The Legality of the Data Retention Directive in Light of the Fundamental Rights to Privacy and Data Protection

Abstract:

The EU Data Retention Directive (2006/24/EC) provides an obligation for providers of publicly available electronic communications services and of public communications networks to retain traffic and location data for six months up to two years for the purpose of the investigation, detection, and prosecution of serious crime. Considering potential uses and misuses of retained data such as traffic analysis, social network analysis, and data mining, this paper examines the suitability, necessity, and proportionality of the interference with the fundamental rights to privacy and data protection as guaranteed by the Charter of Fundamental Rights of the European Union.

1. Introduction

The Data Retention Directive [2] (hereinafter the Directive) provides an obligation for providers of publicly available electronic communications services and for providers of public communications networks to retain traffic and location data for six months up to two years for the purpose of the investigation, detection, and prosecution of serious crime. This marks a departure from EU data protection principles under Directive 95/46 [3] (hereinafter Data Protection Directive) and Directive 2002/58 [4] (hereinafter ePrivacy Directive).

After the acts of terrorism committed in 2001 on 9/11, in 2004 in Madrid, and in 2005 in London, the political climate - at least to some extent based on an emotionally perceived high level of risk - allowed for (or even demanded) drastic measures to protect security. [5] The Directive certainly fits the bill. It was officially proposed by the Commission in September 2005 [6] after the European Council had expressed an interest in such a measure following the Madrid terrorist bombings, [7] and had emphasized its priority following the London terrorist bombings. [8]

The first legal challenge to the Directive was a formalistic one. In Ireland v. Council and Parliament, [9] Ireland asked the European Court of Justice (ECJ) to annul the Directive on the grounds that it was not adopted on an appropriate legal basis. The Directive had been adopted pursuant to European Community (EC) Treaty [10] article 95 (now TFEU [11] article 114), which requires a legal act to have as its 'centre of gravity' the approximation of national laws to benefit the functioning of the internal market. [12] Ireland contended that the main or predominant purpose of the Directive was, however, to facilitate the investigation, detection, and prosecution of serious crime, including terrorism. A legal act with such a purpose, Ireland argued, could only have been adopted under EU Treaty [13] Title VI ('police and judicial cooperation in criminal matters'). The ECJ declined to follow, upholding the Directive. [14] The Court held that the substantive content of the Directive 'is directed essentially at the activities of service providers in the relevant sector of the internal market' [15] and that '[t]hose matters, which fall, in principle, within the area covered by Title VI of the EU Treaty, have been excluded from the [Directive].' [16]

While the ECJ has authoritatively answered the question of whether the legal basis is appropriate, the Court has not yet addressed another - and arguably more important-issue: whether the Directive violates EU fundamental rights, in particular the fundamental right to privacy and the fundamental right to data protection as guaranteed by article 7 and article 8 of the Charter of Fundamental Rights of the European Union [17] (hereinafter Charter) which entered into force with the adoption of the Lisbon Treaty [18] on December 1, 2009. [19]

This article's contribution is twofold: First, it will provide a technically founded analysis of the scope of the Directive. In the few instances when such a technical analysis was provided by prior research, it was exclusively focused on Internet-related traffic data. [20] Second, the article will provide an assessment of the legality of the Directive in light of the Charter.

The following chapters 2 to 6 will first analyze the substance of the Directive. Chapter 7 will then discuss whether the Directive meets the requirements under article 7 and article 8 of the Charter.

2. The Personal Scope of the Obligation to Retain Data

Article 3 states that only 'providers of publicly available electronic communications services' and providers of 'public communications networks' are obligated to retain any data. Article 2(1) refers to the definitions provided by Parliament and Council Directive 2002/21 (hereinafter Framework Directive). [21]

Framework Directive article 2(c) defines the term 'electronic communications service' as 'a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks.' '[S]ervices providing, or exercising editorial control over, content transmitted using electronic communications networks and services' are explicitly excluded. In the context of the Directive, the most important question is whether only Internet access providers or also other providers (like mail service providers) provide an 'electronic communications service.' Framework Directive article 2(c) requires that the service wholly or mainly consist in 'the conveyance of signals on electronic communications networks.' With respect to the Internet this definition only matches Internet access providers. Their service consists in the 'conveyance of signals' without any editorial control. Technically speaking, they provide services on the first three layers of the OSI Model [22]: the physical layer, the data link layer, and the network layer. [23]

Services provided over the Internet (as opposed to service providing access to the Internet) do not mainly consist 'in the conveyance of signals'- that is something left to Internet access providers. Services provided over the Internet use the last (or topmost) four layers of the OSI networking model: the application layer, the presentation layer, the session layer, and the transport layer. [24] They do not concern themselves with the first three layers of the OSI Model, i.e. with the 'conveyance of signals.'

Recital 10 of the Framework Directive seems to contradict Framework Directive article 2(c) when it states that '[v]oice telephony and electronic mail conveyance services are covered by this Directive.' However, the term 'conveyance,' as it is used in recital 10 of the Framework Directive, is to be understood in the same context as it is used in Framework Directive article 2(c). The person conveying an email or a signal is not the one who initiates its transmission but rather the one who actually performs the conveyance. It is not the mail service provider but rather its Internet access provider that conveys an e-mail (using signals on electronic communications networks).

Mail service providers provide their service over the Internet and are therefore not 'providers of publicly available electronic communications services' as referred to in article 3 of the Directive.

A similar question is raised with regard to providers of Internet telephony services. [25] Here it is necessary to differentiate between a Voice over Internet Protocol (VoIP) service provided entirely over the Internet and a service that also allows its users to call into or receive calls from the mobile or fixed telephone network. [26] In the former case, the VoIP provider entirely relies on Internet access providers to convey the actual signals on the electronic communications network. In the latter case, the VoIP provider's service does consist of conveying signals on the telephone network. From a functional perspective, an Internet telephony provider acts as an Internet access provider when a call is placed from the telephone network to a VoIP user and as a telephone network access provider when a VoIP user places a call into the telephone network. Therefore only VoIP providers that allow access to or from the telephone network can be considered 'providers of publicly available electronic communications services' as referred to by article 3 of the Directive.

