EU court rejects requirement to keep data of telecom users

http://www.reuters.com/article/2014/04/08/us-eu-data-ruling-idUSBREA370F020140408

by eis • 12 years ago

337 77 12 years ago

eis4• 12 years ago

Great news, though I guess politicians will find loop holes in this decision that will let them do it anways, albeit slightly differently.

I also wonder if this could have implications on drag net data collections by intelligence agencies.

xmpir2• 12 years ago

By now the ISPs/Telcos had to save the data. When the directive came into action the ISPs/Telcos protested as they had additional costs nobody covered. So loop holes will not help if the data is not stored in the first place.

Maakuth• 12 years ago

Unless there's some sort of "full feed copy" wiretap forwarding everything to a spy agency. Isn't this the way it's done in case of NSA and GCHQ, not by stealing archived traffic data off telecom servers?

rossng• 12 years ago

Most likely the individual countries will keep doing it - even if EU may no longer require them to.

kitd• 12 years ago

Yes, exactly.

Sadly, it has come to the point where I can't even imagine the UK government willingly give up this option.

JackpotDen• 12 years ago

This is a worry. At least some decent decisions are being made.

Does this stop forcing the ISP/telecoms from monitoring, or can they still monitor if they want?

eis4• 12 years ago

Can they do this though? It would be against EU law after all.

eik3_de• 12 years ago

EU Court of Justice press release:

english http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...

german http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...

Full verdict text:

english https://netzpolitik.org/wp-upload/c_293_c_594-1.pdf

german https://netzpolitik.org/wp-upload/C_0293_2012-DE-ARR.pdf

(Edit: direct link instead of scribd, thx eis. Added full verdict text.)

ctolsen3• 12 years ago

The Advocate General's opinion which is the basis for the ruling: http://curia.europa.eu/juris/document/document.jsf?text=&doc...

eis4• 12 years ago

Primary source: http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...

sentenza• 12 years ago

This decision has immediate consequences for us here in Germany. As our own constitutional court ruled that the law implementing the directive was invalid, we did not have a data retention law for some time now, since lawmakers wanted to wait out this decision.

So data retention is dead here in Germany and will fall in many other European countries. It is still possible that the court will allow for a severely restricted version of data retention and of course the police can access ISP billing logs if they have a court order, but blind mass-surveillance is a thing of the past.

Yay!

stfu• 12 years ago

Experience tells me that it would be foolish to assume a court decision can tame the data hungry beast that we call government.

skrause• 12 years ago

At least in Germany it wasn't the government collecting the data, they simply forced the ISPs to do so. And when the court ruled the law invalid the ISPs were more than happy to stop the data retention because it cost them a lot of money.

atmosx2• 12 years ago

Of course it can not. But making it illegal is a huge step towards the right direction. Now if the EU members abide to this ruling, it will make it very hard for government officials to get away with alleged privacy breaches.

arrrg2• 12 years ago

It most certainly can. This was already a contentious issue in Germany, maybe with a slight majority in the government in favor of it or at least people who support it in the right places to implement it, but it was far from an uncontroversial issue, even inside the government (i.e. the coalition parties). Germany was already the last country not to have data retention. (Of course also because the constitutional court ruled against it, but political pressure against it was responsible, too.)

The government could ram it through when there were no court objections quite yet but with them the dissenting voices inside government certainly get amplified. Also, while violating the constitution has been quite a sport for the government in Germany in recent years, court decisions that ruled laws unconstitutional have been respected.

I’m quite optimistic, but there obviously remains a danger of this being implemented some years down the line.

I have no idea what this means on the European level and for other individual countries, though.

Zigurd2• 12 years ago

While I'm not assuming Germany's system is perfect, it is very likely some governments operate more under the consent of the governed than the US government.

Ihmahr• 12 years ago

Well, lucky you. Here in the Netherlands the politicians have jumped on this law as an excuse to pass domestic laws for data retention. Although this excuse is now gone the laws are already in place and this court ruling might not mean that my government is obliged not to spy on me.

This ruling also doesn't necessarily prevent outsourcing of the spying to the USA.

