The end for data retention?

The European Court of Justice (ECJ) ruled on Tuesday that the German version of data retention is not compatible with EU law. Now the framework for a new regulation in Germany must be set. Will there still be data retention in Germany then?

Find out here what the ECJ and politicians are currently saying about this.

Previous regulation in Germany

The German regulations criticized are those of the Telecommunications Act (TKG). These stipulate that traffic and location data must be stored by providers for ten and four weeks respectively. This practice makes it possible to draw very precise conclusions about the private lives of the individuals concerned. In this way, entire personal profiles can be created. The ECJ sees this as a violation of EU law.

ECJ: No general and indiscriminate data retention

In its judgment of 20.09.2020, the ECJ ruled (Cases C-793/19, C-794/19 et al.) that the German version of data retention is contrary to Union law. In particular, Union law precludes the general and indiscriminate retention of traffic and location data. However, if there is a serious threat to national security, it is possible. In view of the previous case law, such a ruling was foreseeable.

Nevertheless, the ECJ grants the national legislator a certain amount of leeway within the fundamental prohibition of data retention without any reason.

Exceptions for general and random storage

According to this, general and unprovoked retention of data is to be possible when it is a matter of protecting national security. In this case, traffic and location data may be stored. Whether a serious threat exists can then be checked by a court or an independent administrative body. In addition, such a measure is only permissible for a period limited to what is absolutely necessary.

General and indiscriminate data retention of the identity of users of electronic communications may also be possible. To this end, the purpose must be the protection of national security, the fight against crime and the protection of public safety.

Exception for targeted storage

Targeted retention of traffic and location data is in turn possible if it is necessary to protect national security, combat serious crime or the prevention of serious threats to public security. However, this storage must then be carried out on the basis of limiting criteria relating to data subjects or by means of geographical criteria.

For the same purposes, general and indiscriminate retention of IP addresses associated with the source of a connection may also be performed.

Exception for storage obligation

It is also possible to impose a storage obligation on providers of electronic communications services for a certain period of time. However, this must then be subject to serious crime and serve to protect national security. Traffic and location data may also be collected here.

Voices from politics

Voices from the political arena have already spoken out about the ruling and the situation that has arisen.

The FDP is still keen to abolish data retention completely. FDP Federal Minister of Justice Buschmann has already announced that data retention without any specific data protection requirements will now be "swiftly and definitively removed from the law.

The Green parliamentary group also sees the ruling as a blow to the proponents of data retention. A regulation that conforms to the constitution has been needed for a long time.

On the other hand, SPD Interior Minister Faeser sees the topic of Data retention primarily a concern of the security authorities touched. They would like to see data retention.

How much more data retention is possible?

Even if the ECJ's ruling is superficially against German data retention, the exceptions make it clear that there is still a lot that can be done. The exceptions set out by the ECJ are so wide-ranging that a ban on data retention without any reason can already be called into question.

As is clear from the voices from the political arena so far, a compromise between the Federal Ministry of the Interior and the Federal Ministry of Justice, which is in charge, will be reached regarding the options for data retention in Germany. This compromise could include more data retention than the ruling initially suggests.

Are you also wondering what and how much you are allowed to store? You can rely on our team of experts when it comes to data protection issues! To the first contact here.