In 2016, with an EU legal framework on data retention still lacking, the CJEU further clarified what safeguards are required for data retention to be lawful.

In the case of Tele2 Sverige and Home Secretary v. Watson, the court concluded that Member States cannot impose a general obligation on providers of electronic telecommunications services to retain data, but did not ban data retention altogether. Such retention is compatible with EU law if deployed against specific targets to fight serious crime. Retention measures must be necessary and proportionate regarding the categories of data to be retained, the means of communication affected, the persons concerned and the chosen duration of retention. Furthermore, national authorities’ access to the retained data must be conditional and meet certain data protection safeguards.

In the case of Breyer the court concluded that Internet Protocol addresses may constitute personal data where the individual concerned can be identified, even where a third party must obtain additional data for the identification to take place. The CJEU also held that data retention is allowed as long as website operators are pursuing a legitimate interest when retaining and using their visitors’ personal data. This is of major importance for data retention rules; it follows that online media service providers can lawfully store their visitors’ personal data to pursue a legitimate interest, rather than just for the purposes previously outlined in the invalidated Data Retention Directive. Thus, the grounds justifying data retention have become broader.  

Member States made only limited progress in adopting new legal frameworks for data retention to incorporate the requirements and safeguards set out in the CJEU’s case law. Most seem reluctant to amend their national laws to conform to the Digital Rights Ireland and Tele2 judgments. In the meantime, challenges against domestic data retention laws in Member States generally abated, though three characteristic cases challenging data retention were brought in Germany, the Netherlands and the United Kingdom in 2016.

All in all, Member States’ progress on the issue since the CJEU’s invalidation of the Data Retention Directive remains limited. This may partly be due to the absence of harmonised rules at EU level. Eurojust, the EU agency for judicial cooperation in criminal matters, has stated that, while data retention schemes are considered necessary tools in the fight against serious crime, there is a need to create an EU regime on data retention that complies with the safeguards laid down by the CJEU. In any event, regardless of whether at European or national level: as long as data retention measures continue to be deployed, adequate protection measures must soon be implemented to prevent fundamental rights violations. 

Source: FRA Fundamental Rights report, 2017

Austria

No significant change in 2016.

In 2015, the Supreme Court – which actually revoked the national law implementing the Data Retention Directive – concluded that accessing location data (including network cells) retained for billing purposes is necessary for investigating crimes, meaning that refusing to grant access would violate the law.

Belgium

In Belgium, a new law has been in force since July 2016. Given the concerns expressed during the legislative process, it added strict safeguards and security measures. The law also clearly defines which authorities can access and retain data and for how long, and specifies the requirements for accessing three different categories of data. However, the blanket retention of data by telecommunication providers has not been removed.

Bulgaria

In 2016, the new Countering of Terrorism Act (Закон за противодействие на тероризма) was adopted, amending the legal framework of data retention laid down in the Electronic Communications Act (Закон за електронните съобщения).  The new rules apply only when there is imminent danger of committing the crimes listed in the law. All of the listed crimes are related to terrorism. According to the new rules, access to the data in such cases must be provided immediately without prior permission by the court. The court, which must be notified immediately, reviews the case within the next 24 hours and confirms or rejects the access. If the access is confirmed, all actions done before the court decision are automatically validated. If access is denied, all the data provided so far must be destroyed. 

Another set of amendments to the Electronic Communications Act (Закон за електронните съобщения) submitted to parliament is aimed at permitting data retention for the purpose of finding persons, for whom a justified assumption can be made that they have become or may become victims of a serious crime.  According to the current rules data retention is possible only for the purpose of national security and for the purpose of prevention, investigation and prosecution of serious crime.  The draft law was developed by the government and passed the first reading in parliament in May 2016. To become a law it must go through a second reading, which is not scheduled yet. Between the two readings, two sets of amendments to the draft were submitted to parliament. The first one suggests narrowing the scope of data retention for finding victims or potential victims only to persons who have been reported missing.  The second one suggests the introduction of an obligation for the institutions implementing the data retention to inform, within 24 hours, the target persons about the data retention measures implemented on them. 

Croatia

No significant change in 2016.

In 2015, a review of the applicable data retention regime was initiated.

Cyprus

No significant change in 2016.

In 2014, defence lawyers attempted to use the CJEU ruling to overturn convictions in cases where necessary evidence has been collected via mass storage. National courts, however, found that data retention is a proportionate measure for combating crime. The government also proposed draft legislation to parliament that obliges telecom companies to register the users of prepaid cards.

Czech Republic

No significant change in 2016.

Denmark

In Denmark, the government announced that preparations for revising data retention rules are underway, stating that the revised rules are currently under consideration and planned to be introduced in the fall of 2017. The revised rules will take into consideration the CJEU’s Tele2 judgment.

Estonia

No significant change in 2016.

In 2015, a review of the applicable data retention regime was initiated. The Supreme Court of Estonia raised the question whether the Data Retention Directive’s invalidation renders evidence gathered via data retention inadmissible. 

Finland

No significant change in 2016.

In 2015, a review of the applicable data retention regime was initiated. Finland has also enacted legislative amendments. The Information Society Code specifies the retention periods for different types of communications data and requires individual, case-by-case reviews of access requests by the Ministry of the Interior; the new law also gives telecom operators more freedom in decisions regarding the technical implementation of requests.

