Storing telephone and internet connection data without reason or suspicion is against EU law, the European Court of Justice (ECJ) ruled on September 20, 2022. The regulations currently in force in Germany are therefore illegal. The Telecommunications Act (TKG), which has been in force since July 2017, obliges providers of telephone and internet access services in Germany to store traffic and location data of their users for four (location data) and ten weeks (connection data).

By contrast, SpaceNet and Deutsche Telekom had already sued in German courts in 2016. The administrative court in Cologne had initially decided that both providers were not obliged to keep data. In 2019, the Federal Administrative Court referred the issue of compatibility with EU law to the ECJ as part of the review. The Federal Network Agency had already suspended the storage obligation due to the legally uncertain situation.

With the ruling, the ECJ judges have now confirmed their previous case law. “National legislation providing for general and arbitrary storage of traffic and location data as a preventive measure to fight serious crime and prevent serious threats to public security” violates EU law. Exceptions are only allowed where there is a “real and current or foreseeable serious threat to national security”. However, such an injunction must be reviewed by a judge or independent governing body and may only be issued for a period “limited to what is strictly necessary, but may be extended if the threat persists”.

In the run-up to the ECJ ruling, the issue of data retention within the federal government had caused rifts. While Federal Interior Minister Nancy Faeser of the SPD described the storage of telephone and internet access data as an important tool in the fight against crime, representatives of the other traffic light parties FDP and Greens pushed for its repeal.

Justice Minister Marco Buschmann of the FDP spoke of a good day for civil rights. “We are now going to quickly and definitively remove the retention of data from the law without giving reasons,” said the minister. “Data retention belongs to the dustbin of history,” said Konstantin von Notz, deputy leader of the Greens. After all, after intensive discussions, the traffic lights in their coalition agreement clearly agreed that they would no longer monitor the population for no reason in the future, but would aim to avert dangers and implement a fundamental rights-based security policy and the rule of law.

Representatives of the ITC industry welcomed the verdict. Bitkom director Bernhard Rohleder explains: “With today’s ruling, the ECJ is effectively burying data retention. There is no point in continuing to work on this connection data storage tool for no reason. Politicians are called upon to adopt other, legal compliant options for digital forensics.”

Oliver Süme, CEO of the eco-association, called the judgment of the Court of Justice an important milestone. “To definitively undo the data retention in Germany, the federal government must now do its homework: in addition to the pending decision of the Federal Administrative Court, we urgently need a law to repeal the current regulations.” Süme hopes the traffic light will settle its internal coalition talks and now remove data retention from the law as soon as possible.

Süme and other critics of data retention propose the so-called “quick freeze” method as an alternative. User data may only be collected and stored for investigative purposes if there is a concrete suspicion and on the orders of a judge. “Data retention greatly affects our privacy, but does not bring any proven added value to criminal prosecution,” the eco-representative announced in the run-up to the ruling. “Instead of seriously looking for alternatives, Germany still carries the mantra that serious crime can only be fought with data retention – but that is wrong.”