Archiv zur Kategorie English

Complaint on data retention kept secret [updated 24/02/10]

Even after the European Court of Justice has rejected Ireland’s action against the directive on data retention, the European Commission, the German and the Irish autorities are refusing to release Ireland’s reasoning to the Court.

To justify its decision, Ireland writes:

If a request for Ireland’s submission to the European Court of Justice was submitted to this Department, it would be refused as our Freedom of Information legislation clearly states that it does not apply to a record is created by the Office of the Attorney General other than an administrative record. Section 46(1) refers. Whilst in this case the record was created on behalf of the AG, it is still the view of the section that should we receive a similar FOI then Section 4.6(1) would apply. It would not be appropriate for the record to be released on foot of an FOI request in Germany if the same request would be refused in Ireland.

Therefore in view of the foregoing please advise your counterparts in Germany that our view is that the record should be refused.

The European Commission and German autorities have also refused to release the document under their freedom of information rules.

The content of Ireland’s application continues to be potentially useful as the German Federal Constitutional Court will hear several complaints against data retention in December. Earlier this year the Court decided it would review whether Europe transgresses the competences conferred to it by the member states. In its application to the European Court of Justice, Ireland presumably set out reasons for why this is the case with the controversion directive on data retention.

We are thus still looking for somebody who will succeed in getting hold of a copy of Ireland’s application to the ECJ (case number C‑301/06) via the EU, a member state or by other means.

Update of 12 Dec 2009:

The documents have now been published on the Internet:

Kommentieren

European Court to decide on traceability of communications [2nd update]

The European Court of Human Rights is to decide on the complaint of a victim of identity theft (Application Number 2872/02).

In 1999, an unidentified person published an advertisement for a homosexual relationship under the name of the applicant, a then 12 year old boy. The offender was not prosecuted because national law limited access to IP addresses to serious crime.

The applicant is complaining before the European Court of Human Rights that he had not had an effective remedy under national law to discover the identity of the perpetrator. On 27 June 2006 the Court ruled the complaint to be admissible as it raised serious issues of fact and law under the Convention and was not manifestly ill-founded.

An amicus curiae brief has now been submitted to the Court, pointing out that the outcome of the case could have far-reaching effects on the privacy of all European Internet users. A ruling requiring Contracting States to provide for the traceability of communications would have very serious consequences on user privacy.

According to the brief, freedom of expression on the Internet is protected under Article 10 of the Convention. The privacy of communications is protected under Article 8 of the Convention. „Considering the importance of those freedoms and the fact that their benefits by far outweigh the damage caused by their abuse, the Convention requires the creation of effective mechanisms for having illegal content on the Internet removed, but does not require traceability of Internet publishers or users.“

The brief is available on-line for more details. The Helsinki Foundation for Human Rights is already involved in the case.

See also:

Update of 28 October 2008:

The Court has rejected the brief mentioned above. A letter dated 20 October 2008 reads: „Having examined the matter in light of Rule 44 § 2 of the Rules of Court, the President of the Chamber has decided to refuse your request as it has not been submitted within the time allowed (Rule 44 § 2 (b)) and having regard to the state of the proceedings in the case.“

Rule 44 § 2 states:

(a) Once notice of an application has been given to the respondent Contracting Party under Rule 51 § 1 or Rule 54 § 2 (b), the President of the Chamber may, in the interests of the proper administration of justice, as provided in Article 36 § 2 of the Convention, invite, or grant leave to, any Contracting Party which is not a party to the proceedings, or any person concerned who is not the applicant, to submit written comments or, in exceptional cases, to take part in a hearing.

(b) Requests for leave for this purpose must be duly reasoned and submitted in writing in one of the official languages as provided in Rule 34 § 4 not later than twelve weeks after notice of the application has been given to the respondent Contracting Party. Another time limit may be fixed by the President of the Chamber for exceptional reasons.

