In essence, it’s just another ruling in the seemingly endless line of judicial decisions on data retention. But this time, it is a case from Ireland, the European Court of Justice (ECJ) has given an answer that should also be decisive for the German rules on retained data: An “unreasonable” storage obligation for such data violates EU law. The Court is therefore sticking to its strict case law of the past eight years.
The pressure from the EU states on the ECJ had increased dramatically in recent years. In oral hearings, but also behind the scenes, they tried to dissuade the ECJ from its data protection-friendly line, arguing that traffic and location data from telecommunications are indispensable for the fight against crime.
At least the court has taken a step towards the critics. “Targeted” storage, for example at crime hotspots or at airports and train stations, can certainly be permissible. Because the principle of European law, which the ECJ insists on, does not prohibit any form of data collection, but only the “general and indiscriminate” storage of telecommunications data.
The Irish trial involved the investigation of a gruesome murder
An obligation to collect and stockpile such data – just in case the police might need it at some point – is forbidden for states because it deeply invades people’s privacy; Such detailed information makes real personality and movement profiles possible. The ban on storage obligations even applies if the authorities are to be allowed access to the data solely to combat serious crime. The Irish trial involved the investigation of a gruesome murder. Telephone data had also played a role in the process.
During the oral hearing, several member states, as well as the EU Commission, vehemently called for an expansion of the storage options. Because a year and a half ago, the ECJ allowed limited storage requirements to protect “national security”, for example in connection with serious terrorist attacks. The critics wanted to see this principle extended to the fight against serious crime, but the ECJ stuck to its no. The risk of crime – ultimately a permanent condition – cannot be equated with a selective attack on a state’s central structures, for example by terrorists.
The area-wide collection remains a taboo under European law. Behind this very principled attitude is also the realization that the risks for citizens arising from large amounts of data have increased with technical progress, for example through analysis tools using artificial intelligence.
Not surprisingly, this should spell the end for German data retention. In 2019, the Federal Administrative Court appealed to the ECJ, which dealt with the procedure parallel to the Irish case; a decision should be forthcoming in the next few weeks. The German regulations that have been suspended since 2017 were comparatively moderate with their very short storage periods – four weeks for location data and ten weeks for connection data. But because they now allow storage without any reason, they contradict the ECJ case law. The traffic light coalition has already announced an adjustment to the ECJ line in the coalition agreement.
The Federal Minister of Justice is committed to “quick freeze”
However, the judgment of the highest EU court also shows that the criticism of its rigid line has not gone unnoticed by the judges. The 42-page decision contains a good deal of pragmatism. For example, the ECJ allows data to be stored according to “geographical” criteria. These can be well-known crime hotspots, but also endangered infrastructures – airports, seaports, train stations, toll booths. This would then mainly affect the mobile data.
In addition, the court facilitates the use of a method that the then Federal Justice Minister Sabine Leutheusser-Schnarrenberger (FDP) wanted to introduce eleven years ago: “quick freeze”. Telecommunications data can be shock-frozen at an early stage as soon as there is a specific reason, such as a murder or a serious threat to public safety. The incumbent Federal Justice Minister Marco Buschmann (FDP) has also campaigned for “quick freeze”.
Two years ago, the ECJ had also given the investigators an important tool for combating child pornography. An exception to the ban on collection applies to IP addresses; telecommunications operators may be made to store them without a specific reason. And finally, the court has another piece of advice ready: Of course, the states could also make the purchase of prepaid cards dependent on real identity verification.
Whether the endless story of data retention has been told remains to be seen. Several complaints are also pending at the Federal Constitutional Court. And for the ECJ, the motto “After the game is before the game” applies to data protection anyway. He is currently advising on a procedure for storing passenger data.