Wed, 12 March 2015: 'Judge sweeps data retention obligation off the table. Too few privacy safeguards.'

“Someone steals a bicycle. To prove it, the police could request the suspect's historical call records from the provider. Those companies were required to keep records for a year of who calls who, for how long and from what location.

Until the judge yesterday in summary proceedings dismissed that retention obligation. Because it involves storing data of all Dutch citizens, including people who are not suspected of anything, high requirements must be set as to when the police may look into the database. These are insufficient, the court found. (...)

(...) Because although the state can say that it only requests telecom data for more serious offences, it is possible under the Data Retention Act to inspect the information of a bicycle thief. This is because inspection is allowed for crimes punishable by a prison sentence of at least four years. In that case, it is the public prosecutor who decides when to use the tool, which, according to the court, is not an independent test.

The judge acknowledged that the ruling could have "far-reaching consequences" for the detection of criminals. Yet the police are not completely empty-handed. For instance, because of billing, providers store their customers' call history anyway. KPN, for instance, for six months. The police can still request that data.

Only a ready-made database guaranteed to contain the historical calling and internet behaviour of all Dutch citizens, is no longer available. Following the court ruling, several providers have already stopped implementing the retention obligation.

What about in Europe?

The summary proceedings at the court in The Hague follow a ruling by the European Court of Justice. That declared the European directive underlying the data retention obligation invalid last April. However, former minister of security and justice Ivo Opstelten refused to suspend the data retention obligation in the Netherlands.

Several organisations, including Privacy First, the Dutch Association of Criminal Lawyers and journalists' union NVJ, therefore enforced it through the courts.

Several other European member states also took action. In 17 countries, the retention obligation has been suspended or proceedings are ongoing, including in Sweden, Slovenia, Austria and Denmark. In Germany, the retention obligation had never been introduced. (...)"

Source: Wed 12 March 2015, p. 5.