Britannia Radio

Blog] Legal opinion on data retention misses the point (19 May 2012) via AP

 

Referring to an opinion given by the Commission's legal service, EU Commissioner Malmström claims it was legally impossible to amend the controversial data retention directive so as to give Member States discretion as to whether or not they require providers to retain the entire population's communications data. The legal opinion, however, comes to quite a different conclusion. After months of correspondence, hundreds of FOI requests, a letter written by a Member of Parliament and a complaint submitted to the European Court of Justice, the EU Commission has finally released the legal opinion no. Ares(2010)828204 (pdf) which allegedly finds that the EU must continue to require blanket communications data retention throughout Europe. It turns out that the opinion dated 10 November 2010 deals with quite a different matter: It says that the EU cannot render the application of the data retention directive optional to Member States. This is good news because an optional directive would allow Poland, for example, to pursue the proposal of storing communications data for 15 years. The EU data retention directive 2006/24/EC bans storage periods of more than two years. Making the application of the data retention directive optional is not what is being proposed though and misses the point. More than 100 non-governmental organizations are calling for an EU-wide ban on blanket communications data retention laws. The legal opinion does not examine this option. Some NGOs are proposing a compromise which would allow, but not require Member States to enact blanket communications data retention laws, while imposing compulsory limits and standards on Member States that do opt for data retention. A data retention directive thus amended would still be compulsory for all Member States, but it would allow them to opt for storing communications data concerning suspects only (data preservation). Such amendment would partly restore EU law in force before the data retention directive was introduced. The legal opinion does not deal with the proposal of making indiscriminate data retention (not the application of the directive!) optional to Member States. It therefore misses the point of our proposals. The Commission argues that giving Member States a choice would re-introduce obstacles to the internal market. However there is nothing in the treaties to prevent the EU from partially withdrawing harmonization measures. Besides the data retention directive in truth has resulted in a fragmentation rather than a harmonization of provider's obligations throughout the EU. A strictly defined choice as proposed by NGOs would result in much more harmonization than exists at present (see here for details). The Commission's line of argument turns completely abstruse where the EU-wide obligation to retain anybody's communications data is dubbed "common minimum standards for [...] fundamental rights". The EU data retention directive is a common depletion of fundamental rights and the opposite of protecting our liberties. Renowned European law academic Andreas Fischer-Lescano has confirmed to me that the "conditional model" described above is feasible and in line with the treaties. In fact there are various existing examples of such "conditional harmonization" (e.g. Article 1 2003/641/EC, Article 25 2011/92/EU, Article 9 pp. 2006/123/EC, Article 5 2001/29/EG, Article 15 ex-2002/58/EC). Unfortunately the Commission steadfastly refuses to examine this compromise proposal in the context of its pending impact assessment. It will therefore probably be up to the European Parliament and the EU Court of Justice to examine it later on. Differences in legal traditions, constitutions and political preferences in the EU are simply too great to impose the draconic and harmful policy of indiscriminate communications data retention on all 27 Member States. On a side note, contrary to what the legal service is suggesting, it is not possible to base the data retention directive on Article 87 (2) (a) TFEU as it is not about cross-border police cooperation but rather about facilitating national law enforcement (see here for details in German). Full text of the legal service's opinion Ares(2010)828204:

 

[Blog] Commission: Data retention too sensitive to be publicly debated (17 Feb 2012)

 

