Patrick Breyer on data retention rulings: We need targeted investigations, not total capture of all communications and movements!

Patrick Breyer, civil liberties activist and Member of the European Parliament for the Pirate Party, explains today’s ECJ rulings on data retention:

“Under the massive pressure of governments and authorities, the judges partly abandoned our protection against the indiscriminate and general collection of information on everybody‘s communications and movements: The permitted blanket retention of IP data makes it possible to retrace normal citizens‘ Internet use. Criminals can circumvent this easily by using anonymization services, but it makes ordinary Internet users practically transparent. Simlarly, the retention of everybody‘s personal contacts and movements which the Court authorised in certain circumstances has no measurable effect on the investigation of serious crimes according to a recent study. Instead it prevents lawyers and other councillors from offering anonymous advice and threatens the free press which often needs information from anonymous whistleblowers to uncover corruption and wrongdoing.”

Breyer appeals to the EU Commission: “Today’s judgements describe only the outermost limits of what is legally possible and should not be taken as an instruction manual. I warn the EU Commission not to ignore the lack of effectiveness and the harmful effects of blanket data retention on society by making a new proposal to place 450 million EU citizens under general suspicion! Instead we need to focus on preserving digital traces of suspects quickly and across borders (quick freeze).”

Breyer explains the Court‘s idea of IP data retention as follows: “In connection with other information from content providers such as Google, Twitter or Youtube, retained IP addresses would make it possible to retrace our every click, download or post on the Internet, thus the contents of our daily Internet usage.” In Germany, neither the investigation of a serious crime nor a judicial order are a prerequisite for tracing Internet users. “This would be the end of anonymous information and communications via the Internet for non-savvy citizens. An IP data retention disrupts the legitimate anonymity that is required in emergency situations (e.g. victims and potential perpetrators of violent or sexual offences seeking councelling) or to safely report abuses of power (press informants, anonymous criminal charges)”. Breyer points out that the crime clearance rate for Internet crimes in Germany, for example, is above average without IP data retention and even decreased after the first German law on data retention came into force – presumably due to an increased use of anonymization services. “To protect yourself from the constant risk of false suspicion, improper disclosure or accidental loss of sensitive data, I recommend to all Internet users to use a trustworthy anonymization service.”

Study proves that crimes can be investigated without data retention

Yesterday, MEP Breyer published a study by the European Parliament‘s Research Service according to which blanket, indiscriminate telecommunications data retention has no statistically significant impact on crime or crime clearance. The Study concludes that “it does not appear possible to establish any direct correlation between the crime clearence rate and the existence of data retention laws.”

Background of the court decisions

In 2006, the EU enacted a directive making it mandatory to collect information on who contacted whom via telephone, mobile phone or e-mail for a period of 6 to 24 months. In the case of mobile calls or text messages via mobile phones, the user’s location was also to be logged for the police to access. In 2014, the ECJ annulled this directive for violating fundamental rights. In 2016, the ECJ also invalidated national data retention laws of Great Britain and Sweden.

The jurisprudence of the European Court of Justice was not accepted by many EU countries. Numerous governments refused to abolish their national laws on data retention. However, the EU Commission saw no reason to initiate infringement proceedings.

As a result, three national courts again referred the matter to the ECJ. The English Investigatory Powers Tribunal, the French Conseil d’Etat and the Belgian Constitutional Court asked questions on the admissibility of the national laws. The proceedings were initiated by the data protection and civil rights organizations “Privacy International” and “La Quadrature du Net”. In Germany, too, the data retention legislation is being contested in court, among others by Breyer and privacy NGO Digitalcourage.