Update of 4 November 2008:

Kommentieren

Data retention and the German constitution

Excerpt from an e-mail of 2007/08/08:

If the German parliament passes the bill on data retention later this year, we will file a complaint with the German Constitutional Court arguing that a blanket retention of the entire population’s communications data is grossly disproportionate and violates the German constitution. The German Constitutional Court has already ruled rather clearly that this is indeed the case.

However, the directive as part of the „aquis commun“ takes precedence even over the German constitution. So the only thing the Court can do is

a. order that the application of the German transposition act be suspended

b. apply for a preliminary ruling (Art. 234 TEC) by the ECJ on whether the DR directive violates human rights as enshrined in European law.

For as long as the directive is in force, the German Constitutional Court is unlikely to declare unconstitutional an act merely transposing European obligations into national law, as such a ruling would entail a major constitutional crisis in the EU.

However, if the ECJ declares the directive void (no matter on which grounds), the German Constitutional Court will be free to declare the German law unconstitutional as this would no longer conflict with European obligations.

By the way: Even if the directive was re-enacted as a framework decision, framework decisions do not have precedence over national constitutional law, according to our Constititional Court (Reason: no co-decision of the European Parliament). So even this scenario would be a major breakthrough. Anyway, a framework decision would require unanimity which did not and is not going to happen.

Kommentieren

Advocate General on access by IPR holders to communications data

Yesterday’s opinion by the European Court of Justice’s Advocate General states:

  1. Member states are not required by EC law to permit access by IPR
    holders to communications data for purposes of civil litigation.
  2. But they may, under EC law, do so on their own will.
  3. However, access may not be permitted in cases of minor infringements.
    Also any data transfer needs to involve government authorities.
  4. At any rate, data retained in accordance with the data retention
    directive may not be made available to IPR holders. This should cover
    all retained IP addresses as the Advocate General dismisses all other
    provisions that could be read as permitting the retention of
    communications data.

Kommentare (1)

Radio discussion on digital privacy and data retention

On Aug, 2, the Irish national radio broadcasted an interesting programme on data retention. Simply put, governments are trying to expand their reach into mobile phones, email records and web browsing histories. The 28-minute discussion ist available for download here (19.8 MB MP3 file).

reference

Kommentieren

Call on MEPs to vote against data retention

Sent the following e-mail to MEPs:

Dear …,

on Dec, 12th, the European Parliament will vote on a draft directive on data retention (COM(2005)0438). Whereas current EU legislation permits the storage of telephone and internet data only where it is needed for billing purposes, the new draft’s aim is to indiscriminately collect information on everybody’s communications and movements for law enforcement purposes.

Please note that systematically storing all communications data, as proposed, would create the most comprehensive records in history of the private and professional lives of all 450 million citizens in the EU.

It appears some MEPs are considering rushing through a „compromise deal“ with the Council (source). However, any kind of systematic collection of communications data

- is too invasive to personal privacy,

- obstructs professional activities (e.g. in medicine, law, religion, journalism) as well as political and commercial activities that rely on confidentiality,

- does not prevent terrorism or other types of crime and is easy for criminals to circumvent,

- violates the human right to privacy and control of personal information,

- is expensive and burdens the economy,

- discriminates against users of telephones, mobile phones and the Internet.

You can read more about these facts at http://www.jointdeclaration.com/notes.htm.

What makes sense is to introduce a common regime for the storage and preservation of communications data in specific cases (data preservation), as successfully practised in the U.S. and in a number of EU member states. To that end, the articles 14-20 of the European Convention on Cybercrime could be transposed into EU law. The European Parliament’s report on data retention (A6-0174/2005) rightly concludes: „It should be pointed out that the proposal’s objectives could be achieved simply by implementing the Council of Europe’s Convention on Cybercrime and improving crossborder cooperation in the area in question.“

On the other hand, for the reasons pointed out above, compelling providers to indiscriminately retain communications data on everybody would be disproportionate and excessive.

In the interest of your constituents and all citizens in Europe, I urge you and the … group to reject the proposed blanket collection of information on all citizens‘ communications.

