* rC3 2021 Chaos-West TV preroll music *
Herald: Good, good afternoon, everyone. This upcoming talk is "Stop general data
retention in the European Union and the current plans for mass surveillance".
And it is not in German as the Fahrplan suggests. It's all done in English, but…
Dieser Vortrag wird also simultan übersetzt ins Deutsch.
So that's the extent of my German. I will carry on introducing the speakers.
Also not included in the line up in the Fahrplan is
Friedemann Ebelt, a freelance campaigner in Germany against data retention.
Another German is joining us, that is Patrick Breyer
who is a member of the European Parliament for the German Pirates.
And we stay in Brussels for a little bit with Chloé Berthélémy, who is a policy
adviser of European Digital Rights.
And we are also staying a little bit in European Digital Rights, because
We also have the chairman of the Danish NGO IT-Pol, Jesper Lund
That group's also an EDRi member.
And last, but definitely not least,
We have TJ McIntyre, who is a lecturer at University College Dublin, but is also
part of Digital Rights Ireland. And is one of the brains, together with Austrian NGOs
and activists, behind the original DRI Ireland case in front of the
Court of Justice of the European Union, which struck down data retention.
That was already in 2016. Time flies when you're getting old.
I'm going to hand it over to Friedemann, who is moderating this panel.
Friedemann Ebelt: Thank you, Walter, for introducing this talk.
And welcome everybody to this talk on mass surveillance of our communication data in
the European Union. And also thanks you for your interest in this very important
issue. I had the joy to organize this talk and I will help to navigate a little
through this session. And the key questions of this talk are going to be:
What is data retention? And what are the problems?
Also, what is the legal situation in the European Union?
And what are member state governments actually doing?
What is the Commission of the European Union doing?
And what's going on in the European Parliament?
Also important questions are… What's the situation in Germany?
What's the situation in France, Ireland, Denmark and Belgium?
And what can we expect from the new year, from 2022 and the future?
And of course, for many of you, one of the most important questions:
What can citizens do about mass surveillance of communication data?
You will find more information on the speakers, and you will find also
the audio and video to download on media.ccc.de
You can just search for data retention.
And of course, if you like, you can recommend the talk to others.
In general to follow the discussion on data retention during the year 2022 and beyond
you can use the hashtag #DataRetention
or the equivalent in your language.
In German, this would be #Vorratsdatenspeicherung
Patrick Breyer, as the member of the European Parliament,
will start this talk with the question:
What is data retention, and what are the problems?
Patrick Breyer: Thank you very much Friedemann.
And thanks everybody for joining us for this talk.
Data retention has been called the most privacy-invasive scheme ever
adopted by the European Union. But what does the term mean exactly? Now, data
retention means that a record is kept by your providers on all phone calls you made
and received, on all electronic messages you sent or received, as well as on the
IP address that was assigned to each of your internet connections.
So this means that the record does not contain the content of your calls
and messages, but details on who you were communicating with, at what time,
and, in the case of mobile devices, where you were located.
This record can be accessed by public authorities to investigate suspects
of serious crime. But it will be created even if you are not suspected or in
any way remotely connected to any crime.
So what is the problem with creating this sea of personal data?
For the first time with data retention, sensitive information is amassed
on the everyday social contacts, including business contacts,
on the movements and on the private lives of millions of citizens that are not even
remotely connected to any wrongdoing. The German Constitutional Court said
that data retention has a broader range than anything in the legal system to date.
And the idea of collecting information just in case you might need it
in the future, that idea opens the floodgates to recording our entire lives.
Including collecting our travels, using ANPR data, facial recognition data…
You name it. This idea of retaining "just in case" is what is dangerous about this
data retention. And that's why we are fighting this precedent so hard.
It normalizes mass surveillance.
Besides, a blanket telecommunications data retention has proven
to be harmful to many sectors of society. It disrupts confidential
communications in areas that legitimately require non-traceability. For example,
contacts with psychotherapists, with physicians, lawyers, workers councils,
marriage counselors, drug abuse counselors, help lines, et cetera. It thus
endangers the physical and mental health of people in need of support, as well as
of people around them. For example, a German crisis line reported they once
talked a student out of a killing spree that he was contemplating at his own
school. And you know, if you start recording information on these contacts
and people risk being prosecuted, they might no longer call and it might not be
possible to dissuade them from these kind of crimes. Furthermore, the inability
of journalists to electronically receive information through untraceable channels
compromises the freedom of the press, damages preconditions of our open and
democratic society. Blanket data retention creates risks of data abuse and loss of
confidential information relating to our contacts, movements, and interests. And
communications data are particularly susceptible to producing unjustified
suspicions and subjecting innocent citizens to criminal investigations
because they relate to a connection point, not a specific person. And let me briefly
explain why data retention is the problem and not the solution for law enforcement.
It is, as I explained, a weapon of mass surveillance directed against the entire
population. But on the other hand, the results are not even statistically
significant. So neither the number of crimes, nor the crime clearance rate
depends on whether you have data retention legislation in place in a country or not.
