The suspicion-independent storage of user data in the telecommunications sector is illegal. The European Court of Justice (ECJ) sees an incompatibility with applicable EU law. This tightened the requirements for storing communication data.
On Tuesday, the ECJ announced that general storage of traffic and location data without cause is incompatible with Union law. The judgment not only has a signal effect for future regulations at EU level, but also affects German legislation. Thus, the German regulations in the Telecommunications Act (TKG) are affected. The obligation for network operators to store location and connection data when making phone calls and writing SMS, as well as the storage of IP addresses and connection data when using the Internet, is therefore no longer applicable.
Storage obligation suspended since 2017
The storage obligation for telephone providers and Internet providers has not yet been enforced by the Federal Network Agency due to ongoing legal proceedings. Deutsche Telekom and SpaceNet have been suing the TKG since 2017. The legal dispute went through numerous instances of German courts to overturn data retention after all. Finally, the Federal Administrative Court asked whether the TKG is compatible with EU law and referred the case to European courts. As it turns out, rightly so.
Preventive storage illegal
In its judgment on the TKG, the ECJ stated that preventive storage of user data is not permitted. This also does not conflict with the fact that the German regulations would serve to prevent serious criminal offenses. The general and indiscriminate data retention of traffic and location data from all citizens is to be seen as a very serious encroachment on fundamental rights. In short, it is to be seen as a kind of general suspicion, especially for innocent citizens. The ECJ further explained that the storage of connection data allows very precise conclusions to be drawn about the private life of people. This makes it even easier to create what is known as a movement profile. Habits of daily life, whereabouts and one’s own rhythm of life become recognizable. In addition, precise activities, social relationships and conclusions about the social environment of a person are possible.
Preventive storage in the event of a national threat
According to the ECJ, the storage of user data from telecommunications services without cause is only possible within narrow limits. This is the case when there is a serious threat to national security. What is important, however, is an independent control body and the time limit for the measure. This task can be performed by a court or an administrative body in order to prevent any extension.
Another case is the targeted retention of data. The focus on certain persons is permissible if the measure serves to combat serious criminal offenses and prevents threats to public security for a limited period of time.
IP Address Retention
It is also interesting what the ECJ says about the storage of IP addresses and user identities. These should be stored generally and indiscriminately for a limited period of time when fighting crime and protecting public security. To do this, the IP addresses must be assigned as the source of a connection. The determination of user identities of electronic devices is therefore also possible.
You might also be interested in: Did you know what the tax office knows about you?
The federal government must react now
Because the TKG is now illegal, the federal government must now find a legally compliant way of dealing with data retention. The ECJ has been dealing with the issue since 2014 and legislative proposals have repeatedly turned out to be unlawful. So far, corresponding laws have always overshot the mark. The disproportionate restriction of fundamental rights and the risk of misuse of the data have so far been ignored. A regulation that is compatible with both the Basic Law and EU law would therefore be desirable. The FDP is now in favor of a quick freeze procedure. In such a procedure, data can only be stored or frozen if there is a concrete suspicion of a criminal act against a citizen. However, the precise form is disputed. At least the ECJ judgment can now serve as a guide, because there are only a few exceptions for storage without cause and it is limited in time.
source
- ECJaccessed 09/21/22