Look who's fallen foul of Europe's data retention rules. France and Germany
(2022/09/21)
- Reference: 1663741927
- News link: https://www.theregister.co.uk/2022/09/21/eu_data_retention/
- Source link:
On Tuesday, the European Court of Justice (ECJ) issued rulings that limit indiscriminate data retention in France and Germany.
The French case involves two suspects, VD and SR, accused of insider dealing, corruption, and money laundering, who challenged the legal basis cited by the French Financial Markets Authority (Autorité des marchés financiers) to obtain personal data from telephone calls that had been stored for a year in case the info might be useful for criminal investigators.
The ECJ, based in Luxembourg, [1]found [PDF] that the EU's Market Abuse Directive and the Market Abuse Regulation cannot ignore the EU's Directive on privacy and electronic communication.
[2]
Those rules, the ECJ said, "do not authorize the general and indiscriminate retention by operators providing electronic communications services of traffic data for a year from the date on which they were recorded for the purpose of combating market abuse offenses including insider dealing."
[3]
[4]
Separately, German telecom firms SpaceNet and Telekom Deutschland challenged the German legal requirement that companies retain traffic and location data for all customers' communications.
The ECJ [5]determined [PDF] that EU law disallows national legislation that requires indiscriminate retention of telecom traffic and location data to fight crime and protect public safety.
[6]
"EU law precludes national legislation which provides, on a preventative basis, for the purposes of combating serious crime and preventing serious threats to public security, for the general and indiscriminate retention of traffic and location data."
The German law's requirement that telecom firms retain traffic data for 10 weeks and location data for four weeks could allow "very precise conclusions to be drawn concerning the private lives of the persons whose data are retained," the ruling explains.
The ECJ ruling says that mandatory data retention in defense of national security is allowable when there is a "a serious threat to national security that is shown to be genuine and present or foreseeable." Any such accommodation, the court says, must be subject to judicial review and must be of limited duration related to a specific threat.
[7]Dear Europe, here again are the reasons why scanning devices for unlawful files is not going to fly
[8]NSO claims 'more than 5' EU states use Pegasus spyware
[9]UK signs deal to share police biometric database with US border guards
[10]Draft EU AI Act regulations could have a chilling effect on open source software
German Justice Minister Marco Buschmann voiced support for the ECJ's decision [11]via Twitter , calling it, "a good day for civil rights."
Matthias Pfau, co-founder of privacy-focused email service Tutanota, also applauded the ECJ's decision about the German data retention requirement.
[12]
"German governments have tried to pass data retention laws twice already," said Pfau in a [13]blog post . "Each time, the law has been successfully fought in court and declared unconstitutional. In a free democracy, data retention can never be a proportionate method to prosecute criminals as it puts the entire population under general suspicion."
Pfau argues that while law-abiding citizens tend to be indifferent to data retention because they believe they have nothing to hide, such sentiment ignores the possibility of oppressive regimes coming to power and using data stores to target political enemies.
Putting everyone under blanket surveillance and violating their fundamental right to privacy, he argues, is simply not proportional to the need to combat crime. And that, he notes, is the position taken by the ECJ. ®
Get our [14]Tech Resources
[1] https://curia.europa.eu/jcms/upload/docs/application/pdf/2022-09/cp220157en.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://curia.europa.eu/jcms/upload/docs/application/pdf/2022-09/cp220156en.pdf
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/06/02/eu_child_protection/
[8] https://www.theregister.com/2022/06/24/nso_customers_eu_pegasus/
[9] https://www.theregister.com/2022/07/04/uk_us_border_biometric_data/
[10] https://www.theregister.com/2022/09/11/in_brief_ai/
[11] https://twitter.com/phoenix_de/status/1572235387128389632
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://tutanota.com/blog/posts/data-retention/
[14] https://whitepapers.theregister.com/
The French case involves two suspects, VD and SR, accused of insider dealing, corruption, and money laundering, who challenged the legal basis cited by the French Financial Markets Authority (Autorité des marchés financiers) to obtain personal data from telephone calls that had been stored for a year in case the info might be useful for criminal investigators.
