EU court rules against German data collection law

A German law requiring telecoms companies to retain customer data is a breach of EU legislation, a European court ruled Tuesday, prompting the justice minister to vow an overhaul of the rules.

Justice Minister Marco Buschmann (FDP) speaks in the Bundestag.
Justice Minister Marco Buschmann (FDP) speaks in the Bundestag. Photo: picture alliance/dpa | Wolfgang Kumm

Firms Telekom Deutschland and SpaceNet took action in the German courts challenging the law that obliged telecoms firms to retain customers’ traffic and location data for several weeks to fight serious crime.

The case headed to the European Court of Justice (ECJ) in Luxembourg, which ruled against the German legislation.

“EU law precludes the general and indiscriminate retention of traffic and location data,” the court said in a statement, confirming its previous judgements on the issue.

The Federal Administrative Court, one of Germany’s top courts, had argued there was a limited possibility of conclusions being drawn about people’s private lives from the data, and sufficient safeguards were in place.

But the ECJ said the German legislation – which required traffic data to be retained for 10 weeks, and location for four – applies to a “very broad set” of information.

It “may allow very precise conclusions to be drawn concerning the private lives of the persons whose data are retained… and, in particular, enable a profile of those persons to be established.”

The stated aim of the law was to prosecute serious criminal offences or hinder specific risks to national security, but the court said that such measures were not permitted on a “preventative basis”.

However, it said that in cases where an EU state faces a “serious threat to national security” that is “genuine and present”, telecoms providers can be ordered to retain data.

Such an instruction must be subject to review and can only be in place for a period deemed necessary.

Following the announcement, Justice Minister Marco Buschmann hailed a “good day for civil rights”.

“We will now, swiftly and definitively, remove data retention without cause from the law,” the minister wrote on Twitter.

Data privacy is a sensitive issue in Germany, where people faced mass surveillance under the Nazi regime as well as in communist East Germany.

Buschmann is from the liberal FDP party, which has made data protection a key plank of its policies.

Interior Minister Nancy Faeser – from Chancellor Olaf Scholz’s Social Democratic Party – said she did not “want to have old debates, but act pragmatically”.

Nevertheless, she added the court ruling still gave the government space to implement “what is permissible and urgently necessary”.

Faeser noted the ruling still allowed measures such as the storing of IP addresses as part of efforts to fight crime, which she said could help in combating sexual violence against children.

Related Topics


Member comments

Log in here to leave a comment.
Become a Member to leave a comment.


How German authorities are cracking down on Google

Germany's antitrust regulator on Wednesday criticised the way Google handles users' data and threatened action against the US tech giant.

How German authorities are cracking down on Google

Data collected by Google was used to “create very detailed user profiles which the company can exploit for advertising and other purposes”, the Federal Cartel Authority said.

Based on a preliminary assessment, the watchdog determined that users were not given sufficient clarity on the “far-reaching processing of their data across services” by the tech company.

“General and indiscriminate data retention…  is not permissible” without giving users choice, the watchdog said.

The Federal Cartel Authority was therefore “currently planning to oblige the company to change the choices offered”, it said, adding that it expected to issue its final decision this year.

READ ALSO: Germany asks EU to rein in Twitter after ‘arbitrary’ bans by CEO Musk

“Google’s business model relies heavily on the processing of user data,” said the authority’s chief Andreas Mundt.

The digital giant had “access to relevant data gathered from a large number of different services” which meant it enjoyed “a strategic advantage over other companies”, Mundt said in a statement.

Google said in a statement it would continue its “constructive dialogue” with the Authority “in order to address their concerns”.

The warning comes after Google was classified as a company of “paramount significance across markets” in 2021.

The designation gives Germany’s regulators the option to intervene earlier against potentially uncompetitive practices by huge digital companies.

Wielding the new legislation, the watchdog has also opened probes into US tech giants such as Amazon and Facebook.

At the end of last year, the regulator shelved a separate investigation into Google’s News Showcase service, after the firm made “important adjustments” to ease competition concerns.

Big tech companies have been facing increasing scrutiny around the globe over their dominant positions as well as their tax practices.   

In July 2022, the European Parliament adopted the Digital Markets Act to curb the market dominance of Big Tech, with violators facing fines of up to 10 percent of their annual global sales.