eco – Association of the Internet Industry Criticises New Version of Data Retention Law: “Disproportionate, Contrary to European Law and Outdated”

Klaus Landefeld, Member of the Board of eco - Association of the Internet Industry, comments on the planned new version of indiscriminate data retention by German Federal Minister of Justice Stefanie Hubig:

"German Federal Minister of Justice Hubig's plans are extremely problematic. A three-month, indiscriminate and comprehensive data retention regime is not compatible with the case law of the European Court of Justice (ECJ). Against this background, the Minister of Justice's understanding of fundamental rights must also be questioned, at the very least."

"For it is obvious that this draft law contains no trace of the restrictions required by the ECJ, which could temporarily allow data retention in individual cases, subject to an order limited geographically or to specific groups of persons and based on a concrete cause."

Outdated and disproportionate

Landefeld comments on the proportionality and legal policy assessment of the draft bill:

"The Minister of Justice's plans are not only disproportionate, they are outdated. In addition to various other studies, even the German Federal Criminal Police Office recently confirmed that the availability of IP addresses beyond three to four weeks no longer offers any significant investigative added value.
Accordingly, apart from the vague wording in the coalition agreement, there is no explanation as to why such a long storage period should be necessary.
At the same time, the European e-Evidence system shows that the future clearly lies in cause-based electronic evidence preservation and disclosure within a matter of days. The signs therefore point unmistakably in a different direction."

Landefeld also takes a critical view of the timing and political approach of the German Federal Ministry of Justice:

"At European level, there are currently new initiatives aimed at establishing clear rules for the design of data retention in line with the requirements of the ECJ." Given the widely differing existing regulations in the various countries with regard to scope and retention periods, it is already foreseeable that reaching agreement will be extremely difficult.

"It is difficult to understand why the German Federal Ministry of Justice (BMJ) is intervening in this ongoing debate with a proposal that is clearly contrary to fundamental rights. The timing of the publication shortly before Christmas also creates the impression that an open and in-depth discussion of the proposals is not desired."

Concerns about new obligations for providers and professional confidentiality holders

Landefeld also warns against repeating past mistakes in the design of retention obligations:

"Previous data retention laws were rightly criticised for placing storage obligations unilaterally on providers of telecommunications and Internet access services. Appropriate differentiation between citizens and professional confidentiality holders such as lawyers, doctors, clergy or tax advisers was often lacking."

There is a risk that this problem will be repeated in the current draft law:

"There is serious concern that the BMJ will once again effectively shift the special protection afforded to professional confidentiality holders onto the Internet industry. A technical distinction between 'ordinary citizens' and professional confidentiality holders is not possible at the outset. Compensating for this would require additional measures which, in turn, would be highly problematic from a data protection perspective."

For providers, the trauma of bearing the costs of what is likely once again to be an unconstitutional implementation is also being repeated. Once more, the draft imposes extremely burdensome requirements for storage, processing and deletion, running into hundreds of millions of euros, which providers alone are expected to bear and for which they would not be compensated should the law be suspended.

Background

eco points out that the statutory obligation to retain data in Germany was suspended due to concerns under European law. In its judgment of 22 September 2022, the European Court of Justice made it clear that the German provisions on indiscriminate data retention were not compatible with EU law. On this basis, the German Federal Administrative Court finally declared the storage obligation for telecommunications providers to be contrary to EU law in September 2023.

eco supported the action brought by SpaceNet AG, a member company of the association, from the outset and thus made a significant contribution to clarifying the incompatibility with European law. Against this background, eco regards renewed hasty measures and excessive retention periods as particularly critical and regrettable.

Download the German-language eco guidelines on data retention here.