The second kind of providers named in article 3 are providers of 'public communications networks.' Framework Directive article 2(d) defines the term 'public communications network' as 'an electronic communications network used wholly or mainly for the provision of publicly available electronic communications services.' Framework Directive article 2(a) further defines the term 'electronic communications network' as 'transmission systems and, where applicable, switching or routing equipment and other resources which permit the conveyance of signals […] by […] electromagnetic means […].' A provider of 'public communications networks' as referred to by article 3 therefore is the entity that provides the network infrastructure that permits the conveyance of signals.

3. Transposition of the Directive

Pursuant to article 15(1), Member States had to transpose the Directive by September 15, 2007. According to article 15(3), Member States had the option of postponing the Directive's transposition until March 15, 2009 but only with regard to Internet access, Internet e‑mail, and Internet telephony. [27] Sixteen Member States chose to do so.

Indicative of the controversial nature of the Directive, many Member States faced domestic obstacles in the process of transposing the Directive into national law. The European Commission chose to bring infringement actions against Greece, [28] the Netherlands, [29] Sweden, [30] and Austria. [31] Sweden, despite having lost its case before the ECJ, still refuses to transpose the Directive, citing human rights concerns. [32] In the case against Austria, which was the only Member State to formally raise the issue of whether the Directive conforms to fundamental rights, the ECJ held that a Member State cannot properly plead the unlawfulness of a directive as a defence in an infringement action under TFEU article 258. [33]

Documents released by the European Commission in response to a request for access to documents under Charter article 42 reveal that the Commission has also initiated infringement proceedings against Luxembourg. [34]

In Germany and Romania where the Directive had been transposed, constitutional courts struck down the transposing acts as violating constitutional rights. The Constitutional Court of Romania held that the transposing act violated the constitutional rights of privacy, of confidentiality in communications, and of free speech. [35] The German Federal Constitutional Court - without addressing the legality of the Directive itself [36] - declared the transposing act unconstitutional as it violated the privacy of telecommunications guaranteed by Basic Law [37] article 10(1). [38] The Federal Constitutional Court held that, while the scope of data to be retained was not per se disproportional, the statutory requirements regarding data security, the purposes of data processing, transparency, and legal protection were insufficient, [39] rendering the transposing legislation disproportional. Over 34,000 citizens, including Sabine Leutheusser-Schnarrenberger, currently serving as Germany's Federal Minister of Justice, had initiated this action.

4. Data to Be Retained

4.1. General Limitations

Article 3(1) states that providers of publicly available electronic communications services or of public communications networks only have to retain data that they 'generated or processed.' [40] As article 2(1) refers to the Data Protection Directive with regard to the definitions contained therein, the term 'processed' has to be construed according to Data Protection Directive article 2(b) which defines 'processing of personal data' as 'any operation or set of operations which is performed upon personal data, whether or not by automatic means […].' All data (re)transmitted by a provider therefore is 'processed.'

The requirement that the data has to be 'generated or processed' makes clear that the providers have no obligation to generate new data - for example by requiring their users to provide personal data such as a social security number-to buy a pre-paid cell phone.

Recital 13 explicitly states that only 'accessible' data has to be retained. It further notes with regard to Internet e-mail and Internet telephony that the obligation to retain data applies only in respect of data 'from the provider's or the network providers' own services.' As the Directive only covers 'publicly available electronic communications services' the term 'service' as it is used in recital 13 is to be construed as referring to a 'publicly available electronic communications service.' [41]

A further limitation is provided by article 5(2) which states that '[n]o data revealing the content of the communication may be retained pursuant to this Directive.' As discussed below, traffic data if professionally analyzed will necessarily reveal at least parts of or hints to the contents of a communication. [42] A simple example would be regular calls to a cardiologist only occurring during office hours. Article 5(2) therefore seems to essentially contradict article 5(1). To resolve this contradiction one has to interpret the phrase 'data revealing the content' in article 5(2) as data 'containing' or 'directly revealing' the content. This can also be supported by the last sentence of article 1(2) which states that '[the Directive] shall not apply to the content of electronic communications.' This means that article 5(2) only emphasizes what is obvious from article 5(1): the content of communications must not be retained pursuant to the Directive. [43]

4.2. Traffic Data Categories and Affected Means of Communication

Article 5(1) names six categories of data to be retained: data necessary to (a) trace and identify the source of a communication; (b) identify the destination of a communication; (c) identify the date, time, and duration of a communication; (d) identify the type of communication; (e) identify users' communication equipment or what purports to be their equipment; and (f) identify the location of mobile communication equipment. While this list of data categories is very broad, the means of communication to which they apply are rather few, significantly reducing the scope of data to be retained.

According to article 5(1), traffic data is only to be retained in relation to five specific means of communication: fixed network telephony, mobile telephony, Internet access, Internet e-mail, and Internet telephony. The kind of traffic data to be retained for each means of communication shall now be discussed. [44]

When fixed network telephony or mobile telephony is used for communication, the telephone number, name, and address [45] of the caller and the callee(s), the date and time of the start and end of the communication, [46] and the type of telephone service used [47] are to be retained. For mobile telephony the caller and the callee(s) International Mobile Subscriber Identity (IMSI), [48] International Mobile Equipment Identity (IMEI), [49] and cell ID [50] also have to be retained at the start of the communication. In the case of pre-paid anonymous mobile telephony services the date and time of the initial activation and the cell ID from which the activation occurred also are also to be retained. The data relating to unsuccessful call attempts does not have to be retained. [51]

With regard to Internet access, the following data has to be retained: the allocated IP address, [52] user ID(s), [53] the calling telephone number in case of dial-up access, [54] the name and address of the person to whom the IP address was allocated, [55] the date and time of the log-in and log-off, [56] and the DSL or other end point (on the user's side). [57] In the case of mobile Internet access, the cell ID - along with data identifying the geographic location of the cell-also has to be retained 'at the start of the communication,' i.e. when the Internet connection is established. It has to be emphasized that no data with regard to Internet access is to be retained 'to identify the destination of a communication' (article 5(1)(b)) or 'to identify the type of communication' (article 5(1)(d)). [58] With regard to Internet e-mail and Internet telephony, 'Internet access' therefore is not a subsidiary 'catch-all' means of communication.

