Significant point 1 — confirms that data retention requirements from states to electronic communications services are covered by EU law — not exempt because national security related (esp. under Art.4(2) TEU) https://twitter.com/eucourtpress/status/1313379250511196164

2/ “General and indiscriminate” retention of traffic and location data are “particularly serious interferences with the fundamental rights guaranteed by the Charter”

3/ Allows retention by a Member State “facing a serious threat to national security that proves to be genuine and present or foreseeable”, if the decision is “subject to effective review either by a court or by an independent administrative body whose decision is binding”

4/ Perhaps most interesting… CJEU rules that national courts may not apply provisions of national law in this situation which are incompatible with EU law, and must “disregard information and evidence obtained by means … in breach of EU law” where suspects can’t challenge

Also important: DPEC “does not preclude the automated analysis of the [traffic and location data], of all users of means of electronic communication.” (NB These quotes are all from the CJEU press release. Full judgment coming shortly on CJEU website.)