The European Union’s top court has ruled that Germany’s data retention rules breach European laws, handing a blow to member states that rely on blanket data collecting to combat crime and protect national security.

According to the Court of Justice of the European Union (CJEU), the legislation only applies where there is a severe threat to national security, stated in precise terms. The decision follows catastrophic attacks by Islamist extremists in France, Belgium and the United Kingdom in recent years.

Governments claim that access to data, particularly data acquired by telecom carriers, can aid in the prevention of such tragedies, whereas operators and civil rights advocates criticize such exposure.

How the case came about

The newest lawsuit arose when Deutsche Telekom affiliate Telekom Deutschland and internet service provider SpaceNet argued that Germany’s data retention statute violated EU regulations.

The German court then sought assistance from Europe’s highest court (CJEU), which stated that such data retention applies only under particular conditions. The CJEU reaffirmed that EU legislation prohibits broad and indiscriminate surveillance of traffic and location data unless there is a substantial threat to national security.

However, the judges added that, to combat severe crime member states may, in rigorous accordance with the principle of proportionality, allow the targeted storage of such data, as well as broad and arbitrary retention of IP addresses.

It started with two people

According to eco, an industry association that supports SpaceNet, Germany’s broad data storage requirement costs the industry millions of dollars.

In another instance, the CJEU ruled that financial market authorities cannot invoke EU rules to force telecom providers to send over the personal information of traders suspected of violating insider trading and market manipulation regulations.

Two individuals initiated the case after the French Financial Markets Authority used French laws to request that telecom providers send personal data from phone calls made by the two.

Tip: EU proposes supply chain emergency powers, leaves businesses worried