EDPS: Data Retention Directive fails to meet data protection requirements

This article is also available in:
Deutsch: [EDSB: Richtlinie zur Vorratdatenspeicherung wird Datenschutzanforderungen nicht gerecht | http://bit.ly/juy3xn]

Peter Hustinx, the European Data Protection Supervisor (EDPS) adopted, on 31
May 2011, an opinion on the European Commission’s Evaluation Report on the
Data Retention Directive submitted on 18 April 2011 to the Council and the
European Parliament.

The EDPS has several times expressed his concerns related to the necessity
for retaining data on such a large scale in view of the rights to privacy
and data protection and has called for a clear demonstration that such a
measure is necessary and proportionate.

On the basis of the Commissions’ Evaluation Report, the EDPS has drawn the
conclusion that the Data Retention Directive does not meet the requirements
set out by the rights to privacy and data protection, primarily because
the necessity for data retention has not been sufficiently demonstrated.
Hustinx also believes that data retention could be regulated in a less
privacy-intrusive way and that the Directive lacks foreseeability.

“Although the Commission has clearly put much effort into collecting
information from the Member States, the quantitative and qualitative
information provided by the Member States is not sufficient to draw a
positive conclusion on the need for data retention as it has been developed
in the Directive. Further investigation of necessity and proportionality is
therefore required, and in particular the examination of alternative, less
privacy-intrusive means” says the EDPS.

Also, in Hustinx’s opinion, the present Directive leaves too much room for
Member States to decide on the purposes for which the data may be used,
on who can access the data and under which conditions.

Therefore, the EDPS calls on the Commission to seriously consider “all
options in the impact assessment including the possibility of repealing the
Directive”. An eventual future data retention directive should be considered
only if the necessity of data retention, “supported and regulated by the EU,
could be sufficiently demonstrated, which includes a careful consideration
of alternative measures.”

The respective directive should be exhaustive (with a clear and precise
purpose), proportionate (without going beyond what is necessary),
comprehensive and should “genuinely harmonise rules on the obligation to
retain data, as well as on the access and further use of the data by
competent authorities.”

EDPS – Press Release (31.05.2011)
http://europa.eu/rapid/pressReleasesAction.do?reference=EDPS/11/6&format=HTML&aged=0&language=EN&guiLanguage=en

Opinion of the European Data Protection Supervisor on the Evaluation report
from the Commission to the Council and the European Parliament on the Data
Retention Directive (31.05.2011)
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11-05-30_Evaluation_Report_DRD_EN.pdf,

EDRi-gram: Top 10 misleading statements of the European Commission on data
retention (20.04.2011)
http://www.edri.org/edrigram/number9.8/data-retention-evaluation

EDRi-gram: Data retention in EU Council Meeting (18.05.2011)
http://www.edri.org/edrigram/number9.10/data-retention-eu-council