WRITTEN QUESTION E-2308/02

by Erika Mann (PSE) to the Commission

(25 July 2002)

Subject: Mandatory data retention

According to the views of European Data Protection Commissioners, mandatory data retention as adopted recently in the EP constitutes a clear change from the current practice whereby operators cooperate with law enforcement agencies on a case-by-case and individual basis following an authorisation or warrant.

How does the European Commission evaluate the impact of general mandatory data retention on user confidence in electronic communications?

Does the European Commission think that a Data Retention Regulation could provide the essential legal framework? If so, when would the European Commission propose it?

How will the European Commission address the liability implications of data retention for communications companies, should data be misused or in instances where data that is forwarded to LEAs turns out to be wrong and leads to misinterpretation and even wrong judgments?

Answer given by Mr Liikanen on behalf of the behalf the Commission

(24 September 2002)

The new Directive 2002/58/EC on the processing of personal data and the protection of privacy in the electronic communications sector was adopted by the Parliament and the Council on 12 July 2002(1). The Directive (Article 15.1) allows Member States to adopt legislative measures to restrict the scope of some rights and obligations it provides for insofar as such restriction constitutes measures that are necessary within a democratic society to safeguard national security, public security, defence and for the prevention, investigation, detection and prosecution of criminal offences. These measures must be fully compatible with the European Convention on Human Rights and other general principles of Community law. The Directive mentions data retention measures as a possible example of such restricting measures. However, this reference does not constitute a requirement for mandatory national traffic data retention measures.

If a Member State does propose regulatory measures on traffic data retention on the grounds mentioned in Article 15.1 of the Directive, they will be examined by the Commission for conformance to the data protection Directives and more generally to Community law. Of special concern in any such examination will be the effects of these measures on electronic communications sector, including user confidence, and on the functioning of the single market.

A possible Community legislative instrument to regulate mandatory traffic data retention could take two forms, depending on its legal basis and objective. The effect would be different in the two cases. A third pillar instrument (under Title VI of the Treaty on the European Union) with the objective of improving police

and judicial co-operation in criminal matters would probably tend to require all Member States to impose certain traffic data retention requirements. A first pillar instrument (under the EC Treaty), with the objective to ensure the proper functioning of the single market, would probably impose limits to traffic data retention conditions that may be imposed on providers of electronic communications services and networks especially in order to suppress any obstacle to the freedom of establishment

The Commission has no plans to propose either type of legislative instrument at this stage.

The Commission recognises the importance of the issue of liability of providers of electronic communications services and networks for the transfer of incorrect data or for misuse of such data. In their capacity of controllers of personal data the providers are responsible for any damage resulting from any act incompatible with the data protection Directives including the quality and accuracy of the data or the unlawful transfers to third parties. However, it is up to those Member States that find it necessary to impose traffic data retention requirements on providers, to ensure that requirements will not lead to liability for providers if they implement them lawfully.

(1) OJ L 201, 31.7.2002.