Joint civil society response to the Commission’s call for evidence: Impact assessment on data retention by service providers for criminal proceedings
Last week, the EDRi network expressed shared concerns about the introduction of new rules at EU level on the retention of data by service providers for law enforcement purposes.
Civil society strongly opposes the new rules forcing service provides to retain massive amounts of data
The submission by EDRi and members is based on the Commission’s call for evidence for an impact assessment (Ares(2025)4081079) and the documents produced by the High Level Group on “Access to Data for Effective Law Enforcement”.
We strongly oppose the adoption of new EU rules forcing electronic communications service providers to massively retain their users’ traffic and location data beyond what is necessary for service and billing purposes..We believe that this obligation:
- constitutes mass surveillance, which unacceptably undermines the rights to privacy and data protection and thus, endangers the exercise of other fundamental rights enabled by them such as freedom of expression and information, freedom of assembly and association, the right to a fair trial, to health care, to social protection and social assistance, etc.;
- has been found contrary to the EU Charter of Fundamental Rights by the Court of Justice of the European Union (CJEU)
- creates inadmissible data security risks, considering that the vast amounts of personal data retained for law enforcement are vulnerable to cyberattacks (which happen on a regular basis with disastrous consequences for people affected)
It is our recommendation that the Commission prioritises the launching of infringement procedures against Member States whose data retention legal framework does not comply with the CJEU case law. Based on the most recent reports and surveys, this, unfortunately, would concern a majority of Member States. Once all infringing national laws have been brought in line with EU law , the Commission could carry out a proper assessment of impacts, including on the respect for fundamental rights, and eventually consider an EU instrument to remedy shortcomings.
We also stress in our submission that there is still no scientifically proven link between indiscriminate data retention and impact on crime or crime clearance, and bring attention to six issues in the current impact assessment process which must be addressed.