Regarding Internet e-mail, the sender's and the recipient's e-mail addresses (hereinafter user IDs), [59] telephone numbers in case of dial-up access, [60] DSL or other end points (on the user's side), [61] names, and addresses [62] are to be retained. To identify the date, time, and duration of the communication, article 5(1)(c)(2)(ii) states that the 'date and time of the log-in and log-off of the Internet e-mail service' has to be retained. This wording raises serious problems. The sending of an e-mail does not necessarily commence with the log-in and also does not necessarily complete with the log-off. A user could use a single log-in session to send and/or receive multiple e-mails over a considerable time span. In an effort to craft a single provision that would cover Internet e‑mail and Internet telephony, the European legislator seems not to have considered this fact. However, as the wording of article 5(1)(c)(2)(ii) makes clear, the log-in and log-off time of the Internet e-mail service has to be retained, but not the point in time an e-mail was actually sent or received. The Directive does not define the term 'Internet e-mail service.' The term certainly covers services offered using the standardized e-mail protocols SMTP, [63] POP3, [64] and IMAP. [65]

To identify the type of e-mail communication, information about 'the Internet service used' has to be retained. [66] However, the Directive does not provide a definition for the term 'Internet service.' Article 2(2)(c) defines 'telephone service' as the type of service and not as a specific service offered by a specific provider. 'Internet service' is therefore to be construed as to mean the type of mail service (e.g. SMTP, POP3 or IMAP) and not the IP address and port number of the actual service used (e.g. 216.139.219.28:25). If mobile equipment is used to send and/or receive e-mails, the cell ID (along with data identifying the geographic location of the cell) has to be retained 'at the start of the communication.' As each individual e-mail has to be considered a 'communication' in its own right, the cell ID has to be retained for every e-mail sent from or received by a mobile device.

In the case of Internet telephony, the following data has to be retained: the caller's and the callee's VoIP addresses ('user IDs'), [67] names, and addresses; [68] in case of a VoIP-to-telephone-network-call, the callee's telephone number and the telephone number assigned to the caller, [69] telephone numbers in case of dial-up Internet access, [70] DSL or other end points (on either user's side), [71] the date and time of the log-in and log-off of the Internet telephony service, [72] and the type of Internet service used. [73] 'Internet service' in the context of VoIP could be construed as to mean which VoIP protocol (e.g. SIP) was used. If mobile equipment is used to perform the VoIP communication, the cell ID (along with the data identifying the geographic location of the cell) has to be retained at the start of the communication. [74]

5. The Minimum and Maximum Retention Periods

Article 6 states that the data specified in article 5 is to be retained 'for periods of not less than six months and not more than two years of the date of the communication.' This gives the Member States considerable flexibility in determining the retention period. Adding to this flexibility is article 12, [75] which allows Member States 'facing particular circumstances' to extend the retention period. Said circumstances have to warrant such an extension and the extension itself may only be valid for a limited period. The Member State has to inform the Commission and other Member States immediately. According to article 12(2), the Commission has the power to approve or reject the extension. If it does not act until six months after the notification the extension is deemed to have been approved.

It finally is important to reiterate that the limits for the retention period only affect data that is to be retained in accordance with article 5. The Directive therefore does not establish a general maximum data retention period.

6. Access to Retained Data

Article 4 states that traffic data retained in accordance with the Directive shall be 'provided only to the competent national authorities in specific cases and in accordance with national law.' But as recital 25 reiterates, the European Community had no power to regulate the issue of access by national authorities for activities referred to in the first indent of Data Protection Directive article 3(2). These include 'processing operations concerning public security, defence, State security […] and the activities of the State in areas of criminal law.' [76]

When interpreting article 4 in the light of recital 25, it is apparent that the Directive sets no limits whatsoever on the conditions or kind of access to the retained data a Member State may grant a national authority. [77] Article 1 also states that the retention is to be performed 'in order to ensure that the data are available for the purpose of the investigation, detection, and prosecution of serious crime, as defined by each Member State in its national law' [78] (emphasis added).

7. Legality of the Directive with Regard to Fundamental Rights

When determining the legality of the Directive with regard to fundamental rights, it is important to keep in mind that the Directive itself does not state the conditions under which access to the retained data may be granted. However, as further elaborated infra, the Directive does provide that the purpose of the data retention is 'the investigation, detection and prosecution of serious crime.' [79]

7.1. Interference with the Rights to Privacy and Personal Data Protection

Before the adoption of the Lisbon Treaty, EU Treaty article 6(2) was the sole legal basis for fundamental rights in EU law. It stated that the EU 'shall respect fundamental rights […] as general principles of Community law.' Pursuant to EU Treaty article 6(2), said fundamental rights were to be derived from the Convention for the Protection of Human Rights and Fundamental Freedoms [80] (hereinafter ECHR) and from the constitutional traditions common to the Member States. [81]

With the adoption of the Lisbon Treaty on December 1, 2009, the Charter entered into force. EU Treaty 6(1) as amended by the Lisbon Treaty states that '[t]he Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union […] which shall have the same legal value as the Treaties' (emphasis added). The Charter is therefore part of primary EU law and all acts of secondary EU law - in particular directives - have to conform to it. [82] Accordingly, it is possible to challenge the legality of the Directive on the basis that it does not conform with the Charter. [83]

Article 7 of the Charter ('Respect for private and family life') states: 'Everyone has the right to respect for his or her private and family life, home and communications.'

Article 8(1) of the Charter ('Protection of personal data') provides: 'Everyone has the right to the protection of personal data concerning him or her.'

The preamble of the Charter provides guidance for interpreting its provisions. It states:

This Charter reaffirms […] the rights as they result, in particular, from the constitutional traditions and international obligations common to the Member States, […] the European Convention for the Protection of Human Rights and Fundamental Freedoms, […] and the case-law of the Court of Justice of the European Communities and of the European Court of Human Rights.

