ECJ: Data Retention vs. Quick Freeze – What Is Legal?

Oct 7, 2022 Benn-Ibler Rechtsanwälte

“I talked to Lisa on the phone for 30 minutes yesterday and was logged into the Munich-Pasing radio cell.” According to the European Court of Justice (ECJ), such suspicion-independent storage of network data (so-called data retention) by the state is not compatible with European law. It is therefore evident that the existing German regulation is unlawful.

In a German lawsuit, two providers had sued against their data retention obligation from 2015. Since 2017, regulations have been suspended due to legal uncertainties. In the course of appeal, the German Federal Administrative Court referred the question of the compatibility of data retention with EU law to the ECJ for a preliminary ruling.

In its ruling, the ECJ has now confirmed the incompatibility and disproportionality of unlimited preventative data retention under the German Telecommunications Act with EU law. The obligation of providers to retain location and traffic data as well as IP addresses allows precise conclusions to be drawn concerning individuals' private lives, such as their permanent places of residence or social relationships.

According to the Court, data may be stored generally and indiscriminately if there is a genuine and foreseeable threat to national security. However, it is necessary to obtain prior authorisation from a judge or an independent administrative body and to limit the time of storage to what is strictly necessary. In the fight against serious crime, such as child pornography, it is permissible, according to the Court, to store call data of specific suspects. Only the retention of IP addresses is permissible for a certain period of time without a specific reason. Furthermore, targeted preservation of data is permissible by order of the authorities, but limited to certain locations or categories of individuals, or the immediate securing of data (‘quick freeze’).

In Austria, the Constitutional Court had already declared the regulation of the Telecommunications Act on nationwide data retention unconstitutional as early as 2014. In 2017, a subsequent regulation was passed which only allows data storage if there is a specific cause. Accordingly, telecommunications providers may be ordered to store customer call data for up to 12 months but only if ordered to do so by the public prosecutor's office (‘quick freeze’). The ECJ has made it clear that this type of data retention is not contrary to EU law.

ECJ, C-793/19 (20 September 2022)