Something doesn't fit

The curious case of Angela Merkel and her EU data retention ideas

In the wake of last week’s terrorist attacks in Paris, German Chancellor Angela Merkel has called on the European Commission to deliver on its “promise” of a new EU-wide data retention directive to replace the one struck down by the EU’s highest court last year.

Merkel wants to implement this new directive into German law. There’s only one problem: the Commission doesn’t seem to have promised any such thing, at least not in public.

The Court of Justice of the European Union struck down the Data Retention Directive 2006 in April of last year because it was disproportionate and had insufficient safeguards. The directive had mandated that EU countries had to force telecommunications firms to retain metadata about their customers’ communications for between six and 24 months. Even before the CJEU scrapped it, Germany had already stopped implementing it on constitutional grounds.

On Thursday, according to a DPA report, Merkel told German parliamentarians:

Given the cross-party conviction among all interior ministers, both state-level and federal, that we need such minimum retention periods, we should insist that the revision of the directive promised by the EU Commission is quickly completed and then implemented into German law.

That DPA report claims “Brussels is drafting a follow-up that meets the judges’ standards,” but that’s not what the Commission says.

Last month, Netzpolitik reported that new Home Affairs Commissioner Dimitris Avramopoulos was planning to make such an announcement, and that his department was “now reflecting on the how, rather than the if.” However, after that report came out, the department backtracked, with a spokeswoman saying: “I meant that we are now reflecting on the how to take things forward, rather than if we need a new directive or not.”

Avramopoulos’s predecessor, Cecilia Malmström, had previously said she wouldn’t propose any new data retention directive until the EU’s new data protection rules had been finalized – something that now may not happen before 2016.

An EU source confirmed to me today that the Commission is taking its time evaluating the issues raised by the CJEU ruling, and intends to have an open dialog with the European Parliament, member states, civil society, law enforcement and data protection authorities. Only then will it be able to decide whether there is a need for a new proposal, the source said.

Technically, Merkel could try setting up a new German data protection law without a broader EU directive. However, her own justice minister has firmly rejected the mass surveillance idea, telling German television a few days ago: “With data retention, we also store all data from journalists and restrict freedom of the press. That does not fit together.”

She would also need to somehow make sure that her data retention law didn’t fall foul of the arguments the CJEU used to strike down the EU Data Retention Directive, advice from the EU Legal Service division suggests.