Specifically regarding the rights which correspond to rights guaranteed by the ECHR, article 52(3) of the Charter states that 'the meaning and scope of those rights shall be the same as those laid down by the [ECHR].' It is important to note that the ECHR only constitutes a floor not a ceiling for the level of protection provided by the Charter. [84]

The case law of the European Court of Human Rights is particularly relevant as it addresses many questions related to communications surveillance and data privacy. Furthermore, both article 7 and article 8 of the Charter are based on ECHR article 8. [85]

ECHR article 8 § 1 stipulates everybody's right 'to respect for his private and family life, his home and his correspondence.' [86] The European Court of Human Rights established in Klass v. Germany [87] that telephone communications fall under both 'correspondence' and 'private life.' [88] The Court has further held in Malone v. United Kingdom [89] that not just the contents of telephone communications but also the telephone numbers dialled (i.e. traffic data) are protected under ECHR article 8. In Copland v. United Kingdom, [90] the court held that this principle also applies to e‑mail communication.

Article 7 of the Charter uses the same wording as article 8 ECHR, except that the broader term 'communications' instead of 'correspondence' is used. [91] In light of the above case law, it is evident that the means of communication addressed by the Directive-fixed network telephony, mobile telephony, Internet access, Internet e-mail, and Internet telephony-fall within the scope of article 7 of the Charter.

As the Directive does not regulate the conditions under which access to the retained data may be granted, the issue arises whether the data retention in itself constitutes an interference with article 7 and article 8 of the Charter. The European Court of Human Rights stated in Amann v. Switzerland that 'the storing of data relating to the 'private life' of an individual falls within the application of Article 8 § 1 [ECHR].' [92] Citing this principle, the Court further elaborated in Copland v. United Kingdom that 'it is irrelevant that the data held […] were not disclosed or used […] in disciplinary or other proceedings.' [93] The right to privacy as it is provided by ECHR article 8 is therefore to be understood in a very broad sense.

As the scope of article 7 and article 8 of the Charter has to be construed as at least equally broad, [94] the retention of traffic data in itself constitutes an interference with article 7 and article 8 of the Charter. As the retention is mandatory, the Directive does not leave the Member States the possibility to implement the Directive in a way that would not interfere with these rights. The question therefore is whether this interference constitutes a violation.

With regard to potential limitations of the rights guaranteed by the Charter, article 52(1) of the Charter provides:

Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

This is very similar to the requirements established by ECHR article 8 § 2 which states that an interference with the exercise of the right conferred by article 8 § 1 ECHR is only permissible if it is 'in accordance with the law' and 'necessary in a democratic society' for a recognized purpose.

7.2. 'Provided for by Law'

The European Court of Human Rights has repeatedly held that the phrase 'in accordance with the law' in ECHR article 8 § 2 also establishes requirements with regard to the quality of the law and does not only refer back to domestic law. [95] Said quality has to be compatible with the rule of law, which is expressly mentioned in the preamble to the ECHR. To that end, it has to fulfil the requirement of foreseeability, [96] i.e. it has to be 'formulated with sufficient precision to enable any individual - if need be with appropriate advice - to regulate his conduct.' [97] The Charter's requirement that any limitation on the exercise of rights 'must be provided for by law' is to be construed to establish the same requirements. [98]

Article 5 of the Directive uses a very complex approach to define the specific types of traffic and location data to be retained. As described above, it does not deal with each type of communication (fixed network telephony, mobile telephony, Internet access, Internet e-mail, and Internet telephony) separately. It rather deals with all types of communication under each of the six data categories. In an effort to use the same wording for multiple types of communication, article 5 is also ignorant of certain technical facts [99] and thereby specifies the data to be retained less precisely than intended.

However, with sufficient technical understanding of the communication technologies involved, all terms used in article 5 can be applied to the five types of communication in a way that foreseeability can be established with respect to what data will be retained.

7.3. The Requirements of the Principle of Proportionality

Article 52(1) of the Charter refers to the 'principle of proportionality.' It is established case law of the ECJ that

[t]he principle of proportionality, which is one of the general principles of Community law, requires that measures adopted by Community institutions do not exceed the limits of what is appropriate and necessary in order to attain the objectives legitimately pursued by the legislation in question; when there is a choice between several appropriate measures recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued. [100]

From the ECJ's case-law and article 52(1), four elements of the proportionality test can be inferred. For an interference with a fundamental right to be proportionate, the measure must: (1) pursue 'objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others;' [101] (2) be suitable to meet these objectives; (3) be 'necessary' in the sense that it is the least invasive suitable measure; and (4) is proportionate in the strict sense. [102] Each of these elements will be discussed below.

Note that ECJ's measure of proportionality slightly differs from that used by the European Court of Human Rights. [103] However, since the ECJ and not the European Court of Human Rights will have to rule on whether the Directive complies with the Charter, the ECJ's measure is used in this article. [104]

7.3.1. The Public Purpose of the Directive

Under the principle of proportionality, a measure that interferes with a fundamental right can only be justified if it pursues a legitimate public purpose. The fundamental right to the protection of personal data under Charter article 8 also requires that personal data be only processed for specified and legitimate purposes. [105]

According to article 1(1), the European legislator aims to harmonize the obligations of providers to retain data, 'in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime.' As TFEU [106] article 82 et seq. grant upon the EU powers in the area of judicial cooperation in criminal matters, the 'investigation, detection and prosecution of serious crime' evidently is a 'general interest recognised by the Union' [107] as required by the principle of proportionality. Furthermore, the Directive's stated purpose, despite being worded very broadly, [108] also fulfils the requirement of a specified and legitimate purpose under Charter article 8.

The Directive's objective has the potential to justify an interference with article 7 and article 8 of the Charter. To determine whether this is actually the case, the suitability, necessity, and proportionality stricto sensu of the measure have to be examined.

7.3.2. Suitability

Whether the retention of traffic data as provided by the Directive is suitable to achieve the objective stated in article 1(1) depends on the technical aspects of the data retention. Commentators have argued that the amount of data retained would be so vast that a search would take between 50 and 100 years. [109] These estimates are mostly based on incorrect assumptions with regard to what data is to be retained [110] and ignorant of the performance capabilities of today's computer systems. When properly indexed, [111] large amounts of retained data can be searched very efficiently and within adequate time frames.

It has also been argued that without the retention of the contents of the communications, little information can be gained from the retained data. [112] However, as described below, traffic analysis and social network analysis allow inferring a magnitude of information, close to what could be gained from analysing the contents of communications.