So I've commissioned the European Parliament's research service to look at
the statistics throughout the EU, and they didn't find one country where the
crime rate or the number of crimes depended on is a data retention law in
effect or not. But you'd expect it, you know, considering the breadth and mass
of information that's being recorded. Obviously, there are typically other ways
of clearing crimes than historical records. And also, blanket retention may
have counterproductive effects, pushing criminals to other terms and making
investigations even more difficult in some cases. And specifically, I want to say, in
relation to child pornography online, which is really the favorite, most popular
argument that proponents use currently. Let me underline that in Germany, without
mandatory data retention in force, 91% of all investigations of child pornography
are cleared. And the crime clearance rate actually dropped when IP data retention
came into force in Germany, about 10 years ago. Besides, anonymous communications
protects children by allowing for anonymous counseling that they are in need
of, by allowing for anonymous self-help groups, by allowing them to anonymously
file criminal charges. So don't be mistaken about the killer argument of
child pornography. It's an excuse, not a valid justification.
Ebelt: Patrick, since you explained what blanket or general data retention is all
about, it seems pretty clear that it's a huge problem in democracies. And it's a
huge problem for the freedom of our communications. But how about the legal
situation? And this is something TJ McIntyre, chairman of Digital Rights
Ireland, will explain us right now. TJ… TJ McIntyre: Thanks Friedemann. So the
situation here, if we go back to the early part of the 2000's, is that even in the
run up to 9/11, governments were using this kind of data retention essentially in
secret. And they were getting telecom companies to retain this information
without usually any real legal basis. And, after that was exposed, the early part of
the 2000's saw some national laws being rushed in, in a hurry, to try to legalize
this practice. But it also saw a lot of challenges brought by civil rights groups
to these practices. And there were successful challenges in many individual
countries on different grounds, in Germany, Romania, Bulgaria and so on. But
what was most interesting from my perspective was when the battle shifted to
the European level, because there was a move to introduce a European law, which
would require data retention across all of Europe, which was eventually adopted as
the so-called Data Retention Directive. And we in Digital Rights Ireland, along
with colleagues from many other civil rights groups, brought action seeking to
challenge this. And eventually we were successful in doing so before the European
Court of Justice in 2014, which invalidated the directive on the basis
that it was essentially disproportionate and a gross invasion of privacy, one that
creates real risks of abuse. If we had a piece of legislation which involves
creating these huge dossiers of data on everybody indiscriminately. So that was
2014, and since then we've seen massive national pushback against this finding,
that this kind of indiscriminate data retention is disproportionate and
therefore contrary to European law. And we've seen multiple cases since then where
national governments have tried to persuade the European Court of Justice to
change its tack. There was a judgment in 2016 in a case brought by litigants from
the United Kingdom and from Sweden, the Tele2 and Davis and Watson case. There was
a judgment in 2018 in a case arising from Spain. There was a judgment in 2020 in a
case coming from France and the United Kingdom, the Quadrature du Net and the
Privacy International joint cases. And again and again and again, what national
governments have tried to do is to persuade the European Court of Justice
that it was wrong in 2014. That this finding that mass indiscriminate
surveillance is unacceptable in a democratic society should be rolled back.
Now, to my mind, what's very interesting is what's happening at the moment. Because
there is yet another of these cases, in fact, three parallel cases before the
European Court of Justice at the moment, where national governments have
essentially again tried to square up to the European Court of Justice. Where
collectively – this is really quite remarkable, I don't think we've ever seen
such a coordinated set of national disobedience to court rulings before –
where collectively, national governments across the EU have tried to say to the
European Court of Justice, "we need this kind of mass surveillance," – though,
without producing any evidence to show that it's in fact necessary, as Patrick
points out – "We need this kind of mass surveillance. We think you are wrong. We
want you to change your mind on this." So, this to me is rather worrying because it
shows, I think, a degree of lawlessness here. National governments are unwilling
to accept the findings of the highest court in Europe on this point. In some
countries – in Ireland, for example – the law and the theory hasn't been changed at
all. Despite the multiple judgments in this area, Irish law remains as it was in
2011, so predating all these cases. And the Irish government has essentially
indicated that it plans to keep that law in place until it is forced by the
judgment of the national courts to do away with it. So we have, I think, a very
difficult situation here. In one sense, of course, we've been very lucky. We've
achieved a number of very important judgments from the European Court of
Justice. We have a court there whose members understand the importance of this
issue. But against that, you have a real problem here with national pushback and a
desire to eventually force down the court. And perhaps wait until the
composition of the courts changes in future and get more favorable precedents.
So I think, from that perspective, it's very important that at a national level,
we push to increase the political pressure against these laws. And, as far as we can
at European level, we try to push the Commission to act, to take steps against
member states that have refused to implement judgments of the European Court
of Justice, and to ensure compliance with European law.
Ebelt: Thank you, TJ. Now, following the legal situation, let us have a look at the
implementation of law. And here, one of the or maybe the most important players
in the European Union is the Commission of the European Union. And this question goes
to Jesper Lund, chairman of the IT- Political Association of Denmark.
Jesper, what is going on at the Commission?
Jesper Lund: Thank you, Friedemann.