Arnt• 12 years ago

The .nl law is presumably not permissible for the same reasons that the directive was, so a challenge should have good chances. Assuming that this ruling establishes a precedent valid within .nl, of course.

dan_bk• 12 years ago

blind mass-surveillance is a thing of the past.

Don't forget the fact that the NSA is everywhere, can intercept and store everything and is above the law (or at least: above the law as it should be (or be interpreted)).

Germany still allows the presence of several huge NSA surveillance sites. Having them inside the country certainly allows for easy tapping of German infrastructure.

fauigerzigerk• 12 years ago

The court found the DRG to be disproportionate, not well circumscribed and prone to abuse. But it also said that a more limited form of data retention is in the public interest.

So I'm pretty sure the debate isn't over. There will be some form of data retention everywhere.

id• 12 years ago

I think you are overly optimistic here. Data retention is still perfectly legal and I'm sure it will continue in many European countries. They are just no longer required to have a data retention law. It now depends on the lawmakers and the constitutional courts of the respective countries to take actions.

But I agree with you, in Germany data retention is now very unlikely to happen. For the countries that have implemented it already, it's going to be very hard to reverse, though.

ithkuil• 12 years ago

operational costs are high and grow with both user base and bandwidth.

haakon• 12 years ago

In Norway, politicians have promised that they want to go ahead with data retention regardless of the legality of the EU directive. It has been postponed multiple times due to cost and technical issues, but we'll probably get it eventually :-(

danbruc2• 12 years ago

Then just join the EU and the problem is solved.

widdershins• 12 years ago

This ruling just means that the law requiring ISPs to retain data is invalid. It doesn't ban national governments from passing their own laws to the same effect.

vidarh• 12 years ago

The only two parties in favour are Ap (labour party) and Høyre (conservatives) and in the latter there was substantial dissent. It only went through in the first place because the conservative leadership used the party whip in parliament.

Even though they still have a majority in parliament together, the conservatives are strengthened, and labour weakened, and a large part of the argumentation was that the EU "required" it. With this legal opinion I'd imagine at least some people in the labour party will consider opposing it, and more people in the conservative party - it's quite possible they'll find it hard to muster a majority to defend a challenge against the law.

frik2• 12 years ago

Related news:

NSA allegedly listening to everything in Austria

  As part of "Mystic" apparently the NSA monitored not only 
  all communications in Iraq, but also in Austria. The 
  basis for this was a secret treaty, by which the 
  government knew about it, writes an Austrian magazine. 
  [...]

http://translate.google.com/translate?sl=auto&tl=en&js=y&pre... [heise.de, news article from yesterday evening]

Austria has implemented the data retention law and officially stores "connection"-data for 6 months, apparently NSA stores "everything" and is working together with the Austrian telekom companies and government.

Zigurd2• 12 years ago

I predict that it will eventually come out that other European nations have similar secret treaties, and that their sovereignty is circumscribed by such treaties. This is why you hear complaints, but see no action. It will be interesting to see if any popular movements against such agreements arise.

tempodox2• 12 years ago

So, contrary to well-founded despair in the U.S. of A. & the U.K., there are still civilized regions on this planet. This gives me hope.

NicoJuicy4• 12 years ago

Actually, the U.K. is part of the EU, so this should affect them...

Tyrannosaurs3• 12 years ago

Yes, but if we don't already we'll soon have our own national law requiring this data be collected.

This government aren't at all liberal in this regard and would never have been wild about trusting the EU to do this (or anything else) in the first place.

atmosx2• 12 years ago

hm. This is important, extremely important. I'm very happy as an EU citizen for the direction the EU has been taking lately on technology matters.

I'm not fond of the EU, Brussels or anything, but there's a string of positive decisions in technology related matters that not many people seem to understand. That's good.

junto• 12 years ago

My assumption is that a UK individual, backed by an organisation such as Liberty will start the long road to the European Court of Human Rights, but first they need to take this to court in the UK (and lose to qualify).

NicoJuicy4• 12 years ago

I'm actually curious about which effects this ruling in the United Kingdom (Brittain).

