WRITTEN QUESTION E-3081/02

by Erik Meijer (GUE/NGL) to the Commission

(28 October 2002)

Subject: Circumvention of US legislation by a data retention requirement for electronic communications in the EU

1. Is it correct that on 16 October 2001 the President of the Commission received a report from the US President seizing upon an offer made by the President-in-Office of the Council on 27 September 2000 to improve cooperation in combating terrorism, to suggest that the EU should take measures in the area of data retention, in other words the storing of electronic communications data so as to be able to check whether they are being used for criminal or terrorist purposes or to track down the place of residence of the sender in subsequent months or years?

2. Does the Commission have the impression that this American request influenced the view taken by the Council on 28 January 2002 that the ban on data retention for purposes other than billing should be deleted from the draft Directive on the processing of personal data and the protection of privacy in the electronic communications sector (C5-0028/2002), as a result of which the Council is free to make proposals on data retention for a period of 12 to 24 months?

3. Can the Commission confirm that President Bush is asking the European Commission and the Council to impose requirements on European firms which could not be imposed in the United States under current US legislation? What is the Commission's view of this contradiction?

4. Is it possible that, through the exchange of data with Europe, US judicial bodies are trying to obtain traffic data which could not be obtained under US legislation? Does the Commission find it acceptable that, through this circuitous European route, data can be gathered and stored for the benefit of a State which is not authorised to collect such data itself?

5. Does the Commission share the concern expressed by civil rights organisations in the United States and Europe who see these proposals as a breach of civil rights and who, in a letter to the Presidency, have expressed the following views on Bush's request

for the introduction of data retention: While we support the President's efforts to take appropriate steps to reduce the risk of terrorism and to protect public safety, we do not believe that this proposal is appropriate or necessary?

6. What role will these objections play in the final shape of any framework directive on data retention? What is the current situation regarding this matter?

Answer given by Mr Liikanen on behalf of the Commission

(10 December 2002)

1. Yes, the Commission has received from President Bush a letter dated 15 October 2001 with several proposals on counter-terrorism cooperation, including on the subject of data retention in the context of the review of the corresponding legislation.

2. In line with the objective of a high level of protection of personal data within the Community, the Commission has taken the view, throughout the co-decision procedure on Directive 2002/58/EC on privacy and electronic communications(1), that the general obligation to erase traffic data when they are no longer needed for the provision of the communication service or for billing purposes, must be maintained. This is without prejudice to possibilities to process traffic data on the basis of the individual's consent which have been extended in the new Directive. At the same time the existing margin for Member States to restrict rights and obligations under the Directive where this is notably necessary for national security or for the prevention, investigation, detection and prosecution of criminal offences also remains in place, though subject to the conditions now explicitly recalled in the same Directive, including a test of necessity, appropriateness and proportionality in a democratic society. On request of the Council, the Commission and the Parliament have accepted that retention of data for a limited period be mentioned as one example of such possible measures. This reference to the retention of data is, however, neither a requirement to impose such retention, nor an authorisation for Member States that would wish to introduce such measures. The Commission is not in a position to assess the influence of the American request on the position of the Council, and would refer the Honourable Member to the Council.

3. Whether the American legal system leads to a more restricted availability of traffic data in the United States is not clear. While the United States do not appear to include a general obligation to retain traffic data for law enforcement purposes, it does not have an explicit obligation to delete collected data that are no longer needed for the provision of the service or for billing purposes.

4. As suggested by the Honourable Member, the possibility exists that, through obligations imposed within the Union, American authorities get hold of traffic data that would otherwise not be available via their own legal system.

5. The Commission is fully engaged in ensuring compatibility between data protection and privacy rights and law enforcement needs. The Commission is currently trying to clarify as much as possible how national measures can be best reconciled with the legal requirements stemming from Community law, from the European Convention on Human Rights and from the Charter of Fundamental Rights, bearing in mind the Commission's powers under the existing institutional framework.

6. The Commission is involved in certain Council discussions on the subject of general traffic data retention requirements. At this stage, the Commission calls for a dialogue on this issue with all interested parties and considers premature to draw any conclusions on whether there is a need for any legislative action at Union level, which under the third pillar can be tabled in Council by any Member State. If and when a draft Framework Decision on retention of traffic data would be proposed, the Commission would have to ensure its consistency with Community law requirements, and in particular with the new Directive on privacy and electronic communications, subject to the limits of Community action in this area.

(1) Directive 2002/58/EC of the Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector OJ L 201, 31.7.2002.