EU court rules against Germany's blanket data retention law

The European Court of Justice (ECJ) has ruled that data retention in Germany is not compatible with EU law, stating that internet and phone service providers should not store citizens' communications data without cause.

The case was triggered after Deutsche Telekom unit Telekom Deutschland and internet service provider SpaceNet AG challenged Germany’s data retention law, arguing it breached EU rules. The German court subsequently sought the advice of the EU court, which said that indiscriminate data retention should only be applied in exceptional circumstances. 

“The Court of Justice confirms that EU law precludes the general and indiscriminate retention of traffic and location data, except in the case of a serious threat to national security,” the judges said.

“However, in order to combat serious crime, the member states may, in strict compliance with the principle of proportionality, provide for, inter alia, the targeted or expedited retention of such data and the general and indiscriminate retention of IP addresses.” 

In the past, governments have argued that access to data, especially that collected by telecom operators, is vital for security operations, and could help prevent terrorist attacks similar to those that have occurred in France, Belgium and Britain in recent years. However, operators and civil rights activists oppose such access to users' personal information. 

But not all politicians oppose the ruling. German Justice Minister Marco Buschmann hailed the decision, celebrating Tuesday as "a good day for civil rights". Instead of the blanket law, Buschmann favours what's being called a "quick-freeze" solution where data should be stored when there is a specific reason to do so and on the basis of a court order. 

"Germany's data retention without cause is illegal," he tweeted."We will now swiftly and finally remove unjustified data retention from the law."

Germany's Telecommunications Act required service providers to store their customers' telephone and internet data for four or ten weeks and to make it available, if necessary, to law enforcement authorities. According to eco – Association of the Internet Industry, which backs SpaceNet, Germany’s data requirement costs the industry millions of euros.

In addition to the German case, on Tuesday the ECJ also ruled that a French law on mass data retention violates EU law, after two individuals challenged the French Financial Markets Authority's request to forward personal data from telephone calls made between them. 

The ECJ's ruling said financial market regulators cannot use EU laws against insider dealing and market manipulation to force telecom providers to hand over the personal data of traders suspected of these violations.

“The general and indiscriminate retention of traffic data by operators providing electronic communications services for a year from the date on which they were recorded is not authorised, as a preventive measure, for the purpose of combating market abuse offences including insider dealing,” the court said.

EU member states have repeatedly argued at the ECJ that investigators need access to communications data. However, in 2020, the Luxembourg-based court ruled that storing data about citizens' communications, even if not the actual content itself, is generally illegal in the bloc.

Although the UK is currently under the EU's data protection legislation, in 2022, the government revealed its plans to introduce a new Data Reform Bill, which will differ from the European Union’s General Data Protection Regulation (GDPR) and Data Protection Act, described by the Government as “highly complex.” 

The UK’s new data bill is expected to increase fines for nuisance calls and texts, allow for a digital births and deaths registry in England and Wales, and facilitate the flow and use of personal data for law enforcement and national security purposes, among other changes.