Germany

In Germany, the Federal Constitutional Court rejected several expedited actions114 brought by lawyers, doctors, journalists, members of parliament and media associations – i.e. professionals bound by professional secrecy – as users of telecommunication services for private or business purposes. The applicants were seeking to annul the new provisions on the retention of telecommunication metadata introduced by a 2015 law. The court held that suspending the disputed provisions was not justified because the mere storage of data does not automatically cause serious disadvantages, even to persons bound by professional secrecy. The court further stressed that the conditions set out in the legislation for the use of data for criminal investigations meet the standards laid down in previous case law.

Greece

No significant change in 2016.

In 2014, various organisations produced legal analyses of the national regulation.

Hungary

In Hungary, the government has not taken any steps to amend the Act implementing the Data Retention Directive. However, the Hungarian parliament amended the Act on certain questions of electronic commercial services and information society services to expand the scope of data retention. It introduced data retention obligations for electronic and IT service providers similar to those applicable under the Act implementing the Data Retention Directive. The new law obliges electronic and IT service providers that allow encrypted communication through their services to store all metadata related to such communications for one year. It thus widens the scope of data retention.

Ireland

The Digital Rights Ireland challenge to domestic Irish data retention laws continues before the High Court in Dublin. The case had been adjourned until December 2016 to await the judgment of the CJEU in the joined English and Swedish cases, Davis and Watson v. Home Secretary and Tele2 Sverige. The High Court has not yet delivered judgment..

Lithuania

No significant change in 2016.

In 2015, a review of the applicable data retention regime was initiated.

Luxembourg

In Luxembourg, the government introduced a bill amending the data retention regime in accordance with Digital Rights Ireland and restricting the possibilities of retaining data to the grounds specifically listed in the bill. It was debated whether or not the bill contains a wider list of offences justifying retention beyond what is strictly necessary.

Netherlands

In the Netherlands, the Administrative Jurisdiction Division of the Council of State decided on an administrative action116 against the Passport Act (Paspoortwet), which allows the Dutch authorities to store in a database digital fingerprints obtained for new passports or identity cards. The Council of State referred the case to the CJEU for a preliminary ruling, but the court concluded that it could not review the matter because it does not fall within the scope of the European Passport Regulation. The Council of State then decided that the long-term decentralised storage of digital fingerprints by the authorities is illegitimate. However, this cannot prevent the authorities from refusing to issue a passport.

Poland

In Poland, Parliament adopted in 2016 the amendment to the Act on Police and several other acts (Ustawa o zmianie ustawy o policji i innych ustaw) concerning certain competences of the enforcement and intelligence services, including their access to telecommunication metadata (such as telephone billings or location data) retained by telecom companies as well as internet service providers. The new law entered into force on 7 February 2016. According to the new law, every six months the competent authorities are obliged to provide the court with a general report on the obtained data. The report should contain the following information: number of cases in which the data were asked for, types of data, types of criminal offences which formed grounds for a decision to obtain data. Subsequently, the court is supposed to inform the services which were subject to supervision on the control results. However, it will not have any power to enforce the deletion of data. Moreover, the new law extends the surveillance mechanisms to “internet data”, broadening the current competences of enforcement and intelligence services to encompass metadata concerning the citizens’ activity on the Internet related to the use of electronic services. The data retention period is 12 months.

Romania

In Romania, there is three main laws under preparation, which allow for data retention: on amending the Counter Terrorism Law (Legea nr. 535/2004 privind prevenirea şi combaterea terorismului), on the purchase of prepaid SIM cards and on cyber security, respectively.  On 12 and 13 April 2016, the President of Romania (Președintele României) organized consultations with representatives of the parliamentary parties on these law proposals. 

Slovakia

In Slovakia, a new law entered into force on 1 January 2016, abolishing the preventative blanket retention and storage of data by telecommunications companies and introducing all the safeguards prescribed by the CJEU.

Slovenia

No significant change in 2016.

In 2014, on 11 July, the Slovenian Constitutional Court repealed mandatory data retention and took steps to compel ICT operators to delete stored metadata.

Spain

No significant change in 2016.

In 2014, defence lawyers attempted to use the CJEU ruling to overturn convictions in cases where necessary evidence has been collected via mass storage. National courts have, however, found that data retention is a proportionate measure for combating crime. Even when the applied measures have been viewed as excessive in the light of the Digital Rights Ireland criteria, the Court of Appeal of the Netherlands explicitly stated that the invalidation of the directive does not automatically make the national legislation unconstitutional.

Sweden

No significant change in 2016.

In 2015, Tele2, a telecom company, informed the Swedish Post and Telecoms Authority that it would stop storing data to comply with the CJEU judgement. However, the police informed the Post and Telecoms Authority that this would undermine the effectiveness of their work, so the authority requested the company to continue retaining data. Tele2 filed proceedings against the state, arguing that its failure to abolish data retention conflicted with EU law and the Charter of Fundamental Rights.

United Kingdom

In the United Kingdom, the Investigatory Powers Act provides for the Secretary of State to require communication service providers to retain relevant communications data for one or more of the statutory purposes for a period up to 12 months and specifies a number of safeguards in respect of data retention.

The Court of Appeal reviewed a claim alleging that the retention of, and access to, sensitive personal data – in particular, on gender reassignment – by certain officials breached the right to private life (Article 8 of the ECHR). The court dismissed the appeal, holding that although there was an interference with Article 8, it was proportionate. Specifically, the data were already in the public domain and would mostly be of no interest to those assessing them, and they would typically have no contact with the applicant. Additionally, disciplinary measures were provided for in case of any abuse of access by the officials.