So, essentially, every since the Data Retention Directive was annulled in 2014,
there has been an ongoing discussion: is there going to be a new data retention
instrument at the EU level? And so, besides waiting for the Commission, this
discussion has also been going on in various working groups of council
where member states meet in secret. Fortunately, some of that documents are
leaked or obtained through Freedom of Information Access requests. So we sort of
know from this process that that, as TJ mentioned, member states are in complete
denial. They refuse to accept that general indiscriminate data retention is illegal,
and try to move on from that starting point. So most recently, I think, the
Commission has sort of taken a hold... wait and see attitude, wait for the next
judgment. But after the La Quadrature judgement in October last year,
the Commission has come forward with a non-paper in June which generated a lot of
attention. So it's mostly a paper that that asks questions to member states, but
sort of reading between the lines of the paper, we can also see what plans the
Commission might have for a not necessarily a new data retention law; that
is one of the options for member states. It could also be guidance for member
states. But sort of going through the paper, it follows roughly the judgment in
the La Quadrature case. One novel aspect of that is that the court reaffirmed that
we cannot have mass surveillance, general and indiscriminate data retention, for the
purpose of combating even serious crime. But it is possible unfortunately the court
said, it is possible, in certain cases, to have general and indiscriminate data
retention for national security, if there is a serious threat to national security
that is as genuine and present and foreseeable. It's pretty clear from my
reading of the judgment that this must be an extraordinary situation where
surveilling everybody for a short time can help prevent a very serious threat to
national security. But the commission is using that, and member states are also
doing that. We'll get to that later. Using that as sort of a starting point to have
general and indiscriminate data retention. So the commission asks – even though
national security is the sole competence of the member states,
and the commission is very unsure of any legal basis here –
whether there should be an EU instrument on data retention for national security.
One thing to note here is that this might be even worse
than the Data Retention Directive because the commission indicates that this
should not just cover telecommunications services, as the Data Retention Directive
did, but also so-called over-the-top providers (OTT's.) Which would be services
like Signal, WhatsApp, Facebook Messenger, and so forth. And this could potentially
be an EU legislative initiative, whereas perhaps data retention for traditional
telecommunications services could remain with member states. The Commission is also
suggesting that there could be a mixed approach of national legislation and and
EU legislation. The Commission is also asking member states about targeted data
retention. This is what the court has said since, essentially since the first judgement
that general and indiscriminate data retention is not allowed, but targeted
data retention could be allowed or is allowed by EU law. And unfortunately, what
the Commission does in this area is so, take every hint in the La Quadrature
judgement, and sort of amplify to make targeted data retention cover as much as
possible. It's pretty clear from the judgment that targeted data retention has
to be the exception, not the rule. It cannot cover half of the population. But
this part is sort of forgotten by the Commission in the non-paper. So they
mentioned a long list of areas: critical infrastructure, transport hubs, and then
areas with above average crime rates. This is not exactly what the court said; said
specific areas of high incidence of crimes or above average could very easily include
a large part of a member state. And then on the person-based targeted data
retention, it sort of mentions almost everybody who could be of interest to the
police: known organized groups, individuals convicted of serious crime,
individuals who have been subject to a lawful interception order, individuals on
watchlists, and so forth. You know the tendency of the police and secret services
to put people on watchlists in secret, that this can presumably be very long.
In connection with this – it actually gets even worse – because in connection with
targeted data retention, the Commission mentions the idea of having subscriber
information collected on everybody and verified subscriber information, including
mandatory and EU-wide mandatory obligation to have registration of anonymous SIM
cards, pay as you go SIM cards. And this is sort of justified by the targeted data
retention. We need to make sure that the right persons can be targeted.
The non-paper also mentions quick-freeze or expedited retention. This is interesting
because quick-freeze data preservation is what civil society has called for as
the alternative to data retention, basically ever since the mid-2000s.
And finally, it goes into the generalized retention of IP addresses, which the Court
of Justice unfortunately allowed on a general and indiscriminate basis in the
La Quadrature judgement, but limited to serious crime. Just looking at the
questions, Commission is asking member states whether sufficient, whether all
relevant cybercrimes are covered by their notion of serious crime. Let me briefly,
in conclusion, mention some of the member states' reaction to this. Statewatch did a
Freedom of Information Access request with the Commission to get a response from
member states. Most of them refused, but some Denmark, Finland, Germany,
Hungary, Luxembourg, the Netherlands, and Sweden provided their responses.
In general, they want an EU instrument, but they're not interested in having that
cover national security. They're also not too keen on targeted data retention, and
they don't really like the idea of quick- freeze. So it's not entirely clear what
this EU instrument should cover. Except while they want, you know, indiscriminate
data retention for everything, but they can't have that. And that is their chosen
state of denial, which has been going on since the first judgment in 2014.
Let me let me stop here as the summary of the present EU initiative,
and we'll continue later.
Ebelt: Thank you, Jesper.
So the Commission is communicating and negotiating a lot with member state
governments, and the aim seems to be to find new ways for more mass surveillance.
So of course the question is, how do national governments
in the European Union treat fundamental rights and respond to the legal situation?
So what is going on in EU member states? And maybe let us start with France,
where Chloé from EDRi can tell us about the situation.
Chloé Berthélémy: Sure, thanks. I'd like to introduce
a little bit maybe the work of our EDRi member in France?
So EDRi is a network of members, and one of them is La Quadrature du Net.
And they were among the main
*sounds of fixing microphone*
Hmm, would this one work? Yes, OK. Sorry about that.
Yes, so I wanted to talk about like the work of like La Quadrature du Net,
our EDRi member in France. Sorry for all the technical details.
They were one of the main plaintiffs that led to the landmark ruling,
La Quadrature du Net, that was mentioned already a couple of times now.
And they brought this case, like the procedure started already in 2015.
They went in front of the Council of State in France
after the first ruling by the Court of Justice of the European Union in
in Digital Rights Ireland and wanted to have the legal framework in France removed
or annulled by the Council of State. And obviously, that wasn't to the taste of the
highest administrative court in France, and they decided to refer yet another
question to the Court of Justice. That led to the famous ruling in 2020 in October,
saying that the National Legal Framework in France is actually contrary to EU law
and to the Charter of Fundamental Rights. But unfortunately, what the kind of, the
aftermath of this ruling in October 2020 shows us is that France is, possibly, one
of the most aggressive, offensive member states in the EU who is willing to
really pay the price and the high price to keep its mass retention regime in place.
