Data retention is mass surveillance of people’s phone and internet activity

What is “data retention” for law enforcement?

It is the legal requirement for internet service providers to retain metadata about their users beyond what is necessary for the provision of the service (e.g. billing or network optimisation and security purposes) and to keep it solely so that it can later be accessed by law enforcement bodies and intelligence services.

What is metadata?

Metadata is data generated for the purpose of transmitting content in electronic communications services and networks. This includes mobile numbers of the sender and recipient, the time and duration of a call or an internet session, websites accessed, and the location of mobile devices. On a technical level, metadata is no longer needed once the transmission ends.

Metadata is very revealing about people’s private lives.

• Systematic recording of location data will reveal a person’s permanent and temporary places of residence, political and religious preferences (e.g. participation in public demonstrations and religious ceremonies), health status (e.g. visit to a specialised clinic), sexual orientation (e.g. LGBT+ venues), or other sensitive aspects (e.g. visit to a lawyer’s office).
• Metadata contains information about social or professional relations with other people (“social graph”).
• Usage patterns for website visits and other internet services reveal an enormous amount of information about a person’s interest and state of mind.

Why is it important?

1. Metadata is more revealing than the content of communications, especially because metadata is highly structured, which makes it easy to analyse. Governments can easily profile and categorise entire populations solely based on metadata.
2. The Court of Justice of the EU rightly described metadata retention as creating a feeling of being under constant surveillance. This has a chilling effect on participation in public life, as individuals restrict their own civil liberties to avoid surveillance.
3. While data access requests may be specific and targeted, general and indiscriminate data retention treats everyone as a potential suspect. Surveillance without suspicion violates the presumption of innocence, which is an essential right in democratic societies.
4. Retention of vast amounts of personal data inevitably creates huge vulnerabilities to cyberattacks. Malicious actors can gain access to massive amounts of data and abuse it for identity theft or blackmail.
5. Data retention severely undermines the possibility of online anonymity. Anonymity is a question of safety for many, even a matter of life or death: investigative journalists, whistleblowers, crime survivors, political opponents, refugees, victims of transnational repression, artists, human rights defenders, and more. It supports the exercise of key fundamental rights such as freedom of expression and the freedom to receive and impart information.

Examples of harms caused by indiscriminate data retention

1. US telecom company AT&T was hacked by an attacker who stole the logs of calls and texts to more than 100 million customers over a six-month period in 2022.
2. In 2024 the Garda Síochána Ombudsman Commission (Ireland’s police watchdog) accessed journalists’ phone records to identify their sources as part of its own investigation into the Irish police, even though the journalists were not accused of any criminal offence.
3. In 2013, the Polish Central Anti-Corruption Bureau (CBA) obtained access to billing data of a journalist who had reported on irregularities in the intelligence services. The CBA’s aim was to uncover their source’s identity. The journalist won the case in court, and the CBA published an official apology.
4. The Berlin Data Protection Authority reported that most cell tower dumps (law enforcement requesting information on all the devices that connected to a particular cell site during a specific time period) by German authorities between 2009 and 2011, when data retention was in place in the country, were unlawful. The German police used this surveillance technique as an everyday investigative tool despite its very intrusive nature, and systematically failed to meet several legal requirements. Data retention enabled this abuse.

What should EU law say about it?

• Uphold fundamental rights: Any EU law on electronic communications or law enforcement access to data should reaffirm the legal obligation to ensure confidentiality of communications, including metadata, as the main rule.
• Preclude mass surveillance: Exceptions to this rule must be provided for by law and interpreted strictly, in accordance with CJEU case law on the current e-Privacy Directive, which states that the Charter of Fundamental Rights precludes general and indiscriminate retention of traffic and location data even for combatting serious crime.
• Allow only targeted data retention for law enforcement: With sufficient resources and swift procedures, quick freeze orders could secure the data strictly necessary for a specific investigation, provided they are executed in compliance with all the applicable EU and national procedural safeguards such as prior judicial authorisation.

Want to know more?