Digitalcourage: Criticism of the EU Commission's study on retained data
No question whether data retention is of any use: In the contract on the data retention study, the benefit of data retention is assumed to be given (p. 1). For example, it is assumed that data retention is a necessary and effective means of combatting child pornography. We criticise that the necessity and effectiveness of mass surveillance still has not been proven. A neutral study should not assume the benefit of blanket mass surveillance, but should first prove it.
Core question ignored: The study regards the question of regulating access to retained data as a possible means to mitigate the encroachment of fundamental rights by blanket mass surveillance (p. 2). In our opinion however, this could lead to one decisive characteristic of data retention being overlooked: the collection and storage of the population's communication data is already a disproportionate encroachment on fundamental rights, regardless of who accesses the data at a later date, and for what purposes.
Legal expansion instead of law enforcement: The EU Commission is in favour of harmonising the regulations for data retention in the EU. At present, there are EU countries with data retention obligations of varying severity, countries with no data retention obligations, and countries where constitutional courts are currently reviewing data retention laws. While the study asks how member states enforce their mass surveillance, for instance by limiting it to certain categories of data or periods of time despite the rulings of the EU Court of Justice, it ignores the question of how the rulings of the EU Court of Justice can be enforced in order to achieve harmonisation.
The goal is surveillance, not freedom or security: In our view, the above-mentioned objectives of the study are lacking some essential points. For example, it does not include 1. an overview of investigation methods that do not require mass surveillance, 2. an evaluation of the necessity and effectiveness of data retention regimes, 3. an assessment of the technological impact, 4. an evaluation of the consequences for democracy and civil rights and freedoms, 5. an evaluation of the chilling effects that are induced by already existing measures of telecommunications surveillance, 6. an identification of the requirements of democracies and the rule of law, 7. an evaluation of investigative errors and weaknesses in both the police and the secret services in terrorism cases (in Germany, see for example: NSU, Anis Amri and others).
Biased selection of stakeholders: For a study like this, all stakeholders should be interviewed. However, only the following are explicitly mentioned: investigative authorities, telecommunications companies, telecommunications supervisory authorities and EU institutions (p. 6). Not explicitly mentioned are for example: data protection supervisory authorities, fundamental rights organisations or other civil society stakeholders.
Facts beyond court rulings: A “retrospective fact finding support study” is to be prepared. It looks like it is going to be hard to find facts that will be taken seriously and treated with respect: the EU member states have declared before the EU Court of Justice that they do not wish to implement its ruling on data retention, we reported on this.
Since surveillance is pursued so zealously that even rulings of the EU Court of Justice are no longer respected as facts, and the EU Commission is not taking any action to enforce these rulings, we assume that law enforcement agencies, secret services and governments will ignore all other facts as well.
The study does not ask about threats: For the identification of national data retention practices, the study is to elicit which data are stored for which period of time, and what procedures for accessing the data are in force. (p. 6f). The contract lists 13 detailed questions, none of which deals with the threats of data retention, data leaks or misuse, even though there is ample reason to do so, for example after the case in Denmark (see article on heise.de).
Singular focus on benefits, risks ignored: While the identification of benefits of data retention is formulated as a separate study task under point 4.3 in the contract, the contract does not contain an explicit requirement to assess the risks of data retention. For example, the study asks, “Are the communications metadata non-content data used for the purpose of preventing crime?” The follow-up question is, “What is the benefit of such use of data?” No questions are asked about the risks of preventive mass surveillance – this is biased.