Data retention overturned? Aftermath to the private sector?

The European Court of Justice has brought its settled case-law on data retention in line with the judgments of 08.04.2014 (C-293/12), 21.12.2016 (C-203/15 & C-698/15), 06.10.2020 (C-623/17, C-511/18, C-512/18 & C-520/18) and of 02.03.2021 (C-746/18).

In its ruling of April 5, 2022 - C-140/20 - the ECJ reaffirmed and once again made it unequivocally clear, that national laws, which provide for general and indiscriminate data retention of traffic and location data as a preventive measure to combat serious criminal offenses, violate Union law and are therefore impermissible.

Evidence from stored data

Backstory of this ruling was the conviction of an Irishman to life imprisonment for the murder of a woman, in which precisely such traffic and location data in connection with telephone calls were admitted as evidence by the court of first instance and convicted the defendant of the crime. The convicted man successfully defended himself against this before the High Court, whereas Ireland appealed against this decision to the Supreme Court. In its reference for a preliminary ruling, the Supreme Court primarily asked the ECJ for clarification regarding the requirements of European Union law in the area of the storage of the aforementioned data for the purpose of combating serious criminal offenses.

Data retention as an interference of fundamental rights

In its reasoning, the ECJ stated (again) that the ePrivacy Directive (Directive 2002/58/EC) regulates in particular the principle of prohibiting the retention of traffic and location data. According to the ECJ, any storage of such data thus constitutes, on the one hand, an exception to this prohibition and, on the other hand, an interference with the fundamental rights to respect for private life and to the protection of personal data.

Restrictions on these fundamental rights by the member states are permitted, but they must be measured against the principle of proportionality, in other words they must be suitable, necessary and, in particular, appropriate (proportionate in the narrower sense) with regard to the objective pursued.

Data retention is not necessary for the purpose of combating serious crime, if it is carried out generally and indiscriminately. Such a serious interference cannot be justified, if the data of the data subjects have at least no indirect connection with the objective pursued.

The ECJ recognizes such a connection - and also presents the blueprints for it - if data retention serves the purpose of combating serious crime and preventing serious threats to public security, and if the retention of traffic and location data is carried out specifically on the basis of categories of data subjects or by means of geographical criteria, for example at strategic locations such as airports, train stations or toll booths.

Similarly, general and indiscriminate data retention is permissible with regard to IP addresses, provided that this is limited to the absolutely necessary in terms of time, and with regard to identity data of users of electronic means of communication, as it is already the case when SIM cards are purchased.

Data retention light with reservations - "quick freeze"

Furthermore, the ECJ considers the "quick freeze" procedure, i.e., the immediate preservation of traffic and location data available to providers of electronic communications services, as fundamentally unobjectionable. Law enforcement authorities should be able to temporarily halt any deletion processes at the providers. Relevant data would be symbolically frozen and could be "unfrozen" by a court order and then legally exploited. At any rate, in the opinion of the ECJ, such a model represents a compromise between the effective interests of law enforcement on the one hand and the right to informational self-determination, in particular the data protection rights of those affected, on the other. Such "data retention light" is not new and was already presented as draft law by the German Ministry of Justice in 2011.

Conclusion

Due to the (renewed) signal effect of this ECJ ruling, it is more than likely, that the 2011 draft law will experience a renaissance and that the "quick freeze" model will once again generate discussion in the German parliament (Bundestag). Such a legal instrument will also cause discussion in the private sector at the latest when personal data to a deletion period is frozen and unfrozen again for subsequent investigative proceedings. It remains to be seen whether such a national regulation will find its way into the Bundestag and whether it is at all compatible with the GDPR.

Article provided by INPLP member: Jens Eckhardt (Derra, Meyer & Partner, Germany)

Co-author: Juri Knaub

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)