In the context of the revision of the controversial EU Data Retention Directive, the EU Commission's Legal Service has written an opinion on the possibility to render the application of the Data Retention Directive optional to Member States. However the Commission is refusing to disclose it due to the "highly sensitive nature" of the public debate on the controversial policy of blanket communications data retention. The Commission today refused to disclose the legal opinion on the future of the controversial EU policy to retain information on all EU citizens communications and movements without cause. The secret opinion Ares(2010)828204 is described as follows: "This legal opinion analyses the issues of the possibility to render the application of the Data Retention Directive optional to Member States (MS) and the consequences of such a different treatment between MS as well as the question of the legal basis on which future instruments on data retention should be adopted." The Commission acklowleges that "the question of the data retention is of a highly sensitive nature" due to its "impact on the rights to privacy and the protection of personal data". However, the Commission is afraid that "external interferences" as a result of publication of the document would "seriously undermine" its decision-making process "in this area of a high sensitive nature". I have applied to the Commission to reconsider its decision. I am even considering taking the Commission to court if it continues to refuse access to this crucial piece of advice. Apparently the legal service claims in it that it was impossible to render the application of the Data Retention Directive optional to Member States, a position disputed by legal scholars. The Commission is currently carrying out an impact assessment on the future options with regard to the controversial 2006 Data Retention Directive. Apparently it is assessing neither the option of banning blanket data retention nor of making the sweeping policy of indiscriminate communications data retention optional for Member States. More than 100 organisations from 23 European countries have asked EU Commissioners Malmström, Reding and Kroes in a joint letter to "propose the repeal of the EU requirements regarding data retention in favour of a system of expedited preservation and targeted collection of traffic data". Among the signatories are civil liberties, data protection and human rights associations as well as crisis line and emergency call operators, professional associations of journalists, jurists and doctors, trade unions, consumer organisations and industry associations Directive. Read the Commission's decision to decline access in full (pdf) If that does not work try here http://www.vorratsdatenspeicherung.de/images/ARES%282012%29183373.pdf   Blog post by Patrick - This post expresses the author's personal views.

http://www.vorratsdatenspeicherung.de/content/view/542/55/lang,en/

Cecilia Malmström

European Commissioner for Home Affairs

BE-1049 Brussels

22 June 2010

Dear Commissioner,

The EU data retention directive 2006/24 requires telecommunications companies to store data about all of their customers' communications. Although ostensibly to reduce barriers to the single market, the Directive was proposed as a measure aimed at facilitating criminal investigations. The Directive creates a process for recording details of who communicated with whom via various electronic communications systems. In the case of mobile phone calls and SMS messages, the respective location of the users is also recorded. In combination with other data, Internet usage is also to be made traceable.

We believe that such invasive surveillance of the entire population is unacceptable. With a data retention regime in place, sensitive information about social contacts (including business contacts), movements and the private lives (e.g. contacts with physicians, lawyers, workers councils, psychologists, helplines, etc.) of 500 million Europeans is collected in the absence of any suspicion. Telecommunications data retention undermines professional confidentiality, creating the permanent risk of data losses and data abuses and deters citizens from making confidential communications via electronic communication networks. It undermines the protection of

journalistic sources and thus compromises the freedom of the press. Overall it damages preconditions of our open and democratic society. In the absence of a financial compensation scheme in most countries, the enormous costs of a telecommunications data retention regime must be borne by the thousands of affected telecommunications providers. This leads to price increases

as well as the discontinuation of services, and indirectly burdens consumers.

Studies prove that the communications data available without data retention are generally sufficient for effective criminal investigations. Blanket data retention has proven to be superfluous, harmful or even unconstitutional in many states across Europe, such as Austria, Belgium, Germany, Greece, Romania and Sweden. These states prosecute crime just as effectively using targeted instruments, such as the data preservation regime agreed in the Council of Europe Convention on Cybercrime.

 

There is no proof that telecommunications data retention provides for better protection against crime. On the other hand, we can see that it costs billions of Euro, puts the privacy of innocent people at risk, disrupts confidential communications and paves the way for an ever-increasing mass accumulation of information about the entire population.

 

Legal experts expect the European Court of Justice to follow the Constitutional Court of Romania as well as the European Court of Human Rights's Marper judgement and declare the retention of telecommunications data in the absence of any suspicion incompatible with the EU Charter of Fundamental Rights.

 

As representatives of the citizens, the media, professionals and industry we collectively reject the Directive on telecommunications data retention. We urge you to propose the repeal of the EU requirements regarding data retention in favour of a system of expedited preservation and targeted collection of traffic data as agreed in the Council of Europe's Convention on Cybercrime. In doing so, please be assured of our support.