Yours sincerely,

Kommentieren

Amendments to proposed directive on data retention

Sent the following e-mail to MEPs:

Dear …,

I welcome the amendments tabled by some of your colleagues in regard to the proposed directive on data retention (COM(2005)0438), with the aim of limiting its harmful effects on society. In fact, nearly all amendments (LIBE_PR(2005)364679, LIBE_AM(2005)364849, ITRE_PA(2005)364724, ITRE_AM(2005)364725) are aimed at restricting the scope of the proposed directive, arguing that there is no proof that a wider scope would be of substantial use, and arguing that a wider scope would be disproportionate.

However, it needs to be pointed out that these arguments apply to the entire project of mass data retention. There is no proof that mass data retention is of substantial use in fighting serious crime, beyond what traffic data is already available at present. Mass data retention is also clearly disproportionate, considering that 99% of those who would be affected by it are entirely innocent.

For the following reasons, the proposed directive should be rejected, rather than just limited in scope:

  • Once mass data retention has been implemented, its scope is bound to be continuously expanded over time. The proposed evaluation clause is of little value, as all practical experience shows that police powers are never abandoned once they have been introduced. The supposed benefit of mass data retention needs to be empirically examined and proven before implementing data retention.
  • The aftermaths of 9/11, of the Madrid bombings and of the terrorist attacks in London have shown that there is no need for a directive on data retention. Investigations could be conducted successfully without mandatory data retention in the US, Spain and the UK. Only two of the 25 EU member states (Ireland and Italy) have actually implemented mandatory mass data retention at present. There is no evidence that data retention is having any impact on crime levels in those states whatsoever.
  • Data retention is easy for criminals to circumvent, for example by using mobile phone cards that have been registered in the name of another person. Likewise, pay-as-you-go phones, Internet cafés or offshore e-mail accounts can be used to escape detection.
  • The President of the European Confederation of Police, Heinz Kiefer, announced in 2005 that „he is sceptical as to whether [data retention] will actually help criminal investigations. […] [I]t remains easy for criminals to avoid detection through fairly simple means, for example mobile phone cards can be purchased from foreign providers and frequently switched. ‚The result would be that a vast effort is made with little more effect on criminals and terrorists than to slightly irritate them‘“ (source).
  • Mass data retention would have a chilling effect on confidential political, professional and business communications and contacts (and thus the activities of political activists, of lawyers, of journalists, of businessmen engaged in confidential negotiations, etc.). It would also cost millions of euros, withdrawing taxpayer’s money from targeted security projects with an actual impact on crime.
  • Even with a narrow scope and strict safeguards, the proposed directive would create a precedent for the mass collection of information on all citizens on the off chance that the data may come useful at some point in the future. Following that reasoning, why not introduce George Orwell’s telescreens (video cameras) in every home, provided that access to the recordings is only granted in exceptional circumstances? Do we really want to live in a society where all our actions are recorded, all of our interactions are mapped; just in case that the information may be of use at some point in the future?

I hope that MEPs will not let themselves be pressured by the Council’s threat to go ahead with its own data retention project. There is no real risk of that happening because several member states are opposed to passing a framework decision (see here), and an unanimous vote in the Council would be required.

For the reasons set out above, I urge you to reject the proposed directive on data retention altogether and instead speak out for the implementation of international mechanisms for the targeted preservation of data relating to specific suspects. Only targeted and international mechanisms actually promise to be effective in fighting globalised crime and terrorism.

Yours sincerely,

Kommentieren

Data retention and human rights

Sent e-mail to EU data protection officer:

Dear Mr Hustinx,

the Commission is currently drafting a directive on the retention of telecommunications traffic data, and you will probably be asked to issue an opinion in regard to this proposal.

I have dealt with the matter of data retention academically and have written an essay on its proportionality, which I am attaching to this e-mail for your information. Let me briefly put forward the legal grounds for why, in my opinion, blanket data retention violates the ECHR, no matter for what duration the data is to be retained:

The citizens‘ right to privacy is not limited to requiring safeguards against misuse of data. Instead, disproportionate or excessively intrusive interferences are illegal altogether.