Although they are subject to this regulations, considering their censorship the last years, i don't believe they are willing to coöperate on this (like they are not willing to drop the British pound in favor of the €)

Just a thought.

higherpurpose2• 12 years ago

I love EU! US, pay attention. This is how you do civil liberties. It seems EU is becoming the new beacon of democracy and civil liberties in the 21st century (if we ignore UK, which seems more interested in being another US state than an EU one, anyway, but without any rights to vote in the former).

weavejester• 12 years ago

There's a vocal anti-EU minority in the UK, but it's still a minority. It just seems larger than it actually is because it's loud, and to some extent act as swing votes (the Conservatives want to avoid losing too many votes to UKIP, for fear of Labour beating them in the next election).

Silhouette• 12 years ago

There's a vocal anti-EU minority in the UK, but it's still a minority.

That statement is true but potentially misleading.

In a poll earlier this month, as reported by the BBC[1], voting intentions if we had an in/out referendum immediately were 35% in, 32% out, 27% undecided, and 6% would not vote.

A different poll from back in December, mentioned in the same article, had a result of 32% in and 45% out, so it looks like the balance of opinion on this issue varies considerably over time, too.

(Both polls came from reputable sources, so I'm assuming that the sampling was done sensibly.)

In short, while it's true that the "anti-EU" group are a minority, the "pro-EU" group appear to be a minority of approximately the same size.

[1] http://www.bbc.co.uk/news/uk-politics-26892237

rmc• 12 years ago

(the Conservatives want to avoid losing too many votes to UKIP, for fear of Labour beating them in the next election).

If only there was some sort of voting system, where people could rank Alternatives so that the right wing voters wouldn't be split... If only...

Zak• 12 years ago

I love EU! US, pay attention. This is how you do civil liberties.

Note that it was the EU that implemented this data retention law in the first place. The US has no such data retention law and attempts to pass one have failed.

US law enforcement and intelligence agencies have done plenty of their own privacy invasion, of course, but there is substantial evidence that their counterparts in EU countries have done the same, sometimes conspiring with the US to do so.

tempodox2• 12 years ago

"The US has no such data retention law...": Well, NSA & colleagues do their very own data retention, outside of any law. That they violate the Constitution in doing so doesn't seem to be enough to have them stop.

JoachimS2• 12 years ago

Hard to say how the Swedish government will react. One ISP, Bahnhof immeadetly decided to stop collecting any data as specified by the Swedish DRD laws. And erase anything collected.

Press release in Swedish: https://www.bahnhof.se/press/press-releases/2014/04/08/efter...

eurleif4• 12 years ago

Are they literally collecting nothing now, not even enough to link IP addresses with subscriber identities? I love privacy as much as everyone else, but real crimes do happen online, and I wonder about the consequences.

tripzilch4• 12 years ago

Collecting and storing all that data indiscriminately is the wrong approach for preventing online crime. We don't chip and tag everyone 24/7 to prevent RL crime, either.

CharlesKCarillo• 12 years ago

Great news, though I guess politicians will find loop holes in this decision that will let them do it anyways, albeit slightly differently.

acd• 12 years ago

EU is run by a leader who is an ex Mao communist and the head banker is ex Goldman Sachs. I trust them not.

http://en.wikipedia.org/wiki/Jos%C3%A9_Manuel_Barroso http://en.wikipedia.org/wiki/Mario_Draghi

astrange• 12 years ago

That sounds like a reasonably trustworthy set of people if they're ideological opponents.

shmerl• 12 years ago

Great decision. I hope in US something similar will happen. But somehow I doubt that it will in the current sick climate.

DanBC• 12 years ago

One mildly interesting / infuriating pre-Snowden tidbit: the UK was having a national discussion about this kind of mass surveilance. GCHQ were asked for their response a few times. They replied saying things like "it's useful for some crime prevention; you need checks and balances" and so on. What they did 't say was "this isn't relevant to us, because the law already allows us to do it (also, we already are doing it)".

With hindsight I can see how carefully they crafted all their answers. It is very frustrating to me that journalists did not read the relevant laws (which clearly list exemptions for GCHQ) and did not question the relevant oversight bodies or GCHQ for more information.

I tend to agree that slurping and storing all content data or all metadata is probably the wrong approach.

It does make me wonder if the technology got released in any form, even as university research, back to the public. I can understand keeping bomb design documets secret, but better database and better data mining tech is less sensitive.

EU court rejects requirement to keep data of telecom users

Related Stories