CJEU on data retention: exceptions to be defined

With the most recent judgment, the ECJ confirmed its previous assessment of data retention. The German legislator must now address exceptions: Which places are considered dangerous? When do investigators get access to IP addresses?

It is not surprising: The ECJ, the highest EU court, also says in this judgment that the storage of all telephone and Internet data without any reason violates the European Charter of Fundamental Rights. The traffic and location data could contain a great deal of information about the individual – their sexual orientation, political opinions, religious beliefs, habits of daily life. For this reason, data retention is also illegal in Germany.

The judges of the large chamber admit: Yes, unlike other countries in Europe, Germany has set much shorter deadlines. Nevertheless, a lot can be learned about the individual even with a short storage. The law is therefore not permissible and incompatible with European law.

For law professor Matthias Bäcker, who represents the complaining Internet provider SpaceNet, it is a very good judgment because it is made clear again that a lot can be done with the data. “The ECJ recognized this in its earlier case law and has now confirmed it again. I think that’s positive, because the court shows that it has understood how important this interference is.”

ECJ confirms exceptions

However, the ECJ does not completely condemn data retention. As in previous judgments, it allows exceptions to data storage in other countries. If national security is endangered, then it may well be stored on a large scale.

In addition, targeted storage is allowed, for example for people who have previously noticed the security authorities. Or in certain places, such as train stations or airports – these are places where there is an increased risk of serious crimes.

And another very important exception: The IP addresses of the computers may also be saved in principle. The court allows this, for example, to combat depictions of abuse by children on the Internet, because sometimes perpetrators can only be found with the IP address.

“Quick freeze” is allowed

Otherwise, only the so-called quick freeze is permissible – that is, that immediately after a serious crime, for example, all data is frozen and the investigators can work with it. Incidentally – and this also applies in principle – it must of course be clear who is using a mobile phone. So when buying a SIM card, it may be required that the buyer identify themselves. And this information should also be archived.

For the plaintiffs, the exceptions that can be saved are okay, says Bäcker: “I think that one can live with the exceptions provided by the ECJ if it is guaranteed that they are really taken seriously will.”

This means that the ball is now back in the hands of the German legislature. Which places are considered dangerous, for example, or when exactly do investigators get access to IP addresses? The exact criteria must now be defined in Germany.