(Telecompaper) The European Court of Justice has agreed with the opinion of its advocate-general and declared the EU Data Protection Directive invalid. The directive requires communication providers to retain for up to two years metadata on all calls and internet sessions over their networks, so it can be used in eventual law enforcement actions. The court found that the collection and access to such data is a "particularly serious" interference with the fundamental right to a private life and protection of personal data. Furthermore, while the interests of public security could justify the measure, the system for collecting and accessing the data is not sufficiently circumscribed to ensure that the interference with personal rights is limited to what is strictly necessary. In particular, the directive does not differentiate who is affected by the data collection or allow for exceptions, it does not set the terms for access to the collected data or in what circumstances it may be used, and it does not provide enough protection against possible abuse or unlawful access to the data. In addition, it does not require the data to be stored in the EU, meaning the data cannot be sufficiently protected. The case against the directive was brought to the EU Court by the Irish group Digital Rights as well as several public and private parties in Austria. As a result of the court's ruling, the directive is invalid rectro-actively from the date it entered into force.