The European Court of Justice remains true to itself: In its ninth (!) decision on the subject, it also rejected general data retention without cause. With their line of not first preventing any misuse of stored retained data, but already subjecting the storage as such to strict requirements, the judges are opposed to the European Commission and to the clear majority of the member states, who have repeatedly and in vain opposed the Running to Luxembourg specifications.
The balancing of data protection and security interests is ultimately a political question that is obviously assessed differently than the 27 European judges, not only in countries such as Poland or Hungary, but also in France, Germany and many other democracies that are not suspected of being ruled by the rule of law.
The debate about the democratic legitimacy of such legislation is of course drowned out by the jubilation of the internet community, and the Federal Minister of Justice Marco Buschmann will see his intention strengthened to delete the German law on data retention, which is not applied anyway. Admittedly, there is no reason to do so even after today’s judgment: the hurdles set up by the ECJ are high, but by no means insurmountable.
In the case of the IP addresses that are particularly relevant for the prosecution of child pornography, general and indiscriminate storage is permissible according to the judgement. Narrower limits apply to location data, but storage is also possible here if it is limited geographically or according to other criteria. And in the event of a threat to national security, which is probably rare in practice, pretty much anything goes anyway.
The German legislature should use this leeway instead of relying on a quick freeze procedure, as suggested by Buschmann, in which nothing has to be stored initially and the Internet providers can only be obliged by court order to keep their data, which at best goes back a few days to secure databases.
This proposal is as old as the debate about data retention itself, and it is not for nothing that it is considered a net policy shopkeeper: According to a report by “Spiegel Online” via a survey by the EU Commission, it was only implemented in one European member state – and is considered there as ” not successful”.
