CJEU data retention ruling has implications for German telco law

Germany’s legislation had been introduced in 2017, allowing data collection and storage in order to effectively fight crime and terrorism. However, the CJEU has ruled that the law may only be applied in cases where there is a serious threat to national security.

"Businesses in Germany should wait for new regulations which were already announced today by the minister of justice in a reaction on the judgement," said Dr Nils Rauer, digital law expert at Pinsent Masons.

The CJEU's decision was handed down after Telekom Deutschland and internet service provider SpaceNet AG had challenged Germany's data retention law for breaching European rules. They challenged the obligation to retain traffic and location data relating to their customers for a period of several weeks, which was imposed on them by the German Law on Telecommunications (TKG). However, the storage of that data was, at least in Germany, not enforced by the respective authority (Bundesnetzagentur) since 2017 because of doubts as regards the compatibility with fundamental rights.

The German Federal Administrative Court dealing with the case asked the CJEU for advice. The CJEU found that "EU law precludes the general and indiscriminate retention of traffic and location data, except in the case of a serious threat to national security. However, in order to combat serious crime, the Member States may, in strict compliance with the principle of proportionality, provide for […] the targeted or expedited retention of such data and the general and indiscriminate retention of IP addresses."

With regard to the rules set out in the TKG, the CJEU found that the retention obligation "applies to a very broad set of traffic and location data". It said this set of traffic and location data, which is to be retained for several weeks, would allow very precise conclusions regarding the private lives of the people whose data was retained and would be sufficient to establish a profile of these people. Thus, the CJEU concluded that  "[…] the retention of and access to those data constitute separate interferences with the fundamental rights of the persons concerned, requiring a separate justification."

Ruth Maria Bousonville, data law expert at Pinsent Masons, said: "As is so often the case, the issue here is proportionality and the balancing of opposing interests, each of which is legitimate in its own right. It is not advisable to pass too simplistic a judgement on data retention. Rather, one must look closely at which data should be stored for what reason and for how long. Therefore, it is correct that the CJEU makes a 'gradual' assessment and gives a complex answer."

Nils Rauer also highlighted the importance of clarification by the German legislator. "The legal requirements can only be met if the balancing of fundamental rights is already adequately reflected in the law itself," he said.