Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018 (vi) Directive does not require the data in question to be retained within the European Union. 182) In Tele2 Sverige AB vs. Post-och telestyrelsen73, the CJEU was seized with the issue as to whether in light of Digital Rights Ireland, a national law which required a provider of electronic communications services to retain meta-data (name, address, telephone number and IP address) regarding users/subscribers for the purpose of fighting crime was contrary to Article 7, 8 and 73 Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson, Peter Brice, Geoffrey Lewis, Joined Cases C-203/15 and C-698/15, 2016 11 of the EU Charter. The CJEU struck down the provision allowing collection of such meta data on grounds of lack of purpose limitation, data differentiation, data protection, prior review by a court or administrative authority and consent, amongst other grounds. It held: 103. While the effectiveness of the fight against serious crime, in particular organised crime and terrorism () cannot in itself justify that national legislation providing for the general and indiscriminate retention of all traffic and location data should be considered to be necessary for the purposes of that fight. xx xx xx 105. Second, national legislation () provides for no differentiation, limitation or exception according to the objective pursued. It is comprehensive in that it affects all persons using electronic communication services, even though those persons are not, even indirectly, in a situation that is liable to give rise to criminal proceedings. It therefore applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious criminal offences. Further, it does not provide for any exception, and consequently it applies even to persons whose communications are subject, according to rules of national law, to the obligation of professional secrecy. xx xx xx if it is to be ensured that data retention is limited to what is strictly necessary, it must be observed that, while those conditions may vary according to the nature of the measures taken for the purposes of prevention, investigation, detection and prosecution of serious crime, the retention of data must continue nonetheless to meet objective criteria, that establish a connection between the data to be retained and the objective pursued. In particular, such conditions must be shown to be such as actually to circumscribe, in practice, the extent of that measure and, thus, the public affected. 183) With respect to measures for data security and data protection the court held : 122. Those provisions require those providers to take appropriate technical and organisational measures to ensure the effective protection of retained data against risks of misuse and against any unlawful access to that data. Given the quantity of retained data, the sensitivity of that data and the risk of unlawful access to it, the Indian Kanoon - http://indiankanoon.org/doc/127517806/ 135