Statement of the European Data Protection Commissioners

Released : 11 September 2002

Statement of the European Data Protection Commissioners at the International Conference in Cardiff (9-11 September 2002) on mandatory systematic retention of telecommunication traffic data.

The European Data Protection Commissioners have noted with concern that in the third pillar of the EU, proposals are considered which would result in the mandatory systematic retention of traffic data concerning all kinds of telecommunication (i.e. details about time, place and numbers used for phone, fax, e-mail and other use of the internet) for a period of one year or more, in order to permit possible access by law enforcement and security bodies.

The European Data Protection Commissioners have grave doubt as to the legitimacy and legality of such broad measures. They also want to draw attention to the excessive costs that would be involved for the telecommunication and internet industry, as well as to the absence of such measures in the United States.

The European Data Protection Commissioners have repeatedly emphasized that such retention would be an improper invasion of the fundamental rights guaranteed to individuals by Article 8 of the European Convention on Human Rights, as further elaborated by the European Court of Human Rights (see Opinion 4/2001 of the Article 29 Working Party established by Directive 95/46/EC, and Declaration of Stockholm, April 2000).

The protection of telecommunication traffic data is now also provided by Directive 2002/58/EC of the European Parliament and Council concerning privacy and electronic communications (Official Journal L 201/37), under which processing of traffic data is in principle allowed for billing and interconnection payments. After lengthy and explicit debate, retention of traffic data for purposes of law enforcement should meet strict conditions under Article 15(1) of the Directive: i.e. in each case only for a limited period and where necessary, appropriate and proportionate in a democratic society.

Where traffic data are to be retained in specific cases, there must therefore be a demonstrable need, the period of retention must be as short as possible and the practice must be clearly regulated by law, in a way that provides sufficient safeguards against unlawful access and any other abuse. Systematic retention of all kinds of traffic data for a period of one year or more would be clearly disproportionate and therefore unacceptable in any case.

The European Data Protection Commissioners expect that the Article 29 Working Party will be consulted on measures that may emerge from the third pillar discussions before they are adopted.