German data retention rules not compatible with EU law, says top court

The European Court of Justice (ECJ) has ruled that EU citizens' "traffic and location" data may not be stored except in cases of a "serious threat" to national security.

Data retention as a surveillance tool has been controversial in Germany for years

The European Court of Justice (ECJ) ruled Tuesday that data retention in Germany is not compatible with EU law.

The ECJ in Luxembourg said that internet and phone service providers may not store citizens' communications data without cause.

Limited data retention is only permissible under certain strict conditions, including fighting a "severe threat to national security."

German Justice Minister Marco Buschmann hailed the decision on Twitter saying it was "a good day for civil rights."

He said it clears the way for the introduction of new regulations. "Germany's data retention without cause is illegal. We will now swiftly and finally remove unjustified data retention from the law," Buschmann wrote. 

Buschmann favors what's being called a "quick-freeze" solution where data should be stored when there is a specific reason to do so and on the basis of a court order. 

Why the German regulations were controversial

Germany's Telecommunications Act required service providers to store their customers' telephone and internet data for four or ten weeks and to make it available, if necessary, to law enforcement authorities.

But Deutsche Telekom and internet service provider SpaceNet AG challenged it, arguing it breached EU rules.

Germany's Federal Administrative Court subsequently sought the advice of the ECJ which said such data retention can only be allowed under very strict conditions.

"The Court of Justice confirms that EU law precludes the general and indiscriminate retention of traffic and location data, except in the case of a serious threat to national security," the judges said.

ECJ makes similar ruling in French case 

On Tuesday the ECJ also ruled that a French law on mass data retention violates EU law.

"The general and indiscriminate retention of traffic data ... is not authorized, as a preventive measure, for the purpose of combating market abuse offences including insider dealing," the ECJ found.

EU member states have repeatedly argued at the ECJ that investigators need access to communications data.

In 2020 however the Luxembourg-based court ruled that storing data about citizens' communications, even if not the actual content itself, is generally illegal in the bloc.

lo/wmr (AFP, dpa, Reuters) 

While you're here: Every Tuesday, DW editors round up what is happening in German politics and society. You can sign up here for the weekly email newsletter Berlin Briefing.