The response of German politics regarding the ECJ’s decision on data retention in Germany

On September 20, 2022, Germany was condemned by the European Court of Justice (ECJ, judgment of September 20, 2022, Cases C-793/19, C-793/19, C-794/19). The subject of the ruling was the laws on data retention.

The proceedings to which the ECJ’s ruling of September 20, 2022 refers have only a short procedural history: The Cologne Administrative Court had ruled in the first instance that the service providers SpaceNet and Telekom Deutschland were not obliged to retain data relating to their customers’ telecommunications. The Federal Network Agency appealed to the Federal Administrative Court in Leipzig. The court suspended the proceedings and referred the decisive question of whether data retention under German law is compatible with European Union law to the ECJ itself. The ECJ’s decision was in favor of Germany – which is not surprising, because:

Back in 2016, the ECJ ruled on the subject of data retention and determined that unlimited storage of location and telephone data violates the Charter of Fundamental Rights of the European Union. In its decision against Germany, the ECJ remains true to this line and declares the German law on data retention to be contrary to the EU. The rules that impose preventive, or stock, obligations to store data that may at some point be necessary to fight crime or prevent threats to public safety are not compatible with Union law, the ECJ said. The ECJ also considers the indiscriminate storage of traffic and location data in advance not to be in compliance with EU law.

The Federal Ministry of Justice, in order to correct its mistake, has already prepared a draft bill. This simply repeals the provisions in Section 100g (2) of the German Code of Criminal Procedure (StPO) and Sections 175 to 181 of the German Telecommunications Act (TKG). Section 100g (2) of the Code of Criminal Procedure regulated the collection of traffic data. Sections 175 to 181 of the TKG govern, among other things, the obligations to store traffic data, the use of this data, and the guarantee of data security.

The new invention of the Ministry of Justice, i.e. the substitute for the deleted norms: the “investigative instrument of a security order”. The purpose of this instrument is to be able to order the securing of data in the case of significant criminal offenses, if the collection of the data can help to establish the facts of the case or the whereabouts of a defendant.

Thus, the data should not be able to be ordered on anyone, but only on a defendant – this is the first protective mechanism of the new norms. An accused person in the sense of criminal procedure only exists when there is a suspicion of a crime against a person and the investigating authorities initiate a formal investigation against him or her. A double reservation of rights for judges is also to be standardized as a further instrument of protection. First, the judge is to order the “freezing” of the data. This means that data already collected by providers for business reasons, as well as data accruing from the time of the court order, may no longer be deleted. Another judicial decision is supposed to be able to “thaw” this “frozen” data in turn: because only after the second judicial decision can the law enforcement authorities collect and evaluate the data for a certain period of time. Moreover, this should only be able to be ordered in the case of significant criminal offences.

Such regulations are in line with the case law of the ECJ, according to the ministry in the draft bill. The provisions of the TKG, but also of the TKÜG, BPolG, BSI-Gesetz, BKAG, ZFdG, EGStPO, JVEG are also to be amended in accordance with the ECJ’s decision. In its decision, the ECJ established clear criteria that must be fulfilled in order for data storage to be lawful. The regulations are to be adapted to this.

In its decision, the ECJ established clear criteria that must be fulfilled in order for data storage to be lawful. However, there is currently no agreement on the many changes – so it remains to be seen which regulations and when they will come into force.