EU Home Affairs Commissioner Cecilia Malmström announced that the European Commission will propose amendments to the Data Retention Directive (2006/24/EC) following publication of an evaluation report on the Directive early next year. Under the Directive, Member States must ensure that providers of publicly available electronic communications services or public communications networks retain certain traffic data on communications for a period of six months to two years. Such data should ensure that authorities can determine the date, time, duration, source and destination of each communication, and the service and equipment used including the location of mobile devices.
Malmström said the Commission proposals could address a number of issues, including (i) harmonizing and possibly shortening retention periods; (ii) types of data retained; (iii) defining who may access the data and the procedures for doing so; and (iv) compensation for providers required to retain traffic data.
Speaking at a Commission conference on the Directive, Malmström strongly defended the necessity of the law. “[D]ata retention is here to stay, and for good reasons,” she said. “Access to telecommunications data are, at least in some cases, the only way of detecting and prosecuting serious crime.”
However, speaking at the same conference, European Data Protection Supervisor Peter Hustinx sharply criticized the Directive. “[R]etaining communication and location data of all persons in the EU, whenever they use the telephone or the internet, constitutes a huge interference with the right to privacy of all citizens,” he said. “The Directive is without doubt the most privacy invasive instrument ever adopted by the EU in terms of scale and the number of people it affects.”
Hustnix said that under European law retention of traffic data must be proportionate and “strictly necessary,” criteria that the Directive does not appear to meet. He also noted that the Directive has failed to harmonize Member State rules in this area, one of its key purposes.
“The evaluation we are now waiting for is the moment of truth for the Data Retention Directive,” Hustinx said. “Evidence is required that it really constitutes a necessary and proportionate measure. Without such evidence, the Directive should be withdrawn or replaced by an instrument which does meet the requirements of necessity and proportionality.”
While repeal of the Data Retention Directive is very unlikely, the statements of Malmström and Hustinx suggest that the review of the Data Retention Directive will be contentious, with data protection advocates pushing to significantly narrow the Directive while law enforcement authorities argue for its importance as a crime-fighting tool.