By judgement dated 20 September 2022 (docket No. C-793/19, C-794/19), the European Court of Justice (ECJ) ruled that the German regulations on the preventative storage of location and traffic data, known as data retention, are contrary to Union law. The Court of Justice herewith confirms its previous case law (most recently ECJ, judgement of 05 April 2022, case C-140/20), as was to be expected.

At the same time, the ECJ formulates conditions according to which it is possible to deviate from the fundamental ban on retaining data without specific reason. In this way, the ECJ provides the national legislator with decisive recommendations for action to reform the law.

Internet and telecommunications service providers fight back

The background to the current decision is a legal dispute between two internet and telecommunications service providers (SpaceNet & Telekom). They had objected to the Federal Network Agency [Bundesnetzagentur, BNetzA] about the obligation to store traffic and location data under the German Telecommunications Act [Telekommunikationsgesetz, TKG] (Secs. 113b - 113g TKG old version, now Secs. 176 et seq. TKG). This data retention obligation exists generally and indiscriminately according to the national requirements.

The Administrative Court [Verwaltungsgericht, VG] of Cologne had already ruled at first instance in 2018 that such an obligation violates Union law. In the second instance, however, the Federal Administrative Court [Bundesverwaltungsgericht, BVerwG] came to the conclusion that the storage of location and traffic data could be in line with EU law. The Federal Administrative Court then referred the case to the ECJ for a preliminary ruling.

ECJ decision on data retention

The ECJ confirmed that the retention of data without a specific reason and indiscriminately is impermissible. This applies even if data is retained for the purpose of fighting crime and protecting national security.

Under certain conditions, however, the instrument of data retention could be designed in a manner that conforms to EU law. Accordingly, Union law does not preclude regulations on data retention if they

  • permit the operators of electronic communications services to be required to retain traffic and location data generally and indiscriminately in order to protect national security if there is a serious threat to national security that can be considered real and current or foreseeable. The requirement may be controlled by a court or independent administrative agency and must be limited to the absolutely necessary time period.
  • provide for a targeted retention of traffic and location data to protect national security, fight against serious crime, and prevent serious threats to public security based on objective and non-discriminatory criteria by means of categories of data subjects or a geographic criterion, provided that they are limited to the absolutely necessary time period.
  • provide for a general and indiscriminate retention of IP addresses assigned to the source of a connection, provided that this is done for the same purposes and under identical time limits.
  • provide for a general and indiscriminate retention of data concerning the identity of users of electronic communications for the purpose of protecting national security, fighting crime and protecting public safety.
  • allow providers of electronic communications services to be required, for a specified period of time, to promptly secure the traffic and location data available to them in order to fight serious crime and protect national security (cf. also margin No. 131 of the judgement).

Scope for design remains despite the ECJ ruling

In its decision, the ECJ made it clear that data retention without a specific reason is not permissible. However, it is precisely the exceptions and interpretable legal terms defined by the ECJ that leave the German legislature considerable scope for design. Ultimately, this could lead to more data retention than one might think based on the partial media coverage.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.