According to the AG, paragraphs 56 to 59 of Digital Rights Ireland should indeed be interpreted as meaning that a general data retention obligation does not pass
the strict necessity test but only if «it is not accompanied by stringent safeguards concerning access to the data, the period of retention and the protection and security of the data» (§ 195, original emphasis).