Vorratsdatenspeicherung nach EuGH-Urteil: Auch andere Datensammlungen müssen auf den Prüfstand

Im April hat der Europäische Gerichtshof die EU-Richtlinie zur Vorratsdatenspeicherung als unverhältnismäßig eingestuft und gekippt. Die rechtlichen Auswirkungen des Urteils sind jedoch noch immer nicht vollständig erforscht. Manche Mitgliedsstaaten (wie Österreich und Slowakei) schaffen ihre nationalen Vorratsdatenspeicherungen ab, Großbritannien hingegen hat erst letzte Woche eine neue Vorratsdatenspeicherung per Notstandsgesetzgebung erlassen.

Franziska Boehm, Juniorprofessorin am Institut für Informations-, Telekommunikations- und Medienrecht der Uni Münster sowie Mark Cole, Professor an der Fakultät für Rechts-, Wirtschafts- und Finanzwissenschaften der Universität Luxemburg haben jetzt im Auftrag des grünen Europaabgeordneten Jan Philipp Albrecht eine umfassende Analyse des Urteils erarbeitet. Heute wurde die 109-seite Studie veröffentlicht: Vorratsdatenspeicherung nach dem Urteil des Europäischen Gerichtshofs (Executive Summary).

Die beiden Rechtsprofessoren kommen zu dem Ergebnis, dass der EuGH ein Schlüsselurteil abgeliefert hat, das erhebliche Konsequenzen hat und haben wird. Die Allgemeinheit und Undifferenziertheit der Massenüberwachung sind eine schwere Verletzung der Grundrechte.

Das hat auch Auswirkungen auf die nationalen Gesetzgebungen zur Vorratsdatenspeicherung. Die Gesetze der Mitgliedsstaaten müssen sich ebenfalls an den Standards des EuGH-Urteils messen lassen. Werden diese jetzt nicht geändert, kann in jedem Staat gegen das jeweilige Gesetz geklagt werden, notfalls auch vor dem Europäischen Gerichtshof für Menschenrechte.

Auch andere Vorratsdatenspeicherungen auf EU-Ebene, beispielsweise Reisedaten beim PNR-Abkommen und Finanztransaktionsdaten beim SWIFT-Abkommen sind anlasslose Datensammlungen, die teilweise über die Vorratsdatenspeicherung von Telekommunikationsdaten hinausgehen. Vor allem die massenhafte Datenübermittlung in Drittstaaten wie die USA offenbart grundlegende Kompatibilitätsprobleme und widerspricht Grundsätzen des Urteils.

Die Konsequenz kann nur lauten: alle anlasslosen und massenhaften Datensammlungen müssen abgeschafft werden – sowohl auf internationaler als auch nationaler Ebene!

Hier ist die Executive Summary befreit aus dem PDF, Hervorhebungen von uns:

Executive Summary

This study analyses the Data Retention Directive Judgement of the Court of Justice of the European Union of 8 April 2014 and evaluates its impact on other data retention measures at Member States as well as at EU level.

Results of the analysis of the Data Retention Judgement

With its decision on the Data Retention Directive, the Court’s Grand Chamber has delivered a key judgement.

First, the judgement has major consequences on the relationship between the rights to data protection and privacy on the one hand and law enforcement (LE) measures on the other hand in the EU and its Member States. With the complete and retrospective annulment of the Data Retention Directive (DRD) it emphasizes the seriousness of the violation of fundamental rights by the Directive. It opposes the general and undifferentiated nature of data retention measures foreseen in the Directive and gives important clarifications with regard to the relationship between and scope of Article 7 and 8 CFR.

Second, by referring to the guarantees of the ECHR and its interpretation in the ECtHR case law in the context of data retention measures, the CJEU links irreversibly the two legal orders even closer than in the past and opens the possibility to interpret Article 8 ECHR and Article 7 and 8 CFR in a parallel way. Therefore, the statements of the Court not only refer to the singular case of the DRD, but also establish general principles for similar data retention measures.

