The European Court of Justice (ECJ) has ruled against a German law that requires telecoms companies to retain customer data.
According to Security Week, Telekom Deutschland and SpaceNet took action in the German courts challenging a law that obliged telecoms firms to retain customers’ traffic and location data for several weeks.
The ECJ said, “EU law precludes the general and indiscriminate retention of traffic and location data.” Following the announcement, Germany’s Justice Minister – Marco Buschmann – vowed to overhaul the rules.
One of Germany’s top courts – the Federal Administrative Court – said there was a limited possibility of conclusions being drawn about people’s private lives from the data and sufficient safeguards were in place.
However, the ECJ said the German legislation – which required traffic data to be retained for 10 weeks – applies to a ‘very broad set’ of information, adding that it ‘may allow very precise conclusions to be drawn concerning the private lives of the persons whose data are retained… and, in particular, enable a profile of those persons to be established.’
The aim of the law was to prosecute serious criminal offences or prevent specific risks to national security, however, the court said that such measures were not permitted on a ‘preventive basis’.
However, it said that in cases where an EU state faces a “serious threat to national security” that is “genuine and present”, telecoms providers can be ordered to retain data.
Such an instruction must be subject to review and can only be in place for a period deemed necessary.
Buschmann hailed the announcement a ‘good day for civil rights’. He wrote on Twitter that ‘We will now, swiftly, and definitively, remove data retention without case from the law’.
Copyright © 2022 RegTech Analyst
Copyright © 2018 RegTech Analyst
