Data retention ruling: Let’s free Europe from mass surveillance and general suspicion!
In a ruling delivered today, the EU Court of Justice dismissed German legislation on general and indiscriminate retention of call data records and mobile phone location data of the entire population. It warns that bulk retention may reveal “habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them”. However, the Court did not object to the bulk retention of Internet traffic data (IP addresses), which can be used to trace online activity. The so-called quick freeze procedure has also been permitted for the prosecution of serious crimes.
Member of the European Parliament Patrick Breyer (Pirate Party) calls on the EU Commission to enforce the ruling throughout Europe:
„Today’s ruling confirms that national bulk data retention legislation in most EU Member States is illegal, including attempts to justify it with a ‘permanent state of emergency’ in France and Denmark, or with regional crime rates in Belgium. The bulk collection of information on the everyday communications and movements of millions of unsuspected people constitutes an unprecedented attack on our right to privacy and is the most invasive method of mass surveillance directed against the state’s own citizens. Mass surveillance is the opposite of what European values embody. The Commission now finally needs to end impunity and start enforcing our right to privacy throughout Europe!
The anecdotal results of data retention policies are nowhere close to the damage the chilling effect of this surveillance weapon inflicts on our societies, as a recent survey found. Data retention laws have no measurable effect on the crime rate or the crime clearance rate in any EU country. Requests for communications data are rarely unsuccessful even in the absence of indiscriminate data retention legislation. The clearance rate for cybercrime in Germany, for example, is at 58.6% and above average even without IP data retention. It fell when data retention legislation was enacted in 2009.
In the EU I observe a dangerous cycle in which national governments use all sorts of tricks to keep illegal mass surveillance going. In doing so, they disrespect rulings of the highest courts. The rule of law in the EU and the fundamental rights of citizens suffer from the surveillance greed of governments and law enforcement agencies. The EU Commission is standing idly by. The persistent violation of fundamental rights, circumvention of case-law, pressuring of judges and ignorance of facts is an attack on the rule of law we need to stop. The EU Commission now finally needs to do its job and start enforcing the landmark rulings, instead of plotting to bring back data retention.”
According to leaked documents[5] however the EU Commission behind closed doors is proposing to EU governments several ways of de facto re-establishing bulk retention in a way that, on paper, appears to respect the Courts’ requirements. The Commission also proposes to expand national identification and bulk retention requirements to Internet messaging, conferencing and e-mail services. Breyer warns:
“Today’s judgement describes only the outermost limits of what is legally possible and should not be taken as an instruction manual. I warn the EU Commission not to ignore the lack of effectiveness and the harmful effects of blanket data retention on society by making a new proposal to place 450 million EU citizens under general suspicion! Instead we need to focus on preserving digital traces of suspects quickly and across borders (quick freeze).
Unfortunately, the greatest consensus among governments currently seems to exist on mandating indiscriminate IP data retention throughout Europe, which the judges in Luxembourg green-lighted under massive pressure. Under no circumstances should all internet users be placed under general suspicion and online anonymity be abolished! IP addresses are our digital fingerprints on the internet. Bulk collection would endanger crime prevention in the form of anonymous counselling and pastoral care, victim support through anonymous self-help forums and also the free press, which depends on anonymous informants. Incidentally, there is no evidence that IP data retention significantly increases the crime clearance rate. In the absence of data retention Germany today has a higher cybercrime clearance rate than with IP data retention in place. In EU countries with indiscriminate IP retention policies in place, the crime clearance rate is no higher. The right and overdue way to effectively counter child sexual abuse is to strengthen prevention measures and projects, as well as anonymous counselling and therapy services. It is also completely unacceptable that the police refuses to report known abuse material for removal.“
A parliamentary question had recently revealed that Germany fails to trace only 3% of NCMEC reports of alleged child pornography without general IP data retention. Previously, the German Working Group on Data Retention had stressed that IP retention was “completely unsuitable for protecting children”. In 2020 Germany was able to prosecute 91.3% of all child pornography cases – without mandatory IP data retention being in force.
Breyer’s comments on the options considered by the Commission for resurrecting data retention: https://www.patrick-breyer.de/en/breyer-stop-the-return-of-indiscriminate-and-general-communications-data-retention/
Former ECJ judge finding several of the Commission’s proposals in violation of the case-law: https://www.patrick-breyer.de/en/comeback-of-data-retention-former-eu-judge-dismisses-commissions-plans/
The German coalition agreement provides for communications data to be retained only on an ad hoc basis and with a court order. Draft legislation in Germany to reform data retention legislation is expected soon.
An opinion poll published in 2022 found that only 39% of all respondents in the EU support applying data retention to non-suspects, while 42% oppose it. More than a third of the respondents (34%) would refrain from seeking counselling from a marriage counsellor, a psychotherapist or a rehab clinic by phone, mobile phone or email if they knew that their contact was being recorded. (Germany: 45% Austria: 42%, France: 38%, Belgium: 35%, The Netherlands: 34%, Sweden: 33%, Czech Republic: 26% and Spain: 13%)
