mentioned in the Schedule to the [Data Retention (EC Directive) Regulations 2009] so far as such data is generated or processed in the United Kingdom by public telecommunications operators in the process of supplying the telecommunications services concerned’. RIPA Section 21(4) of the Regulation of Investigatory Powers Act 2000 (‘RIPA’), that section being in Chapter II of that act and headed ‘Lawful acquisition and disclosure of communications data’, states: ‘In this Chapter “communications data” means any of the following: any traffic data comprised in or attached to a communication (whether by the sender or otherwise) for the purposes of any postal service or telecommunication system by means of which it is being or may be transmitted; any information which includes none of the contents of a communication (apart from any information falling within paragraph (a)) and is about the use made by any person: of any postal service or telecommunications service; or in connection with the provision to or use by any person of any telecommunications service, of any part of a telecommunication system; any information not falling within paragraph (a) or (b) that is held or obtained, in relation to persons to whom he provides the service, by a person providing a postal service or telecommunications service’. curia.europa.eu/juris/document/document.jsf?text=&docid=186492&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1088733 6/16