In the opinion of an important EU expert, extensive data retention also violates EU law in the fight against terrorism.
Advocate General Manuel Campos Sánchez-Bordona of the European Court of Justice considers the storage of telephone and internet connection data to be lawful only to a very limited extent, as is clear from an opinion published in Luxembourg on Wednesday (Cases C-623/17, C-511/18 C- 512/18, C-520/18).
The expert thus supports an important ECJ judgment of 2016, according to which the unconditional storage of the connection data is not compatible with EU law. In his opinion, the current regulations in France, Great Britain and Belgium violate EU law. Courts from these countries asked the ECJ whether the EU rules in question should also be applied in connection with national security and in the fight against terrorism.
Campos Sánchez-Bordona suggests «limited and differentiated» storage of data for such cases. Only data that is essential for the effective prevention and control of crime and for national security should be allowed to be stored.
In addition, they should only be allowed to be backed up for a limited period. However, there should then be precise regulations. For example, a court or other independent body would have to check the release of the data beforehand, the person concerned had to be informed and regulations to prevent abuse had to be adopted.
In certain cases, however, Campos Sánchez-Bordona may be allowed a broad and general data retention obligation. This is possible in the event of an imminent threat or a dangerous exceptional situation that justifies an official declaration of a state of emergency in a country.
Data protection and network activists have been fighting data retention for years. They already rated the 2016 judgment as a great success for data protection and the fundamental right to privacy. The Association of the Internet Industry responded to the report on Wednesday with delight: "General data retention is always discriminatory and contradicts any presumption of innocence. From the total of the stored data, very precise conclusions can be drawn about the private life of people, »said CEO Oliver Süme. "All attempts at resuscitation will fail."
Last year, however, the EU countries instructed the EU Commission to explore the options for data retention despite the ECJ ruling of 2016. According to a decision by the Justice Ministers, the Brussels authority is to submit a study for possible solutions and possible laws.