The ECJ, based in Luxembourg, [1]found [PDF] that the EU's Market Abuse Directive and the Market Abuse Regulation cannot ignore the EU's Directive on privacy and electronic communication.
[2]
Those rules, the ECJ said, "do not authorize the general and indiscriminate retention by operators providing electronic communications services of traffic data for a year from the date on which they were recorded for the purpose of combating market abuse offenses including insider dealing."
[3]
[4]
Separately, German telecom firms SpaceNet and Telekom Deutschland challenged the German legal requirement that companies retain traffic and location data for all customers' communications.
The ECJ [5]determined [PDF] that EU law disallows national legislation that requires indiscriminate retention of telecom traffic and location data to fight crime and protect public safety.
[6]
"EU law precludes national legislation which provides, on a preventative basis, for the purposes of combating serious crime and preventing serious threats to public security, for the general and indiscriminate retention of traffic and location data."
The German law's requirement that telecom firms retain traffic data for 10 weeks and location data for four weeks could allow "very precise conclusions to be drawn concerning the private lives of the persons whose data are retained," the ruling explains.
The ECJ ruling says that mandatory data retention in defense of national security is allowable when there is a "a serious threat to national security that is shown to be genuine and present or foreseeable." Any such accommodation, the court says, must be subject to judicial review and must be of limited duration related to a specific threat.
[7]Dear Europe, here again are the reasons why scanning devices for unlawful files is not going to fly
[8]NSO claims 'more than 5' EU states use Pegasus spyware
[9]UK signs deal to share police biometric database with US border guards
[10]Draft EU AI Act regulations could have a chilling effect on open source software
German Justice Minister Marco Buschmann voiced support for the ECJ's decision [11]via Twitter , calling it, "a good day for civil rights."
Matthias Pfau, co-founder of privacy-focused email service Tutanota, also applauded the ECJ's decision about the German data retention requirement.
[12]
"German governments have tried to pass data retention laws twice already," said Pfau in a [13]blog post . "Each time, the law has been successfully fought in court and declared unconstitutional. In a free democracy, data retention can never be a proportionate method to prosecute criminals as it puts the entire population under general suspicion."
Pfau argues that while law-abiding citizens tend to be indifferent to data retention because they believe they have nothing to hide, such sentiment ignores the possibility of oppressive regimes coming to power and using data stores to target political enemies.
Putting everyone under blanket surveillance and violating their fundamental right to privacy, he argues, is simply not proportional to the need to combat crime. And that, he notes, is the position taken by the ECJ. ®
Get our [14]Tech Resources
[1] https://curia.europa.eu/jcms/upload/docs/application/pdf/2022-09/cp220157en.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://curia.europa.eu/jcms/upload/docs/application/pdf/2022-09/cp220156en.pdf
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/06/02/eu_child_protection/
[8] https://www.theregister.com/2022/06/24/nso_customers_eu_pegasus/
[9] https://www.theregister.com/2022/07/04/uk_us_border_biometric_data/
[10] https://www.theregister.com/2022/09/11/in_brief_ai/
[11] https://twitter.com/phoenix_de/status/1572235387128389632
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyrguRwovgk2@iAY8@Bq8wAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://tutanota.com/blog/posts/data-retention/
[14] https://whitepapers.theregister.com/
.....and let's not forget FB......
Anonymous Coward
Link: https://theintercept.com/2022/09/07/facebook-personal-data-no-accountability/
......where "veteran...engineers" don't even know anything about the design or location of THE DATA FB ACTUALLY keeps!!
So.......if FB had to delete data after, say, a year.......................they couldn't do it!!!
Wonderful!!!
"ignores the possibility of oppressive regimes coming to power"
I believe they will happily ignore any rule but their own then...
And on the jokes side, let's note that a EU court based in a country noteworthy for being a tax haven and home of easy registration of many shady companies rules against investigations in shady businesses.
I'm all for restricting data gathering and retention - laws should also forbid the very kind of business practices Luxembourg (and other countries) allows to help criminals hide their tracks.