The reason why I'm saying this is because the government made a huge advocacy
campaign towards the Council of State, so the highest administrative court again
charged to actually give its decision after the CJEU ruling. They submitted
weeks before the decision was released by the Council of State, a statement of case.
And in this statement of case, they argued that the Court of Justice
of the European Union would have actually had abused its powers,
and actually wanted to advise the Council of State to ignore
everything that the court has said, and mentioned that this is
way beyond its jurisdiction to actually limit member states in the EU
with anything related to the fight against terrorism
or everything related to national security
and therefore the ruling should be completely ignored.
The Council of State more or less followed this government approach.
Obviously, not as radical position as the French government said.
Because I think it was reported even … the press, that
at one point the French government
was really willing to even negotiate a reopening of the EU treaties
and notably the charter. They would go as far as
going against the primary law of the European Union
to change it in order to accommodate France needs in terms of national security.
Which was pretty strong and quite telling in terms of like the contradiction
that there is with France's typical kind of reputation as a pro-European Union
integration leader. As like, a reputation it has to just drive
EU integration forward and be pro-European in general.
So they're really willing to jeopardize their position
as a strategic position in those fields to keep mass surveillance in place.
And so to all appearance, even if the Council of States said that
the decrees in place since 2015 should be revised, they largely actually give the
legislature all the keys and solutions, corrective solutions, to just maintain the
surveillance regime in place. So how it did that? I'm not going to go through the
entire judgment, because it's rich and there is a lot of conclusions that we
could like analyze, and it's super interesting. But maybe one that is quite
telling I would mention. And that shows like how France is willing to do anything
to keep its data retention in place, and the matter that is indiscriminate in
general, is the reinterpretation of the notion of national security. And in this
notion of national security, it goes far beyond terrorism and thus was also like
showcased during the hearing made by the Council of State just before it released
its decision. There was the general, the director general of the intelligence
services, talking at the hearing and mentioning 'actually terrorism, we have
all the legal tools at hand. It's not so much that you are limited in competence.
What afraid us is more like the, if we apply the CJEU ruling now, we will have
less power to actually surveil and spy on people who are at the kind of the
forefront of social movements, or who are organizing like demonstrations, who are
engaged in social justice fights, and so on. And so in this context of, in this
notion of national security, the Council of State is putting any threat to the
economic interests of the French nation. So they are thinking about economic
espionage, but they're also thinking about mild, like drug trafficking, even like the
smallest networks in your city suburbs? Like that could also fall as a threat to
national security and justify the indiscriminate and general data retention.
And then lastly, the organization of non- registered protests as a permanent threat
to public peace, they call it "public peace". And so that would justify
a general kind of threat to national, that would like demonstrate a threat to
national security permanently and allow France to keep its indiscriminate and
general data retention regime for good. Completely contrary to what the Court of
Justice said, obviously. And even going beyond what France has in place until now,
which was like the state of emergency. I think this is something that many of you
probably heard in 2015, during the terrorist attacks. France reacted
strongly, implemented a lot of measures that were anti-democratic, very like going
against rights and freedoms. That was supposed to be temporary. Unfortunately,
following the ruling by the Court of Justice – and this is also a natural trend
and flow – they decided to bring all those measures that were exceptionally allowed,
in exceptional times. And now they proposed recently in April – just a
few weeks after, a month after actually the decision of the Council – a reform that
brings everything, all of these measures into ordinary law. So obviously what the
Council of State has said: indiscriminate general retention obviously always OK,
because there's constantly threats to national security. But there is obviously
other measures linked to house arrest, use of drones, cooperation with private actors
to enable government hacking into end devices of users, etc. etc. And so all
of this is packaged into one nice little law. And the latest development that I can
share with you in France is that the …
the socialists in the parliament blocked
submission of this bill to the council, the Constitutional Council of France, the
only kind of institution that is left, that kind of like control a little bit
what the government has to say, and put forward as legislation.
And unfortunately, the part related,
like the provision related to data retention in this bill
weren't submitted to the Constitutional Council,
so they never had any say in this. And so now the project is adopted.
Which is like, this is…
Voilà. Rubber stamped. What the Council of State has decided for France.
And this will be very difficult in the future to attack again.
Ebelt: Thank you, Chloé.
I must admit that it is extremely interesting to hear about the situation
in France, but it's also extremely shocking to hear about the strong tensions in the
relations between governments and courts, and governments and rule of law.
And now, to everybody who's watching this talk live,
you can send in your questions to the speakers
by using the hashtag #rc3cwtv,
because we are having a Q&A after, right after the talk.
And maybe we will come back to this point in the Q&A.
And the hashtag is for Mastodon and Twitter.
Since recently, there's a new government in Berlin.
And also, Germany is next to or together with France
a big and important player in EU politics.
So also, there's a new situation in Germany with data retention.
And of course, this question goes to Patrick Breyer
as a German member of the European Parliament.
Patrick, what can you tell us about the situation in Germany?
Breyer: Well, legally speaking, indiscriminate data retention legislation
is in force, but it's not being applied due to a pending court cases that have
said that it violates the EU case law and charter of fundamental rights.
