Berlin: A long and bitter argument over how long the state may keep records of who contacts whom online is flaring again, as European investigators press to rebuild a bloc-wide data retention regime that the continent’s highest court spent a decade dismantling.
The fight is old. Successive rulings from the Court of Justice struck down sweeping national laws that obliged telecoms firms to store everyone’s communications metadata, the who, when and where of calls and messages rather than their content, on the grounds that indiscriminate retention of an entire population’s digital traces violated fundamental rights. Germany, where the practice carries the heavy historical name Vorratsdatenspeicherung, has been one of the most contested battlegrounds, its retention rules repeatedly challenged and curtailed.
Yet the court has lately drawn a subtler line. In a closely watched judgment its full bench held that internet protocol addresses, the numerical labels that identify devices online, count as traffic data but differ from richer location and communication records. General and indiscriminate retention of IP addresses, the judges reasoned, need not amount to a serious interference with rights provided the safeguards are adequate, and so may be kept and linked to a person’s civil identity to let police pursue offences, including relatively minor online crimes such as copyright infringement. The ruling cracked open a door earlier decisions had seemed to bolt shut.
Law enforcement has been quick to lean on it. The Commission’s home affairs side, under Commissioner Magnus Brunner, has been working to harmonise the fractured national rules that govern how providers store metadata, and a formal call for evidence launched last year canvassed support for reviving a mandatory framework across the bloc. A legislative proposal to knit the patchwork together is expected this year, with officials arguing that investigators chasing serious crime, online abuse and terrorism are hamstrung when data vanishes before warrants can reach it and when rules differ wildly from one member state to the next.
Civil liberties groups see the revival as a familiar overreach in new clothing. Blanket retention, they argue, treats every citizen as a suspect, chills free expression and creates honeypots of sensitive data vulnerable to breach and abuse, and they warn that the IP-address ruling will be stretched far beyond its careful wording to justify storing far more. The history of the file, they note, is one of governments legislating, courts striking down and governments legislating again, each round testing how much surveillance the rights framework will tolerate.
The coming proposal will force that tension into the open once more. Lawmakers must square the court’s insistence on proportionality and genuine safeguards with the operational demands of police forces who say the digital trail goes cold without retention. Draft a regime too broad and it invites another judicial defeat; draft one too narrow and investigators dismiss it as useless. Two decades into the argument, Europe has yet to find the line that satisfies both the constable and the constitution, and the next attempt is now taking shape.