Furthermore, one might argue that the Directive cannot achieve its objective due to the numerous ways to circumvent the retention of one's traffic data. [113] This argument, however, fails because the suitability test only requires that the measure is not 'manifestly' unsuitable. [114]

7.3.3. Necessity

The retention of traffic data can only be considered necessary if it is the least invasive measure available that is suitable to achieve the objective stated in article 1(1). In this context it is important to reiterate that said objective includes the 'detection' of serious crime. This means that measures like the surveillance of a specific suspect's telecommunications or a 'quick freeze' procedure [115] are not a suitable alternative as they require that a crime has already been detected or a potential perpetrator of a crime identified. [116]

While it is hard to find a real alternative [117] to the retention of traffic and location data, the question arises whether the retention period is as short and therefore only as non-intrusive as necessary. According to article 6, the data is to be retained 'for periods of not less than six months and not more than two years.' As described above, article 12 additionally allows Member States 'facing particular circumstances' to extend the retention period if the Commission and other Member States are informed and the Commission does not object to the extension within six months.

Due to the lack of empirical studies [118] that would demonstrate the extent to which retained data of a certain age is necessary to investigate, detect or prosecute serious crime it is not possible to determine whether two years (or even more) are 'necessary.' [119] What can be assumed, however, is that any graph depicting the age of retained data versus the number of crimes for which that data was necessary to investigate, detect, or prosecute it, would be asymptotic towards zero. This means that there will always be some serious crime that might require a certain kind of data to be retained indefinitely. This clearly shows that the question of how long the data can be retained while not violating article 7 and article 8 of the Charter is rather a question of proportionality stricto sensu than necessity.

7.3.4. Proportionality Stricto Sensu

The proportionality of the Directive particularly depends on three factors: its effectiveness, the severity of the interference, and the presence of adequate and effective measures against abuse. As the Directive does not regulate the conditions under which national authorities may gain access to the retained data, the public purpose of having such a measure can only be discussed in general terms.

Effectiveness with Respect to the Directive's Objective

The effectiveness of the data retention as provided by the Directive is limited by the inherent limitations of the Directive's scope and the numerous ways available to circumvent the retention of one's traffic data in a personally identifiable form.

The Directive's scope is limited in geographic terms to the territory of the Member States. This means that providers in third countries naturally have no obligation to retain any data under the Directive. If somebody was to use a dial-up Internet access provided by a third country provider and applies link level encryption, [120] no traffic data could be retained. Another example would be somebody employing end-to-end encryption when communicating with his mail service provider. [121] The user's Internet access provider in the EU would be unable to find out to whom e-mails are being sent or from whom they are being received.

A much more drastic limitation of the Directive's scope results from the fact that the categories of data listed in article 5 are only to be retained with respect to fixed network telephony, mobile telephony, Internet access, Internet e-mail, and Internet telephony. These means of communication may have been the most obvious ones at the time the Directive was drafted. However, e-mail and Internet telephony (VoIP) are actually only a very small subset of the means of communication available on today's Internet.

At this point, it is important to reiterate that with respect to 'Internet access,' no data is to be retained 'to identify the destination of a communication' (article 5(1)(b)) or 'to identify the type of communication' (article 5(1)(c)). Internet communication therefore is only to be retained if it is Internet e-mail or Internet telephony.

The Directive defines neither the term 'Internet e-mail' nor 'Internet telephony.' As the term 'e‑mail' is of a technical nature, it should be interpreted in accordance with the relevant technical standards. While Request for Comments [122] (RFC) 5322 [123] specifies the format of an e-mail, the RFCs 5321, [124] 1939, [125] and 3501 [126] specify the standard e-mail protocols SMTP, POP3, and IMAP respectively. The term 'Internet e-mail' as used in the Directive has to be construed as data that conforms to RFC 5322 and is being transferred in accordance with RFC 5321, 1939, or 3501. Data transferred over the Internet that does not conform to the aforementioned RFCs is not 'Internet e-mail.' Related traffic data is therefore not to be retained under article 5.

As the term 'Internet telephony' is not defined in the Directive, one might take recourse to article 2(2)(c) which defines the term 'telephone service' as 'calls […], supplementary services […], and messaging and multi-media services (including short message services, enhanced media services and multi-media services).' The term 'telephone service' is only used in article 5(1)(d)(1) to give meaning to the term 'type of communication' with respect to fixed network and mobile telephony. The term 'telephone service' therefore cannot be used to give meaning to 'Internet telephony.' If the definition of 'telephone service' was applied to the Internet it would effectively cover all services offering audio-visual content. The European legislator hardly wanted to introduce such broad obligations to retain data through a 'backdoor,' using the term 'Internet telephony.' The term 'Internet telephony' therefore has to be construed using applicable standards [127] such as SIP (RFC 3261), [128] H.232, [129] and RTP (RFC 3550). [130] Only data that conforms to these standards can be considered 'Internet telephony.'

To construe the terms 'Internet e-mail' and 'Internet telephony' using applicable technical standards is not only a matter of practicality and legal certainty. The whole purpose of the Directive is to obligate providers to retain certain traffic data. To fulfil this obligation, providers cannot perform a case-by-case determination of every communication or even every data packet. They have to use automated means to read, analyze, filter, and store network traffic data. The implementation of these automated means requires explicit rules as to what data has to be retained. If every provider is not to use his own interpretation of what constitutes 'Internet e‑mail' or 'Internet telephony,' they have to use common standards. The aim of the Directive is to harmonize Member States' provisions concerning the obligations of providers with respect to the retention of traffic and location data. As the Directive does not define any technical standards itself, the goal of harmonisation can only be fulfilled if already-existing, generally-accepted standards are used. The purpose of the Directive therefore requires that technical terms left undefined in the Directive be construed using technical standards.

As the following means of online communication are neither 'Internet e-mail' nor 'Internet telephony,' they are not to be retained under article 5: blogs, message boards, video platforms (e.g. YouTube), social networking platforms (e.g. Facebook), [131] instant messaging, Internet Relay Chat (IRC), Usenet, all Hypertext Transfer Protocol (HTTP) traffic in general, and peer-to-peer services.

