A Third Belgian Law Falls, for a New Reason
On September 3, 2026, Advocate General Maciej Szpunar issued his opinion in Case C-661/24, recommending that the Court of Justice of the EU strike down Belgium's 2022 data retention law. It is the third Belgian data retention law in a row to fail at the CJEU: the EU-wide Data Retention Directive fell in 2014, a second Belgian law fell after the court's 2020 La Quadrature du Net ruling, and this 2022 replacement now faces the same fate.
The 2022 law required communications providers to store identification, traffic, and location metadata for every user, aimed at cybercrime, network security, and online fraud. Szpunar found it covers a particularly broad set of data without imposing storage methods that keep the different categories genuinely separate, which he said makes the interference with privacy rights disproportionate.
The Test That Actually Matters: Watertight Separation
The reason this opinion reaches further than a routine strike-down is the standard Szpunar proposes for what would pass. He argues states may indiscriminately retain a broader range of traffic and location data, not just IP addresses, as long as technical controls keep the categories separate until a legal basis exists to combine them, calling that separation the condition for proportionality rather than the volume of data collected.
He frames this partly as a response to how cybercrime actually works: internet-facilitated offenses need the metadata trail to prosecute, he argues, so blanket bans on collection risk systemic impunity for a growing category of crime.
Where This Test Already Came From
Szpunar is not inventing the separation test from scratch. In 2024, the CJEU ruled in a separate La Quadrature du Net case, this one challenging France's copyright enforcement regime, that indiscriminate collection and storage of IP addresses and customer identity data is acceptable, even to fight crime below the serious-crime threshold, as long as the different metadata categories are kept separate until someone establishes a legal basis to combine them.
Szpunar's opinion asks the court to extend that same logic from IP addresses specifically to the wider set of traffic and location data types Belgium's law covers. A Dublin law professor and longtime chair of Digital Rights Ireland called it potentially a very important opinion, one that invites the CJEU to reconsider the basis of its entire data retention case law around storage and access controls rather than collection itself.
Not Everyone Reads This as Progress
Digital rights groups organized under European Digital Rights have already signaled they will fight any framework built on this reasoning, arguing indiscriminate retention creates its own security risk: the metadata a state retains for law enforcement is also metadata vulnerable to the next breach. They also dispute the premise that indiscriminate retention actually reduces crime, saying no scientifically proven link exists between the two.
Szpunar's opinion is advisory only. The CJEU can rule differently, though it follows its Advocate Generals' opinions in most cases, according to legal observers tracking the case.
What Comes Next, and the Table That Shows the Pattern
The European Commission has been quietly preparing new EU-wide rules to replace the long-dead Data Retention Directive, having run an impact assessment and public consultation, and has promised to explore measures for cross-border lawful interception by 2027. A CJEU ruling that follows Szpunar's opinion would hand that drafting process a green light for broader retention it did not clearly have before. Any business handling communications metadata under an EU retention mandate should treat this opinion as the first signal of where that framework is heading, months before a final ruling or a Commission proposal exists.
| Year | Ruling or opinion | Effect |
|---|---|---|
| 2014 | EU Data Retention Directive struck down | Blanket six-to-24-month metadata retention ruled mass surveillance |
| 2020 | La Quadrature du Net (Belgium) | Retention allowed only if targeted, with real access safeguards |
| 2022 | Belgium's third retention law | Broad metadata retention law passed, now challenged |
| 2024 | La Quadrature du Net (France, copyright) | Indiscriminate IP address retention allowed if categories stay separate |
| 2026 | Szpunar opinion, Case C-661/24 | Proposes extending separation test to broader metadata types |
Servola Journal
We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.
Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.
If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.
Read next: A GDPR Fine for Records Left to Rot in a Bathroom | Perplexity's Local AI Mode Is Not a GDPR Shortcut
