Data retention in Kosovo and Switzerland – legalising illegal laws

Less than a year ago, many thought data retention in Europe would finally be faced with incontrovertible evidence that it is not effective or proportionate. Now, sensing an opportunity to take advantage of a more favourable public relations landscape, some politicians seem to have the intention to bring EU data retention back again.

Data retention laws still exist in some EU Member States, pending evaluation of conformity with the Charter of Fundamental Rights of the EU. Additionally, there are also non-member countries in Europe where data retention is very much a live political debate. In Kosovo, the government is trying to introduce a very worrying law while in Switzerland the existing regulation is set to be further broadened.

In Kosovo, a “potential candidate” country of the EU, the government has proposed a “Draft Law on Interception of Electronic Communication”. Recently, this draft law, still suffering from many of the weaknesses we had pointed out in our previous analysis, was referred by the government to the Parliamentary Committee on European Integration. EDRi has written a letter to the Assembly of Kosovo voicing its concerns and noting that for Kosovo’s application for accession to the EU to be successful, the country’s legal system must respect the Charter.

Multiple aspects of the Kosovar draft law are highly problematic when looked at through the lens of the Court of Justice of the EU’s (CJEU) recent ruling on the Data Retention Directive. Among other worrying provisions, the draft law proposes to give the Kosovo Intelligence Agency its own interception interface functioning independently from those of the Internet Service Providers. Knowing intelligence agencies’ tendency towards secrecy, this will make supervising the correct use of that data difficult, if not impossible.

In a positive development, a large majority of the Plenary Session followed the recommendation of the parliamentary committee and sent the draft law back to the government. We should however be careful to call this victory final, as the Kosovar government has already formed a working group to start drafting a new version of the law. The Minister for European Integration voiced his displeasure on Facebook claiming that “the draft law has been fully harmonized with the European Commission, in line with the Acquis Communautaire and based on the best practices of EU countries.”

While the latest developments in Kosovo inspire hope, the situation in Switzerland is set to become even less respectful of citizens’ right to privacy. Switzerland has had a data retention law for ten years and is currently working on revising it. The Committee for Legal Affairs of the National Council recently followed the recommendations of the government and proposes to extend the period of retention from six to twelve months. The Committee does not see any reason to revise the law in order to oblige Service Providers to store sensitive data within the country.

Switzerland does not intend to join the EU and is thus not affected by the CJEU’s decision on the Data Retention Directive. However, the country is a member of of the Council of Europe and thus bound by the European Convention on Human Rights. The Legal Service of the European Parliament noted in an opinion that the jurisprudence of the CJEU and the European Court of Human Rights (ECtHR) in the matter of data retention is very similar and compatible. It is thus very likely that the ECtHR would rule that the Swiss data retention law violates the Convention.

However, it seems that both the Swiss government and the Legal Committee of the National Council are not particularly concerned by this. Digitale Gesellschaft Switzerland, an NGO working on digital rights issues, has initiated legal proceedings to challenge the law, and given the fact that Switzerland does not have a constitutional court, it is likely that we will see a decision by the ECtHR in a few years’ time.

Committee for Legal Affair wants 12 months data retention (only in German, 26.01.2015)
https://www.digitale-gesellschaft.ch/2015/01/26/rechtskommission-will-12-monate-vorratsdatenspeicherung/

Data Retention ruled invalid: what does this mean for Kosovo? (09.04.2015)
https://edri.org/data-retention-ruled-invalid-what-does-this-mean-for-kosovo/

Legal Service Opinion on CJEU Data Retention ruling (14.01.2015)
https://edri.org/legal-service-opinion-on-cjeu-data-retention-ruling/

The Kosovar Minister of European Integration’s Facebook post on the Assembly’s rejection of the draft law (only in Albanian, 20.01.2015)
https://www.facebook.com/CollakuBekim/posts/881362408575701

(Contribution by Julian Hauser, EDRi intern)