Yours faithfully,

1. Dr. Patrick Breyer [...] for the Arbeitskreis Vorratsdatenspeicherung (Working Group on

Data Retention), Germany

2. Gergana Jouleva for the Access to Information Programme, Bulgaria

3. Terri Dowty for Action on Rights for Children, UK

4. Rainer Hammerschmidt for Aktion Freiheit statt Angst e.V., Germany

5. Andrea Monti for ALCEI - Electronic Frontiers Italy, Italy

6. David Banisar for ARTICLE 19: Global Campaign for Free Expression, UK

7. Dr. Roland Lemye for Association Belge des Syndicats Médicaux, Belgium

8. Alen Nanov for the Association for Advising, Treatment, Resocialization and

Reintegration of Drug Users and Other Marginalized and Vulnerable Groups IZBOR,

Macedonia

9. Bogdan Manolea for the Association for Technology and Internet - APTI, Romania

 

 

 

102. Anna Bauer for Vereinigung Demokratischer Juristinnen und Juristen e.V., Germany

103. Arnout Veenman for the Vereniging ISPConnect Nederland, The Netherlands

104. Miek Wijnberg for Vereniging Vrijbit, The Netherlands

105. Daniel Jahre for Verein Linuxwochen, Austria

106. Claudio Agosti for the Winston Smith Project, Italy

Joint letter of 22 June 2010 to

 

1.Cecilia Malmström, European Commissioner for Home Affairs

2.Viviane Reding, European Commission Vice-President with responsibility for Justice, Fundamental Rights and Citizenship

3.Neelie Kroes, European Commission Vice-President with responsibility for the Digital Agenda

Dear Madam,

 

The EU data retention directive 2006/24 requires telecommunications companies to store data about all of their customers' communications. Although ostensibly to reduce barriers to the single market, the Directive was proposed as a measure aimed at facilitating criminal investigations. The Directive creates a process for recording details of who communicated with whom via various electronic communications systems. In the case of mobile phone calls and SMS messages, the respective location of the users is also recorded. In combination with other data, Internet usage is also to be made traceable.

 

We believe that such invasive surveillance of the entire population is unacceptable. With a data retention regime in place, sensitive information about social contacts (including business contacts), movements and the private lives (e.g. contacts with physicians, lawyers, workers councils, psychologists, helplines, etc) of 500 million Europeans is collected in the absence of any suspicion. Telecommunications data retention undermines professional confidentiality, creating the permanent risk of data losses and data abuses and deters citizens from making confidential communications via electronic communication networks. It undermines the protection of journalistic sources and thus compromises the freedom of the press. Overall it damages preconditions of our open and democratic society. In the absence of a financial compensation scheme in most countries, the enormous costs of a telecommunications data retention regime must be borne by the thousands of affected telecommunications providers. This leads to price increases as well as the discontinuation of services, and indirectly burdens consumers.

 

Studies prove that the communications data available without data retention are generally sufficient for effective criminal investigations. Blanket data retention has proven to be superfluous, harmful or even unconstitutional in many states across Europe, such as Austria, Belgium, Germany, Greece, Romania and Sweden. These states prosecute crime just as effectively using targeted instruments, such as the data preservation regime agreed in the Council of Europe Convention on Cybercrime. There is no proof that telecommunications data retention provides for better protection against crime. On the other hand, we can see that it costs billions of euros, puts the privacy of innocent people at risk, disrupts confidential communications and paves the way for an ever-increasing mass accumulation of information about the entire population.

 

Legal experts expect the European Court of Justice to follow the Constitutional Court of Romania as well as the European Court of Human Rights's Marper judgement and declare the retention of telecommunications data in the absence of any suspicion incompatible with the EU Charter of Fundamental Rights.

 

As representatives of the citizens, the media, professionals and industry we collectively reject the Directive on telecommunications data retention. We urge you to propose the repeal of the EU requirements regarding data retention in favour of a system of expedited preservation and targeted collection of traffic data as agreed in the Council of Europe's Convention on Cybercrime. In doing so, please be assured of our support.

