EU Commission pushes ahead with new EU-wide data retention

The EU Commission has launched a public consultation on a new version of EU-wide data retention. It assumes that such an initiative is urgently needed in principle. According to the Brussels government institution, only the form of implementation is still open. Interested parties have until June 18 to submit their comments.

The reason given is: "In order to effectively combat and prosecute criminal offenses", police and judicial authorities may need access to certain connection and location data from providers of electronic communication services. If providers are not explicitly obliged to retain such user traces for a reasonable and limited period of time, they could be lost to law enforcement.

"There is currently no EU-wide legal framework in this area," writes the Commission in an impact assessment published at the same time. What it fails to mention: The European Court of Justice (ECJ) declared an earlier EU directive on data retention null and void years ago and has only partially relaxed its relevant case law over time – with regard to IP addresses, for example . The Luxembourg judges repeatedly emphasize that such an investigative instrument relevant to fundamental rights must be limited to what is absolutely necessary.

Patchwork in the EU

According to the Commission, most Member States have relevant national legislation, but this is not uniform. The lack of harmonization is cited by the police, public prosecutors and judicial authorities "as a significant challenge for national criminal proceedings" for online and offline offences and hinders cross-border cooperation in the EU.

The controversial High Level Group on Access to Data has recommended the adoption of an EU framework for the warrantless logging of user traces, the executive body emphasizes. Both Commission President Ursula von der Leyen (CDU) and EU countries have repeatedly emphasized the need to ensure lawful and effective access to metadata for law enforcement purposes. In its European Internal Security Strategy, the Commission has also committed itself to presenting a roadmap for further action in this area this year.

Guidelines or legislative proposal?

"In a digital society, electronic evidence is crucial for most criminal investigations and prosecutions," the exploratory paper states. Subscriber information, transmission and reception data of a message, location of the device, date, time, duration, size or other types of interaction that do not reveal the content of the communication could be important for identifying or locating suspects and victims of crime. It could also be important for solving crimes in general.

The main objective of its initiative is to ensure the availability of certain categories of metadata for law enforcement, the Commission explains. In doing so, "EU standards for the protection of fundamental rights, cybersecurity, and the integrity of the EU market must be respected and upheld". This could include "non-binding measures to improve cooperation between authorities" and service providers, such as common standards or guidelines on "minimum retention periods for subscriber data and time-stamped IP addresses". The government institution does not rule out further legislative steps to establish binding requirements for all providers of electronic communication services.

(nie)