Background material on data retention

The Federal Administrative Court in Leipzig confirms the SpaceNet judgement of the European Court of Justice on data retention:

The German regulation of data retention without cause and across the board is contrary to Union law. The statutory retention obligations for telecommunications traffic data remain suspended due to the primacy of Union law.

A victory for SpaceNet AG, which has been fighting for six yearsagainst the controversial surveillance instrument. TheECJ finally creates legal certainty in dealing with the storage of data and clears the way for more suitable methods for the prevention and prosecution of criminal offences.

In his opinion, Advocate General Manuel Campos Sánchez-Bordona declares the German regulation to be contrary to EU law. He reiterates that the general and indiscriminate retention of traffic and location data in the area of electronic communications is only permitted in the event of a serious threat to national security.

The European Court of Justice (ECJ) heard a case on whether German data retention is compatible with the ePrivacy Directive and the EU Charter of Fundamental Rights. During the almost ten-hour hearing in Luxembourg, supporters and opponents fought fiercely over data retention. The proceedings were attended by 12 member states and the EU Commission. The terms "national security" and "serious criminal offences", which SpaceNet had insisted on clarifying, were discussed in detail. It is unclear whether the terms already mentioned by the ECJ in the "Quadratur Du Net" decision (October 2020) will be specified by the ECJ or by the nation states.

Adherence to general ban: The general and indiscriminate obligation to store traffic and location data is incompatible with EU law. (Publication of a decision by the European Court of Justice on three referrals from the UK, France and Belgium). However, exceptions are possible under strict conditions: in the fight against terrorism or serious crime.

The Federal Administrative Court in Leipzig suspends the proceedings on data retention by SpaceNet AG (Ref.: 6 C 12.18) and refers several fundamental questions to the European Court of Justice for clarification.

No rest: seven constitutional complaints have been lodged with the Federal Constitutional Court against the law on data retention without cause, including by an alliance of civil rights activists, data protectionists and politicians.

The mass retention of data without linking it to the fight against crime is incompatible with EU law. The Cologne Administrative Court rules against the Federal Network Agency and in favour of the providers SpaceNet AG and Telekom (in parallel proceedings) that they do not have to store their customers' connection data. The judgements initially only apply to SpaceNet and Telekom. De facto, data retention has been suspended since then.

The Federal Network Agency suspends the storage obligation for all providers.

On 22 June, the Münster Higher Administrative Court rules that the Data Retention Act violates EU law. As a result, SpaceNet is exempted from the obligation to store data from 1 July 2017 and is the only German provider not required to store data until the final decision in the main proceedings. Shortly afterwards, Telekom filed a lawsuit seeking clarification as to whether and how IP addresses must also be stored for mobile phones and Wi-Fi.

SpaceNet AG, supported by eco, files a lawsuit with the Cologne Administrative Court. The European Court of Justice (ECJ) rules on Swedish and English data retention that the retention of personal data must remain an exception and be limited to what is absolutely necessary.

A new law on data retention is passed in Germany, comes into force and becomes mandatory on 1 July 2017.

The internet industry association eco estimates the economic cost to providers of implementing the ten-week data retention obligation at around 600 million euros.

The ECJ declares the EU directive invalid: The EU has completely reversed its previous position and is against data retention.

The Federal Constitutional Court overturns data retention and declares the law unconstitutional - all data records must be deleted immediately, otherwise the provider violates the law again.

The Data Retention Act comes into force.

This is followed by a collective constitutional complaint on behalf of 34,939 complainants.

The law is passed by the grand coalition in Germany on 9 November 2007. The opposition votes against the controversial law. During the one-hour debate, Federal Minister of Justice Brigitte Zypries defended the initiative to retain connection and location data for six months, stating: "We are not on the way to a surveillance state."

One of the first prominent complaints came from Sabine Leutheusser-Schnarrenberger - then Federal Minister of Justice. She refused to implement the EU directive and was criticised by everyone for triggering EU proceedings against the Federal Republic of Germany.

The EU requires its member states to enshrine data retention in national law: Directive 2006/24/EC

The mother of data retention: For the first time, the Federal Council is calling for minimum data retention periods - it is unclear which ones and how many. Everyone still thinks it's mainly about the telephone.