The European Court of Justice will rule, will decide next year on the compatibility
of the German regime with the European fundamental rights. And in the meantime,
the new government has agreed that data should be retained on an ad hoc basis
and by judicial order only. Now, on the one hand side, this excludes sort of
indiscriminate and general regime. But on the other hand, after what you've
heard from previous speakers, you will know that it does not exclude, for
example, a geographically targeted retention that could cover vast parts of
the country, above average crime rates and the like. Nor does it really exclude the
retention of data referring to a present or foreseeable national security threat,
which could also be said to be on an ad hoc basis. So we'll have to watch
very closely what the government will do. The Liberals and the new Justice Minister
are advocating for quick-freeze. But there is a risk, for example, that in the
pending procedure, the courts will not invalidate indiscriminate IP data
retention. You know, saying that the European Court of Justice said all IP data
retention is OK. And there is a risk that the coalition cannot agree, cannot find a
majority to agree on abolishing it politically. So we'll have to see and
watch very closely how the new government will behave also at a European level.
Ebelt: Thank you, Patrick. You said there is a pending procedure on data retention
in Germany, and I know there's also a pending court case, if I'm not mistaken,
on the national data retention regime in Ireland.
And TJ, what can you tell us about the situation in Ireland?
McIntyre: So there are, in fact, three
cases before the Court of Justice at this moment: one from Germany, one from
Ireland, and a parallel one from France. And what to me is very interesting about
those cases is not so much the questions that are asked, but how the court has been
dealing with the case. So the questions that are asked are basically the same
questions over again. Can we have indiscriminate mass retention of data
where we need it for dealing with serious crimes? That is essentially the question
that the Irish court has asked. Again, it's basically putting it up to the
European Court of Justice to change its mind. And then the questions from
Germany are very similar, because we're dealing with the law, which is again
indiscriminate, albeit that the German retention period has now been reduced to
approximately 10 weeks, I think, Patrick. And the question from France is a slightly
more technical question and parralel area of law. But again, the national
governments were taking the opportunity here to push the agenda of looking to
rewind the time machine to 2014, prior to the Digital Rights Ireland judgment, and
go back to a situation where mass indiscriminate retention was allowed.
What the court did, to my mind which was very interesting,
in dealing with these cases, was it initially said, right, we're going to
ask the national courts, do they really want us to hear these cases?
After the La Quadrature du Net judgement the Supreme Court of Justice
reached out to the Irish Supreme Court, for example, and said to it
essentially, "Listen, we've already answered your question. Do you
really want to go ahead with this case?" And in fact, the advocate general
suggested something even more dramatic, if you like, as a response.
Where he said that the response of the courts should be
to dispose of the case using Article 99 of the Rules of Procedure of the court.
Now that might not sound very interesting, but Article 99 basically means you can take
an incoming request from a national court and say, "We've dealt with this already. We
We don't need to hear this case, and we can dispose of it without a hearing." So
the advocate general and I think the court itself is intent here on sending a signal
that we've decided, we've made up our minds regarding these cases, we're not
interested in hearing more and more national cases coming back to us for
national governments. We'd really like you to change your mind now. The Court of
Justice, to my mind, is about to send a signal here where it says, look, the law
on this point is settled. Please go and try and implement that law in good faith,
as opposed to coming back to us with ever more ingenious ways of arguing in favor of
mass data retention. The real question, of course, is whether that's going to happen,
whether national courts are going – national governments, I should say – are
prepared to respect the rule of law. Or whether, as Chloé pointed out, they're
going to be prepared to continue to manufacture a crisis, to manufacture a
collision between national law and European law for the sake of promoting
this surveillance agenda. And unfortunately, I suspect the national
governments are more likely to do the latter than the former. I think it is very
likely that we'll continue to see pushback from them.
Ebelt: Thank you. Next question goes to Jesper. And it would be, how is the signal
– that's how you, TJ, framed what's going on – how is the signal from the European
Court of Justice received in Denmark?
Lund: Well, thank you very much.
*cough*
Sorry. Well, the current Danish data retention law, which is about to be
updated, is essentially the old data retention directive, so general and
indiscriminate data retention of telecommunications services,
kept for one year.
There's a court challenge to that which is still ongoing. The Association
Against Illegal and Mass Surveillance actually lost the case in the first
instance because the government, the Ministry of Justice, argued that the
Danish law should not be annulled. Rather, it should not be applied to the extent
that it is against EU law. So to some extent, this is the same situation as in
Germany, although the Danish telecommunications providers are retaining
the data voluntarily as though the law is still in effect. So to some extent, that
is a sweet spot for the government. Officially they do not have to apply the
data retention law, but telecommunications providers are respecting it anyhow.
Nonetheless, the Danish government has taken upon itself the task of adjusting
Danish law, claiming that after these adjustments, it will be compatible with
the case law of the Court of Justice. So that sounds very interesting.
Unfortunately it's a total exercise in circumventing the court, because, in the
end, we will have almost exactly the same data retention as we have today. It'll
just be relabeled in a way that the government claims it complies with the
Court of Justice. And sort of the main vehicle for doing that is the same one
used in France, namely data retention for national security. So Denmark is going to
claim similar to what France is doing, that there is a quasi-permanent threat to
national security, which justifies the general and indiscriminate retention of
all communications data. Some of the safeguards in the La Quadrature
judgements, such as review by an independent court of these renewable
decisions for general and indiscriminate data retention, are ignored completely.
