The end for data retention?

The European Court of Justice (ECJ) ruled on Tuesday that the German version of data retention is not compatible with EU law. Now the framework for a new regulation in Germany must be set. Will there still be data retention in Germany then?

Find out here what the ECJ and politicians are currently saying about this.

Previous regulation in Germany

The German regulations criticized are those of the Telecommunications Act (TKG). These stipulate that traffic and location data must be stored by providers for ten and four weeks respectively. This practice makes it possible to draw very precise conclusions about the private lives of the individuals concerned. In this way, entire personal profiles can be created. The ECJ sees this as a violation of EU law.

ECJ: No general and indiscriminate data retention

In its judgment of 20.09.2020, the ECJ ruled (Cases C-793/19, C-794/19 et al.) that the German version of data retention is contrary to Union law. In particular, Union law precludes the general and indiscriminate retention of traffic and location data. However, if there is a serious threat to national security, it is possible. In view of the previous case law, such a ruling was foreseeable.

Nevertheless, the ECJ grants the national legislator a certain amount of leeway within the fundamental prohibition of data retention without any reason.

Exceptions for general and random storage

According to this, general and unprovoked retention of data is to be possible when it is a matter of protecting national security. In this case, traffic and location data may be stored. Whether a serious threat exists can then be checked by a court or an independent administrative body. In addition, such a measure is only permissible for a period limited to what is absolutely necessary.

General and indiscriminate data retention of the identity of users of electronic communications may also be possible. To this end, the purpose must be the protection of national security, the fight against crime and the protection of public safety.

Exception for targeted storage

Targeted retention of traffic and location data is again possible when it is a matter of protecting national security, combating serious crime or preventing serious threats to public security. However, this retention must then be carried out on the basis of limiting criteria related to data subjects or by means of geographical criteria.

For the same purposes, general and indiscriminate retention of IP addresses associated with the source of a connection may also be performed.

Exception for storage obligation

In addition, it is possible to impose a storage obligation on providers of electronic communications services for a certain period of time. However, this must then serve to combat serious crime and protect national security. Here, too, traffic and location data may then be collected.

Voices from politics

Voices from the political arena have already spoken out about the ruling and the situation that has arisen.

The FDP is still keen to abolish data retention completely. FDP Federal Minister of Justice Buschmann has already announced that data retention without any specific data protection requirements will now be "swiftly and definitively removed from the law.

The Green parliamentary group also sees the ruling as a blow to the proponents of data retention. A regulation that conforms to the constitution has been needed for a long time.

On the other hand, SPD Minister of the Interior Faeser sees the issue of data retention as primarily affecting the concerns of the security authorities. These are precisely the ones who want data retention.

How much more data retention is possible?

Even if the ECJ's ruling is superficially against German data retention, the exceptions make it clear that there is still a lot that can be done. The exceptions set out by the ECJ are so wide-ranging that a ban on data retention without any reason can already be called into question.

As is clear from the voices from the political arena so far, a compromise between the Federal Ministry of the Interior and the Federal Ministry of Justice, which is in charge, will be reached regarding the options for data retention in Germany. This compromise could include more data retention than the ruling initially suggests.

Are you also wondering what and how much you are allowed to store? You can rely on our team of experts when it comes to data protection issues! To the first contact here.