The new measures are contained in a draft directive by the European Commission which aims to facilitate judicial cooperation in criminal matters by aligning Member States' legislation on the retention of data processed and stored by providers of telecommunications services. The Commission text would only cover the traffic and location data generated by telephony, SMS and Internet protocols and would not apply to the content of the information communicated: the judicial authorities would only be able to know who has contacted whom, when and from where.
Limited access to data
In the report drafted by Alexander Nuno ALVARO (ALDE, DE) and adopted by 33 votes in favour, 8 against and 5 abstentions, the Civil Liberties Committee approved a number of amendments to the Commission text to restrict the use of retained data and ensure that the future law fully respects the privacy of the telephone and internet users.
On the purpose of the directive, MEPs agree with the need to retain data for the detection, investigation and prosecution of crime, but only for “specified forms” of serious criminal offences (terrorism and organised crime), and not for the mere “prevention” of all kinds of crime. Committee members feel that the concept of prevention is too vague and could lead to abuse of the system from national authorities. They also deleted a paragraph from the Commission proposal authorising Member States to use data retention for “other related purposes”.
MEPs provide for data to be retained by the telecommunications companies for a minimum of 6 months and a maximum of 12, whereas the Council had suggested 12 to 24 months. The committee also added a provision for “effective, proportionate and dissuasive” penal sanctions for the companies who fail to store the data or misuse the retained information.
Only judicial authorities from an EU Member State should have access to the retained data from phone or internet providers, say MEPs. Furthermore, access would be granted to third countries such as the USA only by means of an international agreement. MEPs also insist that if national authorities from the EU which are responsible for the investigation of serious crimes in a Member State need to have access to concrete data they would need to get judicial authorisation. The Commission and the Council prefer to grant access to any competent authority determined by Member States. In addition, MEPs want access to retained data to be limited to specific purposes and to be granted on a case-by-case basis (the "push system"): the authorities would need to request each time to the telecom company the data related to a specific suspect, instead of having access granted to the whole database, as the Council prefers.
As for the type of data to be retained, MEPs support the registration of location data on successful calls, SMS and internet use, but prefer to leave up to the Member States the retention of data on unsuccessful calls. The problem is that telecom companies do not currently register lost calls for billing purposes and so to do this using new technologies would be expensive. Some Spanish members supported the Council position and would have preferred to include the retention of unsuccessful calls, since the terrorist attacks in Madrid were prosecuted thanks to the investigation of specific lost calls from mobile phones.
Who foots the bill?
Finally, MEPs argue that the telecom companies should be fully reimbursed by the Member States for all costs of retention, storage and transmission of data, including investment and operational costs. The Council does not agree with this and the Commission had only provided for the reimbursement of “demonstrated additional costs”.