These principles encompass the following points:

• The collection, retention and transfer of data each constitute infringements of Article 7 and 8 CFR and require a strict necessity and proportionality test.
• The Court clearly rejects the blanket data retention of unsuspicious persons as well as an indefinite or even lengthy retention period of data retained.
• The Court sees a sensitive problem in data originally collected for other purposes later being used for LE purposes. It requires a link between a threat to public security and the data retained for such purposes.
• The required link significantly influences the relationship between private and public actors. LE is only allowed to access data collected for other purposes in specific cases.
• The Court explicitly demands effective procedural rules such as independent oversight and access control.
• The collection and use of data for LE purpose entails the risk of stigmatization stemming from the inclusion of data in LE databases. This risk needs to be considered and should be taken into account when reviewing other existing or planned data retention measures at EU and Member States level.

Results of the analysis of the impact on data retention measures in the Member States

A further outcome of the analysis shows that national measures transposing the DRD need to be amended if they contain provisions close to those of the now void DRD. There is a close link between the standards of the EU Charter of Fundamental Rights and Member State measures in this field which leads to an equivalent standard for the validity test of the transposing law. If governments and parliaments in the Member States do not change their national data retention systems after the judgement, there are ways to challenge the national laws before courts which likely would lead to similar consequences for the national laws as the CJEU drew for the DRD.

The most promising way to have a national data retention law reviewed in light of its compliance with fundamental rights and compatibility with EU law is the initiation of legal proceedings in front of national courts. This will potentially include a preliminary reference procedure initiated by the national court for further clarification. Alternatively, after exhaustion of domestic remedies individuals could claim that national data retention schemes violate Article 8 ECHR before the European Court of Human Rights.

Results of the analysis of the impact on other data retention measures in the EU

The judgement also impacts other instruments on EU level concerning data retention and access to this data by authorities. The study therefore tested seven exemplary EU measures on compatibility with the standards set by the DRD Judgment, namely the EU‐US PNR Agreement, the EU‐PNR proposal, the EU‐US TFTP Agreement, the EU TFTS proposal, the LE access to Eurodac, the EES proposal and the draft data protection directive in the LE sector.

• All analyzed measures provide for data retention and affect an enormous amount of (unsuspicious) individuals. Some of the measures seem to be even more infringing than the original DRD.
• There are fundamental compatibility problems, in particular when it comes to undifferentiated bulk data collection and transfer of flight passenger and bank data to the US.
• The same problems arise with regard to the respective plans to establish similar systems at EU level. The rationale for these measures contradicts in essential points the findings of the DRD Judgement. The Court requires a link between the data retained and a threat to public security that cannot be established if the data of unsuspicious persons is retained in a bulk.
• The analysed measures show considerable shortcomings when it comes to the compliance with the fundamental rights which is why they need to be reviewed in light of the DRD Judgement.

Conclusion

The study has demonstrated the impact of the DRD Judgement on data protection and privacy in the LE sector and on other data retention measures. Essential is that blanket retention of data of unsuspicious persons for the later use for LE is not in line with Article 7 and 8 CFR since it is not possible to establish a link between the data retained and a threat to public security. Any possible future data retention measure needs to be checked against the requirements of the DRD Judgement. If the EU or the Member States plan to introduce new data retention measures, they are obliged to demonstrate the necessity of the measures in every single case.

A further important outcome for EU policy making is that if the EU enacts measures infringing Articles 7 and 8 CFR, it needs to define key terms that justify the infringement, such as the use of the data for serious crime purposes, to avoid a diverse interpretation of such key terms in the EU Member States. Moreover, the principles of the DRD Judgement also require a review of measures with the same rationale. EU bodies, particularly the Commission, must review the existing and planned data retention measures of Member States and the EU duly considering the DRD Judgement. The principles of the DRD Judgement further require a review and re-negotiation of international agreements (EU‐US PNR and EU‐US TFTP) since these agreements do not comply with some of the standards set in the DRD Judgement. Finally, the Judgement necessitates a redefinition of the relationship between public and private actors with regard to mutual data access and exchange in the law enforcement context.