Data Retention: eco Warns Against Regression – Legal Certainty, Proportionality and Data Protection Must Remain Guiding Principles

• According to eco, these five points must be taken into account in further consultations on the new draft law

The German federal government plans to store IP addresses for up to three months. From the perspective of eco - Association of the Internet Industry, this would be a step backward in digital policy: renewed blanket data retention jeopardises fundamental rights, creates economic burdens and undermines trust in digital services. Instead, the association is calling for a legally compliant, proportionate and technically feasible solution that is aligned with the European Court of Justice (ECJ) requirements.

"After almost two decades of legal disputes, the German federal government must not once again introduce a law that is exposed to significant legal risks in court. Unjustified data retention remains contrary to European law - the latest ECJ ruling leaves no doubt about this. We need legal certainty instead of symbolic politics," says Oliver Süme, Chair of the Board of eco - Association of the Internet Industry.

In its C-470/21 ruling, the European Court of Justice recently clarified that the indiscriminate storage of communication data is incompatible with European fundamental rights. Nevertheless, the German federal government is working on a national regulation for the mandatory storage of IP addresses.

eco is now calling for a new draft law to take these guidelines into account:

1. Legal certainty instead of ongoing disputes

Every form of indiscriminate and blanket data storage has failed in court. A new approach must not undermine trust in digital services and technologies - neither for citizens nor for companies. Only a precise, purpose-specific and controlled regulations can create trust.

1. Limit storage periods to what is necessary

According to law enforcement authorities, storing IP addresses for two to three weeks is sufficient. Longer periods lead to disproportionate infringement of fundamental rights and increase the risk of abuse and misattribution. eco therefore calls for strictly time-limited, purpose-bound data retention or the use of the quick-freeze procedure, which better protects civil liberties.

1. Avoid economic burdens

The introduction of blanket storage obligations causes significant costs for providers - from additional infrastructure to higher IT security requirements. These requirements lead to price increases for end customers and particularly endanger smaller providers. Without cost compensation and realistic transition periods, Germany risks a competitive disadvantage as a digital location.

1. Ensuring data protection - preventing abuse

With every additional week of data storage, the risk of data leaks or unauthorised access increases. The combination of IP, port and connection data can allow profound conclusions to be drawn about users' behaviour and communication. eco warns that new security promises could themselves become security vulnerabilities.

1. No false sense of security through mass surveillance

There is no empirical evidence that data retention significantly improves the clearance rate. Professional criminals can easily circumvent such measures. Instead of mass data collection, what is needed are targeted investigative tools and better international cooperation.

"We stand for a digital security architecture that upholds the rule-of-law principles and strengthens trust in technology - not for mass surveillance. Only with clear, legally secure rules can Germany achieve digital sovereignty," Süme continues.

You can download the German eco guidelines on data retention here.