 

Yours faithfully,

 

 

 

1.Patrick Breyer for the Arbeitskreis Vorratsdatenspeicherung (Working Group on Data Retention), Germany

 

2.Gergana Jouleva for the Access to etc, etc and many, many more names

 

[Blog] EU Commissioner refuses to consider making blanket data retention optional (26 Apr 2012)

 

EU Commissioner Cecilia Malmström claims that the EU was unable to amend the Data Retention Directive 2006/24/EC to no longer make blanket communications data retention mandatory throughout the EU, but to regulate and restrict national retention schemes where such exist only. The Commission is currently carrying out an impact assessment on the future options with regard to the controversial Data Retention Directive 2006/24 which, according to the European Data Protection Supervisor, "is without doubt the most privacy invasive instrument ever adopted by the EU in terms of scale and the number of people it affects". A Commission proposal to amend the Data Retention Directive is to be presented in July 2012. The civil society proposal of an EU-wide ban on blanket retention legislation in favour of a system of expedited preservation and targeted collection of traffic data is apparently not among the options to be considered because of legal and political doubts the Commission is having as to putting it into practise. What is more, even the compromise proposal to no longer make blanket retention mandatory and regulate it only where such schemes are enacted nationally is not to be evaluated. The reason given for this is disturbing: Apparently the Commission's legal service claims in an opinion that the proposal is illegal because EU law does not permit clauses allowing Member States to opt out of single market legislation. The Commissioner now states publicly: With regard to the question of the Honourable Member on the possibility of having an optional application of the Data Retention Directive, it needs to be underlined that this is not possible for the following reasons: EC law is equally applicable in all Member States in line with the principles of equal treatment and uniform application. Opt-outs for individual Member States are only possible when they are foreseen in primary law. In line with current Treaty provisions, these are not applicable for the data retention directive. Given that the data retention directive has to be applied in the entire EU, any optional retention would reintroduce obstacles to the internal market. In absence of exemptions flowing directly form primary law, secondary law can foresee derogations in favour of the Member State in question subject to specific objectively different circumstances. The Commission is not aware of any such objectively different circumstances which might justify derogation from this principle in the case of data retention. The fact that some Member States may have had constitutional, legal or political difficulties in transposing the directive could not constitute a justification for such a derogation. On the contrary, to render optional any measure with obvious implications for the right to data protection and privacy would deprive the citizen of common minimum standards for those fundamental rights across the EU. While I agree that Member States cannot be given the choice to opt in or out of the data retention directive (meaning, for example, that Ireland could opt out and have data retained for more that two years). However this is not what the proposal suggests. Under the "compromise proposal" the Data Retention Directive is is to reserve to national Parliaments and Constitutional Courts the decision of whether they wish to have communications data retained on the entire population without cause. Only where such national blanket retention requirements are put in place, they are to be (mandatorily) regulated and limited by the EU data retention directive. In my opinion it is clear that such "alternative harmonisation" is legal. In fact it is being done all the time. Article 15 of the ePrivacy Directive 2002/58/EC made it optional for Member States to provide for the retention of traffic data in national law, while imposing certain mandatory standards if they do. There are other examples of EU law allowing Member States to choose between enacting a measure within certain limits and abstaining (e.g. Article 1 2003/641/EC, Article 25 2011/92/EU, Article 9 pp. 2006/123/EC, Article 5 2001/29/EC). It is absurd to claim that mandatory blanket retention of all communications data created "common minimum standards for those fundamental rights across the EU". What the current directive creates is a common maximum erosion of fundamental rights across the EU. In the fashion of the Commission's arguments, one could say that re-introducing the penalty of death by Guillotine would create a "common minimum standard" for the right to life. We should not allow the Commission to use non-existing legal constraints for not even having to even consider and evaluate the option of abolishing mandatory blanket communications data retention while limiting it where it is in place. It is not good enough to examine the option of repealing the directive altogether, as this option is easy to dismiss for a lack of harmonisation and data protection it would bring about (for example, it would allow Member States to even go beyond the few limits the Data Retention Directive sets). In order to overcome the false legal analysis that is impeding a complete impact assessment, I seek your help on the following point: Have you got any ideas on how we could counter the false legal service's opinion with a correct one? Are there any institutions or EU law experts that you can ask for a legal analysis? Blog post by Patrick - Article does not necessarily reflect AK Vorrat's opinion.

