• Home /
• News /
• 2019 /
• April /
• EU: Council wants a "comprehensive study" on data retention that considers "a future legislative initiative"

EU: Council wants a "comprehensive study" on data retention that considers "a future legislative initiative"

10 April 2019

Statewatch News
EU  
Council wants a "comprehensive study" on data retention that considers "a future legislative initiative"
10.4.19
Follow us: | | Tweet

---

The Council of the EU is set to ask the European Commission to "prepare a comprehensive study" on the legal possibilities for retention of telecommunications data for law enforcement purposes, to be ready by the end of 2019. That study should include "the consideration of a future legislative initiative," according to a set of draft conclusions due to be discussed in a Council working party tomorrow.

See: NOTE from: Presidency to: Council: Council Conclusions on improving retention of data for the purpose of fighting crime effectively (7833/19, LIMITE, 27 March 2019, pdf)

The draft conclusions, which will be discussed by the Council's Working Party on Information Exchange and Data Protection (DAPIX), state: "Data retention constitutes an essential tool for law enforcement, judicial and other competent authorities to effectively investigate serious crime, including terrorism," and affirms that such schemes "should be guided by the protection of fundamental rights and freedoms and the principles of purpose limitation, necessity and proportionality."

In March 2016, the Commission reaffirmed its unwillingness to propose new legislation on EU-wide data retention, having said in September 2015 that "data retention is often the subject of a very sensitive, ideological debate and that sometimes there can be a temptation to draw the European Commission into these debates. The European Commission is not ready to play this game." [http://database.statewatch.org/article.asp?aid=36221]

The issue has caused a headache for officials since a 2014 ruling by the Court of Justice of the EU (CJEU), which struck down the 2006 Data Retention Directive on the grounds that it involved "an interference with the fundamental rights of practically the entire European population" that could not be justified given its broad scope and lack of safeguards. http://database.statewatch.org/article.asp?aid=33414]

Long-term discussions have followed, with the EU institutions - particularly the Council - attempting to work out how exactly a mandatory data retention scheme could be implemented in line with the requirements of the judgment.

The draft conclusions call for the Council's "reflection process" on data retention, which has been ongoing since March 2017, to continue, but other requests in the text suggest the Member States finally hope to make some progress with the reintroduction of EU-level measures.

The document calls on the Commission to "evaluate the needs of the competent authorities to have available data that are strictly necessary", to hold "targeted consultations with relevant stakeholders" and to then prepare a "comprehensive study, taking into account those consultations, on possible solutions for retaining data, including the consideration of a future legislative initiative."

The Council appears to hope that the study will be able to provide more clarity over concepts discussed in recent years as potential ways to ensure that mandatory data retention schemes can be made compliant with the requirements set down by the CJEU.

Following on from the 2014 judgment on the Data Retention Directive, the CJEU made clear in the 2015 judgment Watson/Tele2 that the EU's Charter of Fundamental Rights prohibits a "general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication." [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62015CJ0203]

To try to get around this prohibition, the Council and Europol began to explore ideas such as "restricted data retention" and "targeted data retention", the details of which are available in documents published by Statewatch last year. [http://www.statewatch.org/news/2018/feb/eu-drd-reflection-docs.htm]

The Commission should also "explore to what extent the cumulative effect of strong safeguards and possible limitations... could assist in mitigating the overall impact of retaining those data to protect the fundamental rights of the Charter, while ensuring the effectiveness of the investigations," say the draft conclusions.

The documents notes a number of upcoming cases in the CJEU on data retention that have been referred from Belgium, France and Estonia, underlining that national and EU case law "must be followed closely".

The next Justice and Home Affairs Council will not take place until June, although it would be possible for the conclusions to be adopted by the Council sitting in another formation.

The 2006 Data Retention Directive required telecoms companies in the EU to retain, for between six months and two years, certain types of metadata about their customers' communications - such as numbers called by an individual, the duration of those calls and websites visited - in case those data might later be sought by law enforcement authorities investigating "serious crime", a term which was undefined in the text.

In 2014, the CJEU struck down the Directive, ruling that it entailed "a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary."

Although the ruling has not led to the abolition of data retention schemes across the EU - there remain other potential legal bases in EU law, and states may also resort to national legal measures - there is currently no uniform legal requirement across the EU that would 'standardise' the retention of telecoms data for law enforcement purposes.

Background and further reading

Data retention: Commission still refusing demands for new mass surveillance measures (March 2016)

Lack of EU data retention law "a matter of concern" for Member States (November 2015)

Revision of Data Retention Directive put on hold with "no precise timetable" for a new proposal (August 2012)

Search our database for more articles and information or subscribe to our mailing list for regular updates from Statewatch News Online.