[Blog] EU Commissioner refuses to consider making blanket data retention optional (26 Apr 2012)

EU Commissioner Cecilia Malmström claims that the EU was unable to amend the Data Retention Directive 2006/24/EC to no longer make blanket communications data retention mandatory throughout the EU, but to regulate and restrict national retention schemes where such exist only.

The Commission is currently carrying out an impact assessment on the future options with regard to the controversial Data Retention Directive 2006/24 which, according to the European Data Protection Supervisor, "is without doubt the most privacy invasive instrument ever adopted by the EU in terms of scale and the number of people it affects".

A Commission proposal to amend the Data Retention Directive is to be presented in July 2012.

The civil society proposal of an EU-wide ban on blanket retention legislation in favour of a system of expedited preservation and targeted collection of traffic data is apparently not among the options to be considered because of legal and political doubts the Commission is having as to putting it into practise.

What is more, even the compromise proposal to no longer make blanket retention mandatory and regulate it only where such schemes are enacted nationally is not to be evaluated. The reason given for this is disturbing: Apparently the Commission's legal service claims in an opinion that the proposal is illegal because EU law does not permit clauses allowing Member States to opt out of single market legislation.

The Commissioner now states publicly:

With regard to the question of the Honourable Member on the possibility of having an optional application of the Data Retention Directive, it needs to be underlined that this is not possible for the following reasons:

EC law is equally applicable in all Member States in line with the principles of equal treatment and uniform application. Opt-outs for individual Member States are only possible when they are foreseen in primary law. In line with current Treaty provisions, these are not applicable for the data retention directive. Given that the data retention directive has to be applied in the entire EU, any optional retention would reintroduce obstacles to the internal market.

In absence of exemptions flowing directly form primary law, secondary law can foresee derogations in favour of the Member State in question subject to specific objectively different circumstances. The Commission is not aware of any such objectively different circumstances which might justify derogation from this principle in the case of data retention. The fact that some Member States may have had constitutional, legal or political difficulties in transposing the directive could not constitute a justification for such a derogation. On the contrary, to render optional any measure with obvious implications for the right to data protection and privacy would deprive the citizen of common minimum standards for those fundamental rights across the EU.

While I agree that Member States cannot be given the choice to opt in or out of the data retention directive (meaning, for example, that Ireland could opt out and have data retained for more that two years). However this is not what the proposal suggests. Under the "compromise proposal" the Data Retention Directive is is to reserve to national Parliaments and Constitutional Courts the decision of whether they wish to have communications data retained on the entire population without cause. Only where such national blanket retention requirements are put in place, they are to be (mandatorily) regulated and limited by the EU data retention directive.

In my opinion it is clear that such "alternative harmonisation" is legal. In fact it is being done all the time. Article 15 of the ePrivacy Directive 2002/58/EC made it optional for Member States to provide for the retention of traffic data in national law, while imposing certain mandatory standards if they do. There are other examples of EU law allowing Member States to choose between enacting a measure within certain limits and abstaining (e.g. Article 1 2003/641/EC, Article 25 2011/92/EU, Article 9 pp. 2006/123/EC, Article 5 2001/29/EC).

It is absurd to claim that mandatory blanket retention of all communications data created "common minimum standards for those fundamental rights across the EU". What the current directive creates is a common maximum erosion of fundamental rights across the EU. In the fashion of the Commission's arguments, one could say that re-introducing the penalty of death by Guillotine would create a "common minimum standard" for the right to life.

We should not allow the Commission to use non-existing legal constraints for not even having to even consider and evaluate the option of abolishing mandatory blanket communications data retention while limiting it where it is in place. It is not good enough to examine the option of repealing the directive altogether, as this option is easy to dismiss for a lack of harmonisation and data protection it would bring about (for example, it would allow Member States to even go beyond the few limits the Data Retention Directive sets).

In order to overcome the false legal analysis that is impeding a complete impact assessment, I seek your help on the following point: Have you got any ideas on how we could counter the false legal service's opinion with a correct one? Are there any institutions or EU law experts that you can ask for a legal analysis?

Blog post by Patrick - Article does not necessarily reflect AK Vorrat's opinion.