Blogs (short for 'web logs'), social networking or video platforms may contain a message to one or more individuals but as they are not formatted in accordance with RFC 5322, they cannot be considered 'Internet e-mail.' Some forms of communication via social networking platforms may even be labelled 'e-mail' by the platform's provider. They nevertheless typically do not adhere to RFC 5322. Instant messaging and IRC allow instant communication between two or more parties. Most instant messaging applications use a proprietary protocol and data format while IRC is specified in the RFC 1459. [132] Both can therefore not be considered 'Internet e-mail.' Usenet uses a message format that is specified in RFC 5536. [133] That format is similar but distinct from RFC 5322. The protocol used to transfer a Usenet message [134] also differs from SMTP. HTTP [135] traffic (this generally includes all communication to and from one's web browser) is neither 'Internet e-mail' nor 'Internet telephony.' This is even true in the case of web-mail. Web-mail service providers like Microsoft, Google, or GMX offer their users a website that allows them to authenticate and then send and receive e-mails. Technically speaking the data transferred from the user's browser to the web-mail service provider's web server (or vice versa) is not an e-mail (conforming to RFC 5322 being transferred by SMTP, POP3, or IMAP) but an HTTP request or an HTTP response as defined in RFC 2616. When sending an e-mail via web-mail, data is transferred to the provider's web server in a proprietary format. [136] It is there that the data is formatted in accordance with RFC 5322 and further delivered as an e-mail using SMTP.

It would also be technically infeasible to analyze HTTP traffic and filter it with respect to web-mail. There is no standard that would define how e-mails are to be transferred via HTTP. When looking at received mail using a web-mail provider, the provider's web server actually does not send the data comprising the e-mail and the instructions for how to display the data separately. The format language HTML in general does provide for the separation of content and its presentation. This means that any filter that was to attempt to extract relevant e-mail traffic data from the communication with a web-mail service provider would have to be changed whenever the design of the web page changes. Given the huge number of web-mail providers and the constant change of their data formats, filtering web-mail traffic is impossible for all practical purposes. Due to the imprecision of a filter, the inadvertent retention of the content of a communication would occur with statistical necessity. For all the reasons identified above, article 5 cannot be construed as to obligate providers to analyze and filter any HTTP traffic. [137]

Finally, peer-to-peer services are also not covered by the Directive. Due to their decentralized nature, they usually are the means of choice for distributing any kind of objectionable content.

As shown above, there are many means of online communication for which no data is to be retained under article 5. This allows people to prevent the retention of their traffic data simply by choosing a different means of communication.

In addition to the inherent limitations of the Directive's scope there are also numerous ways to circumvent the retention of one's traffic data. [138] As previously described, one could employ encryption technologies to secure the communication with one's SMTP server. If the recipient of the e-mail also communicates with his mail server using the encrypted versions of POP3 or IMAP (or uses web-mail) the only way an Internet access provider could 'see' (i.e. have unencrypted access to) the mail would be the communication between the sender's and the recipient's mail server. While most mail servers transfer e-mails unencrypted, some mail servers do employ encryption by default. [139] In the latter case, no retention of traffic data can be performed by Internet access providers.

Another technique to circumvent the retention of one's traffic data would be to use a web-mail account as a drop box. If both parties to a communication have the username and password for a certain web-mail account, they can communicate by saving draft messages in the corresponding 'Drafts' folder. As the HTTP traffic with the web-mail service provider does not contain an 'Internet e-mail,' no traffic data can be retained. As the web-mail service provider is not a 'provider of publicly available electronic communications services' or of 'a public communications network' it is also not obligated to retain any data.

Furthermore, there are circumvention measures that require less technological ingenuity for concealing one's identity. These include the use of public telephone booths and pre-paid cell phones. Most Member States do not require that the buyer of a pre-paid cell phone identify herself with a government-issued photo ID. Even if a Member State did require such an authentication, pre-paid cell phones could easily be acquired on the black market. Article 5(1)(e)(2)(vi) makes clear that the European legislator did anticipate this problem. It states that in the case of pre-paid anonymous services the date and time of the initial activation of the service and the cell ID from which the service was activated is to be retained. The idea behind this provision seems to be that people are presumed to buy a pre-paid mobile phone near the place where they live or work. Acting contrary to that assumption constitutes another circumvention measure. Regarding Internet access, a simple circumvention measure would be to go to an Internet café or to use a public WiFi hot spot.

As further elaborated below, the continuous use of the same 'anonymous' communication device (e.g. a pre-paid cell phone) is not a perfect circumvention measure. As soon as the device is used for more than a single conversation, extensive social network analysis might provide clues as to who is using the 'anonymous' device. For example, if one uses a pre-paid cell phone to call a friend, a relative and a colleague there might only be one person in the entire population that has direct relations with all three people, making it feasible to identify the caller. Pre-paid cell phones nevertheless drastically reduce the effectiveness of the retention of traffic data. [140]

With regard to Internet communication, there are also more sophisticated circumvention measures. These include commercial anonymisation services and onion routing networks. Commercial anonymisation services are usually proxy-based. Each customer has an encrypted connection with the service provider. Instead of directly communicating with the servers on the Internet, users divert all their traffic to the provider's proxy server. The proxy server will then establish a connection with the actual server and forward all traffic between the user and the server. If additional measures are employed to prevent information leakage, [141] such a commercial service can allow a user to hide her IP address and thereby her identity.

Another such concept is onion routing. The best known onion routing network is Tor (The Onion Router). [142] It is a project sponsored by the Electronic Frontier Foundation with an estimated user base of multiple hundred thousand users. [143] Compared to an anonymising proxy, the advantage of onion routing is that a user does not need to trust a single third party. In the Tor network, each client randomly selects three proxies (referred to as entry, middle, and exit node) from a long list of available proxies. Each packet transmitted by the client is encrypted three times. The entry node can only remove the first layer of encryption which will allow it to learn the identity of the middle node. This means that the entry node only knows the identity of the client and the middle node, but not the packet's contents or the identity of the exit node or the server. When the entry node forwards the packet to the middle node, the middle node will be able to remove the second layer of encryption and will therefore learn the identity of the exit node. It however will not know the identity of the client or the server, nor will it know the contents of the packet. When the exit node receives the packet from the middle node, it will be able to remove the last layer of encryption and will therefore be the only node that knows the identity of the server. However, it does not know the identity of the client (or the entry node). It will know the contents of the packet unless an end-to-end encryption is used between the client and the server (e.g. HTTPS [144]). [145] While Tor also has some weaknesses, [146] it does constitute a very strong measure against any retention of traffic data. Even if providers of Tor services were obligated to retain traffic data, Tor servers in third countries could always be used to circumvent such obligations.

