EU slow to move on data retention
01 November 2002
Following the fundamental changes to the 1997 EC Directive on privacy in the telecommunications sector formally adopted on 12 July 2002 the door was open for new measures to require data to be retained at national and EU levels (see Statewatch, vol 12 no 3/4).
Two key privacy protections were removed. The first of which said that data could only be held for the purposes of billing (ie: for the customer to check the details), usually only for a few weeks. The second allows member states to adopt national laws to require communications providers to retain data for a specified period so that law enforcement agencies can get access to it.
"Under the table", out of public view, was a binding Framework Decision drafted by the Belgian government which would have made data retention mandatory in all EU states (and all applicant states) and rules for the exchanges of data between states/agencies (see Statewatch, vol 12 no 3/4 for details). Statewatch was leaked a copy of the draft Framework Decision and when it was published, with much critical commentary, the Danish Presidency of the Council of the European Union claimed to know nothing about it. However, a set of non-binding draft Conclusions, prepared by the Danish EU Presidency, said:
within the very near future, binding rules should be established on the approximation of Member States' rules on the obligation of telecommunications service providers to keep information concerning telecommunications in order to ensure that such information is available when it is of significance for criminal investigations (Conclusion 9, doc no 10358/02, 24.6.02, emphasis added).
Five further drafts were produced prior to the adoption of the Conclusions at the Justice and Home Affairs Council on 19 December 2002. The first, on 3 October, said that “two delegations” were not in favour of the draft document and five had scrutiny reservations - this was to rise to nine by the time of the next draft on 23 October. The disagreement centred on the issue of data retention in Conclusion 7 (the renumbered no 9 in the adopted text).
The 3 October version said "binding rules should be established on.. retain[ing] traffic data". By 23 October the word "binding" had disappeared, and now a "dialogue" leading to "rules.. should be established and implemented". The draft of 22 November 2002 was firmer, saying that there should be: "as a matter of priority, the necessity of establishing and implementing binding rules.. to retain specific traffic data". But the version of 28 November (which became the final version) said that:
before adopting rules.. to retain specific traffic data.. a dialogue between interested parties should take place.. [and that] If it is found necessary to establish such rules, they should at any rate ensure that such traffic data is available
So, on the face of it mandatory data retention across the EU would appear to be on hold for the moment. Indeed, no other EU government wants to pick up and formally put forward the Belgian government's draft binding Framework Decision - it thus remains "under the table".
This lack of decisive action is all the more surprising as Conclusion 4 of the specially-called meeting of the Justice and Home Affairs Council on 20 September 2001 (and the Bush letter of 16 October 2001) called for measures to be brought forward urgently.
The true picture is more complex. First, the law enforcement agencies already have the power in every EU state to place under surveillance named, specific individuals or organisations (the procedure varies from state to state but has been in place for years). Investigations into suspected terrorists are thus ongoing and unhindered. Second, a majority of EU member states have, or are in the process of, adopting national laws on mandatory data retention (see below). Third, the costs imposed on communications providers is unresolved. Fourth, in some countries there is, in addition to privacy considerations, a perceived