The Ministry of Justice says, well you can sue us if you disagree with our decisions,
and by the way, the your civil court case will not get access to all the evidence
that the Ministry of Justice used to justify the general and
indiscriminate data retention due to our threat to national security. So it's an
almost impossible situation. However, it gets even worse, because you if you have
data retention for national security, you would sort of by the principle of purpose
limitation, you would assume that it is limited to that purpose only. The Danish
government disagrees with that, because the retained data, similar to France, can
also be used for serious crime. So that is, in effect, maintaining the current
data retention regime, except relabeling it as data retention for national
security, but mainly used for the purpose of combating serious crime, as it is done
currently. There's a small catch here. The Danish government recognizes that there is
significant legal uncertainty with this interpretation that it can't be used or
accessed in cases of serious crime. So it's actually very possible that
Denmark will one day send a data retention case to Luxembourg. So let's see
how that goes, when the Court of Justice believes that every possible question
about data retention has been answered. But this is not the end of the story in
Denmark. So the Minister of Justice is aware that one day it may not be possible
to maintain general indiscriminate data retention, because it has to be for a time
limited period, so that cannot be evaded forever. There's also the possibility that
the Danish government might lose a court case. So as an insurance policy to cover
this situation, there is a provision on targeted data retention. This would only
kick in if the general and indiscriminate data retention for national security
cannot continue. And it is not really targeted, because the, just like the
European Commission obviously tries to do with the non-paper that I
described earlier, so the Danish government is taking the possibilities for
targeted data retention, adding them together to the extreme. So the
general criterion for above average crime rates is defined in a way that makes no
adjustment for a population density. So any city or city-like area in Denmark will
have an above average number of crime cases, and that will be included in the
geographical targeted data retention. So 5%…sorry. 75% of the Danish population
lives in 5% of the Danish territory, the cities. They will be surveilled just like
before. On top of that, you have infrastructure sites: every train station
or almost every train station and the mobile towers are selected, so that these
areas are covered in full even though it means surveilling people outside these
areas. So in the end, with the targeted data retention, something like 80 to 90 %
of the Danish population will be covered. On top of that, there are person-based
criteria, where every person convicted of serious crime, every person that's
been subject to lawful interception, criteria mentioned in the non-paper from
the commission. And even with all of that – generalized indiscriminate data
retention continuing, an insurance policy with targeted data retention that covers
80 to 90 % of the Danish population – the Danish politicians, those that are in
favor of data retention, which is a vast majority, complain that they have to
restrict the law because of the Court of Justice in Luxembourg. And they are
saying, these are, they're really using rhetoric that's that we would expect from
from Hungary and Poland. Judges lack the democratic legitimacy, why should they
interfere with Danish politics, and so forth. That is a really terrible situation
for the rule of law in Denmark and Europe in general. So this is sort of...
on a couple of minor tweaks also, there will be mandatory SIM card registration in
Denmark as one of the last EU member states to introduce that,
unfortunately. There are a couple of others that also don't have it yet.
And the threshold for serious crime will be lowered as well. So in effect, even though
if this is presented as adjusting to the case law of the Court of Justice, we will
have in practice more data retention and police would have easier access to the
data. I really hope that this does not become a blueprint for how other member
states in Europe adapt to the case law from the Court of Justice.
But it is unfortunately following the non-paper from the Commission,
perhaps putting it to the extreme more than the Commission intended.
But certainly not the response that we hoped for.
So the fight in Denmark will continue, I can assure you of that.
And let me stop here and pass the word back to Friedemann.
Ebelt: Thank you, Jesper. Yes…
I think the fight needs to continue.
And you said that a lot of data retention politics has to do with
circumventing the court and ignoring decisions and the rule of law.
And on an EU level, a lot of this politics takes place, of course, in process at the
European Parliament, at the Commission. So…
And after hearing this, I… Yeah. I hope…
Chloé, maybe you have some good news for us? What is the situation in Belgium?
Berthélémy: I'm afraid not so good news either from Belgium.
Let me try to a draw a little bit the situation from what happened
since, again, the landmark ruling in October 2020. So it's funny. The
Constitutional Court in Belgium released its decision following that, that ruling
on the 21st of April. So that means one day after the French Council of State gave
its decision. And I listened to the President of the Court of Justice, who was
invited once at a French National Assembly, in front of the committee
specialized in legal affairs and European affairs. And he were saying, "Oh, don't
you imagine that those two jurists, the two courts obviously talk to each other,
and this is why they released their judgment so close to one another." And
those are two very neighboring countries, friend countries. So you can imagine that
they discussed and they exchanged on their point of view on the CJEU ruling.
I was like, well, probably if this is the case, they… probably like the conclusion
of their talks was "we agree to disagree." Because the Constitutional Court of
Belgium choose a completely divergent way compared to the French Council of States –
which I remind you completely to go completely rogue and ignore the court's
main conclusions – the Constitutional Court decided to basically implement what the
CJEU said. And decided, gave the Belgian government the task to find the solution
for itself. So completely something else, than the French Council of State has done.