The effectiveness the Directive with regard to facilitating the investigation, detection. and prosecution of serious crime is therefore severely reduced by both inherent limitations of the Directive and numerous ways to circumvent the traffic data retention. This necessarily limits the measure's public purpose.

Severity of the Interference

At this point, the severity of the interference with article 7 and article 8 of the Charter has to be examined more closely. First, it has to be emphasized that the Directive is a blanket measure in the sense that it mandates the retention of personal data irrespective of who it relates to. This factor weighs heavily against the proportionality of the Directive: In S. and Marper v. United Kingdom, the European Court of Human Rights stated that it was 'struck by the blanket and indiscriminate nature' of UK laws that allowed fingerprints, cellular samples, and DNA profiles to be retained for all individuals suspected of a criminal offence but 'irrespective of the nature or gravity of the offence with which the individual was originally suspected or of the age of the suspected offender.' [147]

The Directive itself does not regulate any uses a national authority might make of the retained data. The possible uses nevertheless do affect the severity of the interference posed by the mere retention of the data. The more information the retained data could potentially reveal about an individual, the more severe the interference. The retained traffic and location data does allow for extensive traffic analysis, social network analysis, and data mining.

Traffic analysis can use the time and duration of a communication, the identities of the parties communicating, and their location to infer new information. [148] In contrast to cryptanalysis, [149] traffic analysis is relatively inexpensive, because less computing power is required. It also does not require a human person to actually look at the analyzed data. As Michael Hermann, the former chair of the UK Joint Intelligence Committee put it: 'traffic analysis […] provides indications of his intentions and states of mind, in rather the same way as a neurologist develops insights about a silent patient by studying EEG traces from the brain.' [150]

An almost classic example is a drastic increase of calls placed by Pentagon employees to Domino's Pizza. [151] What can be inferred from this information? Statistically speaking, it is a good indicator that hostilities are imminent. [152] Knowing the identity of one party often also reveals at least some contents of the communication. If an e-mail is sent to alcoholics-anonymous@example.com, the most relevant aspect of the content of the communication can already be inferred with a high probability: the sender is an alcoholic. Similar conclusions can be drawn when a mail is sent to a doctor specialized in cancer treatment or to a criminal defence lawyer. Another example would be that close friends of any individual can usually be identified by determining with whom the individual communicates most often. If multiple calls are initiated by an individual within a short time period, the order in which the calls are initiated might also indicate a relative importance of the callees to the caller. [153]

Location data might also reveal very significant facts. If two people who communicate regularly with each other change their location to another part of the country or a different country altogether for a few days, it seems likely that they went on vacation together. If somebody spends the night at a different location (within reach of a different cell) but only regularly communicates with one person in that cell it seems likely that the two people spent the night together. [154]

While traffic analysis would already allow a national authority to infer a lot of information about any individual, social network analysis seems especially well suited for drag net operations and the detection of social structures that might resemble those thought to be typically present in a criminal organisation or a terror cell. [155]

Taking things one step further, data mining [156] could be employed to link a database containing retained traffic and location data with other big databases such as those maintained by some national social security agencies. [157]

While all of the above mentioned techniques can help in the investigation and prosecution of serious crimes, they could also be employed to detect these crimes. In this case, everybody's communicational behaviour would be automatically analyzed for certain 'suspicious' communication patterns - irrespective of any anterior suspicion.

Any effort to 'detect' very rare but vaguely defined behaviour within an entire population -like 'terroristic activities' - raises particularly grave concerns. This is due to the characteristic of 'false positive' and 'false negative' error rates when dealing with a 'needle in a haystack' problem. In this context, a 'false positive' signifies an individual who is incorrectly identified as a 'terrorist.' A 'false negative' signifies a terrorist incorrectly identified as 'not a terrorist.' Let us assume that there are one hundred 'terrorists' within the EU population of 500 million, [158] and the existence of a data mining program that has a 1 in 100 false positive rate and a 1 in 100 false negative rate (99 percent accuracy). What is the probability that a person identified by the system as a terrorist actually is one? It is not 99 percent as one might intuitively assume, [159] but rather about 0,002 percent (or 1 in 50,000). The system will incorrectly identify about 5 million people as terrorists while correctly identifying 99 terrorists. [160] While 1 to 50,000 seems disproportionate enough, it should be noted that the assumption that it is possible to construct a 'profile' as precise as matching 99 percent of all terrorists but only 1 percent of the rest of the population is, at best, very optimistic. [161]

One might question whether Member States have the capabilities to engage in such 'drag net' operations. In this regard, it has to be emphasized that the European Commission funded numerous relevant security research projects in the PASR ('Preparatory Action in the field of Security Research') program. [162] Among the funded projects was i-TRACS ('Counter-terrorism identification and advanced tracking system using the analysis of communication, financial and travel data') [163] and HiTS-ISAC (Highway to Security/Interoperability for Situation Awareness and Crisis Management). [164] As demonstrated by products and services developed by the private sector, this research is not merely of a theoretical nature. [165]

The fact that traffic analysis and data mining can be realistically performed using the retained traffic and location data is an aggravating factor to be considered. Adding to the severity of the interference with article 7 and article 8 of the Charter is the maximum retention period of two years with the possibility of further extensions in accordance with article 12. [166]

Lastly, when weighing the severity of the interference against the importance of the public purpose pursued by the Directive, the social harm potentially created by the Directive should also be considered. [167] To what extent will the Directive have a chilling effect on the exercise of people's fundamental rights? If behavioural modifications do ensue, what are the sociological effects? Would social minorities (based on political views, income class, religion, or any other factor) feel pressured to assimilate to the mainstream so as not raise any suspicions? And haven't most positive sociological developments been started by a social minority - that might now be deterred from deviating from what is considered appropriate by the majority? Few empirical data is available to answer these questions. They nevertheless should be considered in a determination of the Directive's proportionality.

