Mass surveillance of electronic communications metadata

The Greek law on the retention of electronic communications metadata (Law 3917/2011) was not revised following the 2014 ruling of the Court of Justice of the European Union (CJEU), which invalidated the EU Data Retention Directive (Directive 2006/24) as disproportionate, nor after subsequent clarifications in 2016 and 2020.

The pre-litigation research support grant enabled Homo Digitalis to undertake a comprehensive legal and institutional analysis of the available avenues for challenging the Greek data retention framework. Documents related to their pre-litigation work and planning are uploaded below.

While undertaking their pre-litigation activities, there was a landmark outcome from the Hellenic Data Protection Authority (HDPA), which has opened up the opportunity for direct follow up litigation and use of the pre-litigation materials.

The background is that Homo Digitalis had, since 2019, consistently advocated for a revision to the to ensure adequate human rights protections. In July 2019, Homo Digitalis revealed that the special committee of the Hellenic Ministry of Justice—tasked in 2014 with revising Law 3917/2011—had failed to produce any work and had terminated its activities. Subsequently, in August 2019, Homo Digitalis filed a legal complaint before the Hellenic Data Protection Authority (HDPA) challenging the legality of the data retention regime.

In 2024, this effort culminated in a landmark outcome: the issuance of HDPA Decision 19/2024, which vindicated the data subject represented by Homo Digitalis and obliged Vodafone to grant access to the requested metadata. The decision effectively recognised the problematic nature of the current data retention framework and laid the foundation for a strategic judicial and institutional challenge to Law 3917/2011.

Following this success, Homo Digitalis is now implementing a dual strategy aimed at securing structural reform. On the judicial front, they plan to intervene before the Council of State in the annulment proceedings lodged by Vodafone, supporting the validity of the HDPA’s decision and requesting a preliminary reference to the CJEU pursuant to Article 267 TFEU.

In parallel, Homo Digitalis intends to submit a complaint to the European Commission, arguing that the national framework mandating general and indiscriminate retention of metadata violates EU law as interpreted in landmark CJEU judgments (Digital Rights Ireland, Tele2 Sverige, La Quadrature du Net). Should the Commission initiate infringement proceedings against Greece, this would exert strong institutional pressure for the amendment or abolition of Law 3917/2011.

By combining these two complementary actions, strategic litigation before the Council of State and a formal complaint before the European Commission, Homo Digitalis seeks to address the issue simultaneously at the national, EU, and institutional levels. This approach strengthens both the individual protection of data subjects and the systemic pressure for reforming Greece’s data retention framework, marking a decisive step forward in aligning national law with the European acquis.