 

 

The highly controversial surveillance measure of telecommunications data retention is noticeably losing its legitimacy. A leaked internal memo by the European Commission[1] setting out a six months roadmap for the evaluation of the EU's 2006 data retention directive attests to its complete failure. Previously denounced as a "paradigm shift" and a "deviation in constitutional norms" by legal scholars and practitioners, the leaked memo leads critics to predict that data retention is nearing its end. The German Working Group on Data Retention ("AK Vorrat") has translated and issued a commentary on the document[2] which was recently published by the Austrian civil rights organization "Quintessenz". In a surprisingly frank manner, the Commission raises a number of problems of the directive, including breaches of law and flaws in its implementation. Perhaps the most remarkable aspect of the report is the Commission questioning the notion of data retention itself. The official report on the evaluation of the data retention directive, presented by the Commission on 18 April 2011, failed to prove the necessity of the instrument. Despite numerous deadline extentions, only 11 out of 27 EU Member States submitted the obligatory statistics on data retention. Furthermore the data that was provided was largely unusable[3]. AK Vorrat concluded that the Commission's report was a political document rather than the result of an independent and scientifically sound analysis that would deserve the name of "evaluation"[4]. While the Commission now admits that “there is a continued perception that there is little evidence at an EU and national level of the value of data retention”, it does not refrain from forging ahead with the question: "what would be the most effective way of demonstrating the value of data retention in general and of the DRD itself?" "Even six years after its adoption, the Commission has failed to prove the necessity of the data retention directive," says Frank Herrmann of AK Vorrat. "Instead the Commission is asking the EU Member States for arbitrary examples of benefits of data retention. This obliterates any trust in the impartiality of the Commission. To accept the failure of the data retention directive would be the right decision - and a courageous one." The confidential memo proceeds to report that restrictions on access to retained communications data (to cases of "terrorism" and "serious crime") have become meaningless. No EU-wide definition of the notion of “serious crime” exists, leading to broad misapplication in some Member States. The internal report not only discusses the possibility of extending the data retention directive in order to allow for massive data access in cases of copyright infringements, "hacking" or "emergencies". It also considers requiring the retention of instant messaging, Internet chat and Internet upload and download records. The report also indicates a need for regulation of data handling by private entities and governments, noting the lack of standards for notification of data retrieval and the absence of a right to obtain information or compensation in cases of data theft or abuse. On the other hand, the Commission examines the situation of the providers that are compelled to retain data: Depending on the country, there is no or nearly no reimbursement of storage costs, which leads to a hitherto unknown distortion of the free market. Especially the costs for small businesses are being rated as "disproportionately high". Because of the lack of a definition under which conditions which authority is authorised to access retained communications data, providers are being driven into the unpopular role of interpreters of vague data retention legislation. This is particularly insidious considering that the EU data retention directive was not adopted as a law enforcement tool, but as an instrument of market harmonization. If the EU Commission now admits that the Directive has led to a distortion of competition rather than harmonization, the legal basis and thus the legality of the controversial directive collapses. Is it necessary to separate data retained unter the data retention directive from data companies keep for operational reasons? The memo leaves this question unanswered. The two different types of communications data (operational data and law enforcement data) are not always distinguished, which not only increases data security risks but also makes it impossible to assess the purported usefulness of blanket data retention legislation specifically. Few of the numerous and diverse concerns raised by civil rights and other non-governmental organizations[3,4] are addressed in the memo. An analysis of the social and sociological implications of recording the entire population's communications is entirely absent and apparently irrelevant in the eyes of the Commission. Many conservative politicians claim again and again that there was no alternative to collecting and retaining complete sets of telecommunications traffic data on every European citizen for months or years. Yet the necessity of this sweeping and indiscriminate policy and its conformity with human rights remains unproven, even five years after the coming into force of the EU data retention directive. AK Vorrat calls for immediately putting an end to the EU-wide obligation of blanket data retention legislation. Together with the 64,074 signatories of the successful German petition against data retention[5], we demand that Germany continue to refuse implementation of the data retention directive into German law until the European Court of Justice has decided on the compatibility of the directive with our fundamental rights. The EU Commission intends to consider its options for withdrawing or amending the data retention directive or making a proposal on data preservation (“quick freeze”) by May 2012. Draft legislation to amend the directive is to be presented by July 2012. AK Vorrat regrets that the Commission is not considering the option of an EU-wide ban on blanket data retention legislation or of letting each Member State decide whether or not to have communications data recorded on all of its citizens in the absence of any suspicion of criminal wrongdoing. Claims that the EU was legally unable to harmonise data retention legislation only where it is in place are considered unfounded by legal scholars[6].