Adequate and Effective Measures Against Abuse

The European Court of Human Rights has repeatedly held [168] that 'adequate and effective measures against abuse' need to be present in order for an interference to be proportional. Article 7 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, [169] which has been ratified by all Member States, [170] also mandates 'appropriate security measures' to protect the confidentiality, integrity, and availability of personal data. [171]

Article 7 of the Directive refers to the Data Protection Directive and the ePrivacy Directive and additionally states the following minimum data security principles: (a) the retained data shall be subject to the same security as data on the network; (b) appropriate technical and organisational measures [172] are to be employed to ensure the confidentiality, integrity, and availability of the retained data; (c) appropriate technical and organisational measures are to be used to ensure that the retained data can only be accessed by specially authorized personnel; [173] and (d) that data, except those that have been accessed and preserved, [174] shall be destroyed at the end of the period of retention. These measures and the ones to be implemented in accordance with the Data Protection Directive and the ePrivacy Directive could be considered 'adequate and effective' with regard to third parties (everyone except the provider and the national authorities) - that is if they are indeed implemented.

A lack of enforcement capabilities of the national supervisory authorities leading to insufficient outside review might severely limit the effectiveness of these measures. The national supervisory authorities referred to in article 9 will most likely not be able to effectively perform an individual security assessment for each provider. Framework Directive article 13b as amended by the Better Regulation Directive [175] will require new enforcement powers for national regulatory authorities: the power to issue binding instructions, [176] powers necessary to investigate cases of non-compliance, [177] and the power to require providers to (a) provide information needed to assess the security and/or integrity of their services and networks, including documented security policies and (b) submit to a security audit carried out by a qualified independent body or a competent national authority and make the results thereof available to the national regulatory authority, whereas the cost of the audit shall be paid by the provider. [178] These provisions, however, do not have to be transposed by Member States before May 25, 2011. [179] Until that date, they are of no direct relevance for the security of retained data and the proportionality of the Data Retention Directive. They do however clearly indicate the inadequacy of security measures currently required.

Another measure that would greatly add to the security of the retained data is an obligation to notify data security breaches to the individuals concerned. Such an obligation is provided for in article 4(3) ePrivacy Directive as amended by Citizens' Rights Directive. [180] However, this provision will also not have to be transposed until May 25, 2011. [181]

Furthermore, it has to be considered that a more centralized network infrastructure, as it is necessitated by the requirement to analyze all traffic, creates additional vulnerabilities. [182]

In addition to threats created by third parties, misuse by national authorities also poses a serious risk. It has to be emphasized that the Data Protection Directive does not apply to law enforcement agencies. [183] Given the standardisation efforts of the European Telecommunications Standards Institute (ETSI), [184] it seems likely that automatic data retrieval will soon be possible for national authorities. Article 10 of the Directive provides that Member States have to submit statistics on a yearly basis to the Commission. Reporting requirements generally have the potential to deter or to allow to detect (but not prevent) misuse by national authorities. However, according to article 14(1), article 10 is not meant to provide such a measure against abuse. [185] It should rather allow determining whether it is necessary to amend the list of data in article 5 and the periods of retention provided for in article 6.

Therefore, the security measures, as provided for by the Directive, cannot be considered sufficiently 'adequate and effective measures against abuse.' [186]

8. Conclusion

The Data Retention Directive clearly constitutes an interference with the fundamental rights to privacy and data protection. This interference is 'provided for by law' and serves the legitimate public purpose of supporting the 'investigation, detection and prosecution of serious crime.' Given this purpose, the Directive also has to be considered suitable and necessary. However, the Directive does not fulfil the requirement of proportionality stricto sensu:

It has been shown that the traffic and location data retention as mandated by the Directive is of limited effectiveness to facilitate the investigation, detection and prosecution of serious crime. If somebody wanted to prevent the retention of his data, there would be numerous ways to achieve that goal. Due to the inherent limitation of the Directive to mobile telephony, fixed network telephony, Internet access, Internet e-mail, and Internet telephony, one simply has to choose an alternative means of communication. Internet anonymising services, pre-paid cell phones, Internet cafés and WiFi hot spots also allow circumventing the retention of traffic and location data in a personally identifiable form. This limited effectiveness reduces the public purpose that has to be weighed against the individual's interest of non-interference with his or her right to privacy.

The possibilities to analyze the retained data in an automatic fashion only slightly add to the effectiveness of the data retention but drastically increase the severity of the interference. Traffic analysis allows inferring much more information than is apparent from the retained data. This may include sensitive personal information such as one's medical condition, political affiliation, or sexual orientation. Social network analysis and data mining would especially allow for fishing expeditions [187] and a continuous surveillance of the entire population. People showing social patterns that are thought to be typical for a criminal or terrorist organisation might face more detailed analysis of their data or additional surveillance measures. In addition to the severity of the interference with an individual's rights to privacy and data protection, it can also be argued that the changes in society, potentially resulting from a constant surveillance, are contrary to the public purpose.

With a maximum as high as two years and possibilities of further extension in accordance with article 12, the retention period also seems excessive by any standard [188] and increases the severity of the interference with people's privacy.

The Directive does not provide adequate and effective measures against abuse by national authorities or third parties. Due to a lack of mandatory outside review, the measures against abuse by a provider itself are also rather inadequate.

In summary, the public purpose of the data retention is limited by the low effectiveness and the potential negative effects on society as a whole. It nevertheless constitutes a very severe interference with the fundamental rights to privacy and data protection but lacks effective measures against abuse. The interference therefore cannot be considered proportionate stricto sensu. Thus, the Data Retention Directive violates the fundamental right to privacy (Charter article 7) as well as the fundamental right to data protection (Charter article 8).

In the infringement actions brought by the Commission against various Member States for failure to transpose the Directive, the ECJ refused to consider the question of the legality of the Directive. However, in a case brought by the civil rights organisation Digital Rights Ireland to challenge the Directive's implementation in Ireland, the Irish High Court is expected to grant the plaintiff's motion for a reference to the ECJ under TFEU article 267, [189] forcing the ECJ to finally address the issue of whether the Directive conforms with the fundamental rights to privacy and data protection.