Which, in its case, was really like giving the French government the concrete
corrective measures to maintain its regime in place. In Belgium, it was: Your legal
system is false and should is annulled. Now you have to work on the solutions
yourself. And so this is what the government has been doing. They have done
it for a month only. So a month later they came up with a bill, with a proposal
for a new law. And that was proposed by the Council of Ministers. Mainly what the
bill contained is a system, is a regime for targeted retention. So they they are not
even like going for the national security mass retention thing.They try out the
targeted retention approach, and they mainly focus on the criteria of
geographical areas. They also include individual-based criteria, but mainly they
focus on how can we maintain data retention as much as possible based on
this geographical measures and measurements. And this is basically what
Jesper explained for Denmark. This isn't very far from actually including the
entire country on there, just "targeted" data retention. The way to do that is,
they the select first like geographical areas that they call "by nature sensitive"
for national security or for any kind of public security. And that includes
airports, train stations, metro stations, so you can already imagine that Brussels
is entirely covered, the border zones with like the neighboring countries,
hospitals, motorways (there's a lot of motorways in Belgium), research centers
so everything that has to do with like state innovation, state research and
everything, justice and police buildings, and all infrastructure, and then all the
municipalities. So the entire territory of the municipality of a city, even small,
which has on its territory critical infrastructures. So water supply, energy
supply, everything. And you can already see like, it's just this list of
geographical like places that the government selected. Given the density,
the urban density of Belgium, the size of the country, it already covers quite a
bunch of people. And a large proportion of the population will be submitted to data
retention, to this "targeted" just in name retention. And they all also use, as
Denmark, the average crime rate. This has been criticized heavily by the
Data Protection Authority in Belgium. They said that the Minister of Justice failed to
provide any statistics to actually explain why they decided this number, this amount
of years. And they even criticized the source of the statistics that will be used
to determine whether a judicial district will be subjected to data retention or
not, because the government wants to use a police database where crimes are
registered. But it's mainly managed and it's exclusively managed by police
officers. So there is a high risk and a conflict of interest that police officer
will just determine one minor act or one minor offense into a serious crime. And so
therefore their police district or their judicial district will fall under data
retention. The database is called the BNG, the BNG. And it was heavily criticized by
journalists in Belgium. They released an entire investigation into the BNG, and
they show that the BNG mostly contained false, like a lot of false information,
rumors, non-verified information, or outdated information as well. And so the
DPA, the Data Protection Authority, required that they use a different
database with actual like criminal offense that led to a conviction that led to a
criminal sentence. Which makes more sense, it's not even given. So this is all the
problems we see with the Belgian bill. This is not limited to that, it is only
the two things that I can mention now. There are many other problems that the DPA
objected to. But for now, the chance we had is that this bill also contained very
dangerous and controversial provisions on access to encrypted content, with the
possibility to force service providers to switch off encryption for certain users.
And thanks to that, there was enough like resistance from civil society and outrage
in the public to halt a little bit the bill. So now it's still under negotiations
with between the ministers before it is presented to the parliament.
But we hopefully can also bring some more attention and traction
on the data retention provision of this law, and try to…
Yeah, halt as much as possible
the general mass retention of metadata in Belgium as well.
Ebelt: Thank you, Chloé. OK. There are many, many problems, but luckily there's
also civil society, and there are also freedom advocates.
So the big question I would really, really like to hear your opinion on is,
what do you expect from the future?
How should governments – but also maybe the Commission of the European Union – act?
What should they do?
Let's hear TJ first.
McIntyre: Thanks Friedemann. Well, I think the problem is, we know what governments
should do, which is comply with the law, and that they're unwilling to do that. So
perhaps the question could become, what can we do to force them to comply with the
law? Now, as civil society, we are collectively already very much
overstretched, I think. Particularly, at the moment most people are doing this,
myself included, as a part time thing. It's unusual to have an organization such
as EDRi, which is quite professional in this regard, when particularly the smaller
member states, this tends to be a part time activity for a small number of
technologists, a small number of lawyers, and so on. So maybe the first thing
everybody should be doing is supporting their local digital rights organization
and I think probably all agreed on that. Otherwise, we're caught in something of a
loop here where we're being reactive. Governments put forward laws which are
ever more draconian, which very often breach existing precedent from the Court
of Justice, never mind the Court of Human Rights. And we as civil society have to
respond to that very expensively. The cost, for governments, of introducing new
measures is, relatively speaking, low. In the sense that, if it doesn't meet with
great domestic political pushback, it's quite straightforward for them to push
forward new measures. And those measures can often remain in place for months or
even years before there is litigation to challenge them, if indeed it's possible in
a particular jurisdiction to bring litigation to challenge them. So as civil
society, we're always on the back foot here. It is very much a reactive sort of
game that we're playing. Ultimately, we need to increase the costs for pushing
these kinds of very illiberal measures, and we need to do that at the point when
those measures are being proposed and adopted. And I think we can learn here
from the German experience and the way in which data retention and encryption and
communications have been baked into the coalition government's negotiations.
That's something which I think we, as voters and advocates need to try to get
our governments to do at the point where those governments are being formed. Short
of that, though, I don't really have any great answer, Friedemann. I'm sorry.
Perhaps somebody else might be able to take it further.
Ebelt: I think that's a great answer. And yet, Patrick, what we what are your
thoughts on the future? Breyer: Well, I can tell for the European
Parliament that I don't know what the majorities would be if the commission
proposed another data retention legislation. Because, you know – having
seen what's happened with chat control, where they justified even the scanning of
content of communications, a blanket indiscriminate, using the child protection
killer argument – I'm not sure that the European Parliament's majority would go
against another data retention instrument, especially if it claims to abide by the
European Court of Justice jurisprudence. And also, I'm very outraged at the
European Data Protection supervisor who, in those court hearings that we've
discussed earlier, actually undermines the ECJ jurisprudence and says, you know, what
matters is access to data, not so much the storage. It's really outrageous. So, but
one good thing from the European Parliament is that in the pending trilogue
on the eprivacy regulation, on the reform, the majority agrees that we won't accept
to have data retention in that specific instrument, because it's about eprivacy and
not about e-surveillance. So what I'm trying to do at the EU level is to
push back in the very early stages of the political process. First of all, I'm very
happy that I found Friedemann to support my work. Last year, I have
commissioned a study by the European Parliament's research service to compare
crime rates throughout the EU. I've already told you about that. And
currently, I have commissioned a poll to find out the public opinion on data
retention in several EU countries. We'll have the results early next year. And
I will also commission a legal opinion, ask a former Court of Justice, European
Court of Justice judge, to write a legal opinion on the French resurrection of
indiscriminate data retention, because that is a model that they are using,
more and more countries are using. So if you have any more ideas about
what we could do at EU level, please let me know.