mpossible to Ensure Legality of EU Communications Data Retention Directive Says German Parliament

April 26, 2011 -- Today the Working Group on Data Retention published an opinion prepared in February 2011 by the Legal Services of the German Parliament on "The Compatibility of the EU Data Retention Directive with the EU Charter of Fundamental Rights". The Bundestag's legal experts write that "it is impossible to rephrase the Directive in such a way that it would ensure compliance with the Charter of fundamental Rights". The opinion observes that "it has become clear that the success of blanket

communications data retention is very limited", and that data retention increases the crime clearance rate only "marginally". It concludes with the finding that: "In any case, the relationship between ends and means is disproportionate."

 

"The Bundestag's opinion supports our conviction that the EU Court of Justice will not uphold the Data Retention Directive once the Irish High Court’s request to examine its legal validity takes place", says Uli Breuer of the Working Group on Data Retention. "The EU must abort this experiment immediately and replace the completely disproportionate blanket collection of the entire population's communications records with an instrument for preserving the data of suspects."

 

"The principle of proportionality is binding on any state governed by the rule of law", Kai-Uwe Steffens of the Working Group adds. "The Legal Services of the German Parliament have found that data retention is irreconcilable with this principle. The Federal Republic of Germany must therefore work towards outlawing data retention within the EU."

 

The Working Group on Data Retention calls on the governments and parliaments of Austria, Germany, Romania, Sweden and the Czech Republic to:

refrain from imposing or permitting the indiscriminate collection of information on all telephone calls, text messages, e-mails and Internet communications, even if fines are imposed, particularly as the EU Court of Justice has yet to rule on the validity of the Data Retention Directive,

 

1.

request permission from the Commission and, if necessary, from the EU Court of Justice, to be exempted from transposing the EU Data Retention Directive 2006/24/EC under Article 114 (4) TFEU,

2.

lobby for the withdrawal of the failed Data Retention Directive and for a European ban on laws requiring blanket and indiscriminate collection of telecommunications data on citizens who have never been suspected of any wrong-doing.

3.

Excerpts from the opinion prepared by the German Parliament’s Legal Services:

"This marginal increase in the clearance rate by 0.006% could raise doubts about whether the provisions in their current form would stand their ground under a proportionality review. In any case, the relationship between ends and means is disproportionate."

"There are doubts about whether Directive 2006/24/EC and the obligation to retain data without cause that it compels are in conformity with the community principle of professional and economic freedom.

 

From an abstract and general point of view, the provisions can be said to be effective. Likewise, they could be said to be necessary, considering that blanket storage is more extensive and therefore more reliable and effective than a preservation order based on reasonable suspicion. What is likely to be problematic, however, is the proportionality of the scheme with regard to the relationship between the ends and means. Nonwithstanding the pending evaluation by the Commission, which, presumably, will yield reliable data concerning the prospects of success of data retention, the provisions in their present

form could interfere disproportionately with telecoms operators' fundamental right to professional and economic freedom. With respect to the current state of debate about Directive 2006/24/EC and interpretation of the EU Charter of Fundamental Rights as well as to the Member States' scope of implementation it is impossible to rephrase the Directive in such a way that it would ensure compliance with the Charter of Fundamental Rights."