The General Data Retention Act (GDPR from the General Data Protection Regulation) of Germany violates EU law, decided Europe's highest court on Tuesday, dealing a blow to member states that collect data to fight crime and ensure national security.
The law can only be applied in cases where there is a serious threat to national security defined in very strict terms, said the Court of Justice of the European Union (CJEU from the Court of Justice of the European Union). The decision comes after long attacks of Islamist militants in France, Belgium and Britain in recent years. Governments argue that access to data, especially that collected by telecommunications operators, can help to prevention of such incidents, while communications providers and civil rights activists oppose this access.
The latest case began when Deutsche Telekom and internet service provider SpaceNet AG challenged Germany's data retention law, arguing that it violated EU rules. The German court then sought advice from the CJEU, which said that this type of data retention may only be permitted under very strict conditions.
“Το Δικαστήριο επιβεβαιώνει ότι η νομοθεσία της ΕΕ αποκλείει τη γενική και αδιάκριτη διατήρηση δεδομένων κίνησης και τοποθεσίας, except από την περίπτωση πολύ σοβαρής απειλής για την εθνική ασφάλεια”, ανέφεραν οι δικαστές.
However, the same court also left a loophole "to combat serious crime, Member States may, strictly respecting the principle of proportionality, provide for, among other things, the targeted or rapid retention of such data and the general and indiscriminate retention of IP addresses ".