In the case of traffic data, it is disproportionate to retain everybody’s communications data just because a minuscule fraction of communications (about 0.0004% according to a German estimate) could be important to the authorities later on. Data retention cannot be expected to lower crime rates (there is no indication whatsoever to that effect). On the other hand, the end of anonymous telecommunications would seriously hamper confidential communications (e.g. communications with doctors, lawyers, journalists, political dissidents, …) because everybody would have to fear their communications being traced or exposed later on.

In all, the harm data retention would do is clearly disproportionate in comparison to its potential benefits. Therefore, data retention is incompatible with Article 8 of the European Convention on Human Rights. The disproportionality of data retention has been confirmed by the following: Art. 29 Data Protection Working Party, Opinion 5/2002, http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2002/wp64_en.pdf and Opinion 9/2004, http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp99_en.pdf; Covington & Burling, Memorandum of laws concerning the legality of data retention with regard to the rights guaranteed by the European Convention on Human Rights, dated 10/10/2003, http://www.statewatch.org/news/2003/oct/Data_Retention_Memo.pdf, 3; Recommendation of the European Parliament on the Strategy for Creating a Safer Information Society by Improving the Security of Information Infrastructures and Combating Computer-related Crime (2001/2070(COS)), dated 06/09/2001, document reference A5-0284/2001; Statement of the European Data Protection Commissioners, dated 11/09/2002, http://www.fipr.org/press/020911DataCommissioners.html.

I am pleased to find that in 2001, you agreed in saying: „The routine retention of traffic data beyond the requirements of billing purposes in order to permit possible access to law enforcement bodies is an improper invasion of the right to privacy guaranteed to individuals by Article 8 ECHR.“ (http://www.paris-conference-2001.org/fr/Contribution/hustinx_contrib.html)

You have probably read Mr Alvaro’s two papers on data retention (www2.europarl.eu.int/registre/commissions/libe/projet_rapport/2005/357618/LIBE_PR(2005)357618_EN.pdf and http://www.europarl.eu.int/meetdocs/2004_2009/documents/DT/553/553885/553885en.pdf). I agree with these papers in the following points:

  • data retention is neither appropriate nor necessary and is unreasonably harsh towards those concerned.
  • individuals involved in organised crime and terrorism will easily find a way to prevent their data from being traced.
  • data retention is incompatible with Article 8 of the European Convention on Human Rights.
  • data retention’s objectives could be achieved simply by implementing the Council of Europe’s Convention on Cybercrime and improving crossborder cooperation in the area in question.
  • the shortcomings in connection with data storage for a specified purpose should be eliminated, instead of introducing data retention, and cross-border cooperation should be improved.
  • the data storage/retention period should be limited, throughout Europe, to a maximum of six months.
  • the extent of data to be stored/retained should not go beyond what is commercially necessary.

Also, in case of prepaid products, anonymous communications must remain possible.

I hope that your opinion will follow the lines of the Article 29 Group’s and the European Parliament’s opinions in speaking out strongly and unambigously against any kind of blanket retention of traffic data. Your opinion can help stop the creation of unparalleled, massive databases on millions of innocent citizen’s communications and movements.

Yours sincerely,

Kommentieren

Legal analysis: Telecommunications data retention and human rights

This paper examines the compatibility of blanket traffic data retention with the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR). The essay was published in the European Law Journal in 2005.

View paper (11 pages)

Kommentieren

Contribution to Commission’s consultation on traffic data retention

This paper adresses questions of the need for a common data retention regime, the need for data retention and the legality of data retention.

View contribution to Commission’s consultation on traffic data retention (pdf document, 3 pages, 24 kb).

Kommentieren


 
Stoppt die Vorratsdatenspeicherung! Jetzt klicken & handeln!Willst du auch bei der Aktion teilnehmen? Hier findest du alle relevanten Infos und Materialien: