Ministers Appear Ready to Approve Two-Step Data Retention
European justice and home affairs (JHA) ministers agreed provisionally Thurs. to a 2-step approach to mandatory retention of communications traffic data. Meeting in Brussels, the Council said member states should first require communications services providers (CSPs) to retain fixed and mobile telephony data. Internet data and information about uncompleted phone calls would have to be retained starting later, letting CSPs that can’t now retain such data a chance to update their systems. Most of the delegations also agreed on a 12-month data retention period, with member states allowed to cut the time as low as 6 months in exceptional circumstances.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
The Council agreement essentially adopts a compromise floated by the Presidency to try to wrap up the controversial framework decision this month. But the European Commission (EC) opposes the draft, which it says is founded on the wrong legal basis. This week, Information Society & Media Comr. Viviane Reding said the EC’s draft directive will be out soon, and that it will provide for contributions from the European Parliament as well as an assessment of CSPs’ data retention costs. The JHA Council also agreed that CSPs and judicial inquiry services should work together to clarify the costs related to carrying out the framework decision.
A 2-step approach to retention will be messy, said Axel Spies, a German attorney in Washington who represents the German Competitive Carriers Assn. How will VoIP be handled under the voice-data criterion? he asked. Moreover, the Council draft provides for a 12-month retention period, but it also allows states to order CSPs to hold data as long as 48 months or as little as 6 in some circumstances, creating massive uncertainty for CSPs in the 25 member states.
Even a 12-month retention period for telecom services alone is “clearly blown out of proportion,” Spies said. Mountains of data will pile up while it remains unclear what’s needed to prosecute criminal activities. Germany’s Telecom Act bars carriers from storing data more than 6 months to review their bills -- and then only if the customer doesn’t object. The framework decision would expand that rule significantly, Spies said, and stick carriers and providers with tremendous financial and technical costs.
And with CSPs paying for storing and providing data, law enforcement agencies will “shop around to obtain data like in a supermarket,” Spies said. In the end, “eavesdropping will be the standard, not the exception,” and police and prosecutors will use CSPs “as their deputy sheriffs.”
Last week, the American Chamber of Commerce to the EU (AmCham) said it opposes mandatory data retention as such and urged the EC and the Council to consider complementing any data retention obligations with data preservation. Data retention regulations must be both proportionate and harmonized, AmCham said, and must balance the investigative need for each data type against the cost of retention. “In our view, law enforcement officials, including the parties responsible for the draft framework decision, have failed to describe how their proposed retention obligations will or can increase investigative effectiveness, crime prevention or anti-terrorism efforts,” the group said in a May 30 position paper.
On June 7, the European Parliament will vote in plenary session on the report from its Legal Affairs committee on the draft framework decision. That report slammed that proposal for being disproportionate and failing to comply with the fundamental principle of presumption of innocence, European Digital Rights (EDRI) reported Thurs. It’s “widely expected that the report will be adopted with a large majority, thus sending a clear signal to Council and Commission that the Parliament is angry about its advisory role and wishes a much stronger public debate about the need, necessity and costs of data retention,” EDRI said.