Ebelt: Thank you.
Well, Chloé, what do you expect of the future or maybe 2022
from your EDRi, European rights, NGO perspective?
Berthélémy: Sure. Well, we'll continue
obviously monitoring the situation at EU levels, just like Patrick does, only like
with our network of experts and NGO.
Obviously, looking at what the Commission has in mind and where this like
long year process of like thinking how all of this can be like put together
and enable mass data retention without like…
without like insulting too much the Court of Justice will lead to actually.
That would be obviously one of our main tasks for the future.
We'll continue, as I said, as a network to monitor what's going on at national level.
So, and as TJ said, we are lacking resources, especially at national level,
to follow all the 27 jurisdictions.
So if you're just interested, and it's in your country, I would just advise
viewers now to look at, look up on EDRi's website our map of members. And
You can join and get in touch with some of them at their contact email address.
If you want to lend a hand and contribute to just monitoring, because the
first step of what we're doing as civil society is just bring a light to those
developments. Because most of the cases, like in many times, it's just going under
the radar. The media isn't picking up the stories so quickly as we would like them
to do, and all those kind of really rights-violating measures can go unchecked
without any kind of democratic pushback or anything. So this is the kind of the first
that I would recommend for viewers to do if they want to get engaged, is basically
join us. Follow us on social media. Follow our website. EDRi has a newsletter where
each and every members of EDRi can contribute, and write, and even guest
writers sometimes. If you want to write about the situation in your country
and you've investigated a little bit the state of play, please talk to us and drop
us an email. Everything is… Obviously all the information of contact can be found on
our website. And you can obviously subscribe to this newsletter.
If you want to go a bit further and get really engaged
like the step, the kind of, the scale of engagement,
you can join us on our mailing list dedicated to the topic data retention,
just by dropping me an email. If you're really into it and
want to contribute actively to the analysis, to possible future campaigns,
or any kind of advocacy actions, we're organizing at EU level.
And then… That's for kind of the…
I think I didn't forget anything you can do as viewers.
In general, what we're looking for, we'll try to push the Commission. It's…
I think it's a dead wish, but I will mention it nonetheless.
We would like the Commission to do, to launch infringement procedures
against countries that do not comply with the CJEU ruling.
As I said, it's a dead wish, because this is a highly political topic.
The Commission has stated multiple times in public that it won't do this.
They're not interested in doing this. They're interested in being in a
cooperative state of mind or spirit of collaboration with member states to find
solutions. Another word for saying, we will ignore what the ruling, what the
ruling says and try to find solutions that can work out and that avoids like
the painful and embarrassing situation of having a future EU legal instrument being
struck down by their own courts. But yeah. This is to be seen. We'll work together
with Jesper. I don't know if you have anything to add, Jesper, to that.
If I forgot something.
Lund: No, I think… So even monitoring the situation
in 27 member states is a huge task, and we definitely need help on this.
Denmark is well covered, but
there is also Sweden…
Many, many different member states.
Mostly you have governments that like data retention and either
try to just ignore the Court of Justice or, as Denmark is doing, make
adjustments to the national law that are not real adjustments, but just try to
maintain what is already in place under the guise of adjusting to the Court
of Justice. Or, we have talked about France, Denmark, Belgium as cases
that really try to circumvent the case law. So keeping…
One definite risk here is that data retention will be forgotten.
That is what member states want, so that nobody talks about it.
So we need to, yeah, we need to keep the public debate going
and make sure that…
contact journalists, make sure that they write about data retention.
And also, I think focus on the rule of law problem that is associated with this area,
because it's really not a sustainable situation that
all member states are ignoring fundamental rights.
Ebelt: In the end, everything sounds also a little bit promising. And at least,
let's not forget this is about, it's about the citizens, it's about the people,
it's about their data, it's about their governments, it's about their freedoms.
Do you have or do you would like to add something?
I mean, here as the speakers?
If not… You still have time to interrupt me.
We can have… I would hand over to Walter, and
we can we just go into the Q&A part of the talk.
And I would thank everybody too, for joining this talk.
Also, thank you to the speakers. It's been really, really interesting.
And to everybody who liked the talk you can recommend it, and
you can get the audio and video to download on media.ccc.de
And of course,
Join the discussion on data retention by using the hashtag #dataretention
or the hashtag that is used in your language.
So Walter…
Herald: Before we go into the questions that have we already have collected
through Mastodon, IRC, Matrix, and Twitter
TJ wanted to add something earlier on while Chloé was still talking, I remember.
McIntyre: Thanks Walter, Chloé's
points reminded me of something that I was very impressed
with from the German campaign against data retention, which was the great use of
civil societies – the groups representing journalists, lawyers, medical
professionals, and so on – to make the point that communications confidentiality
is important for them, too. And that's something I have to admit that we didn't
do to the same extent in Ireland, but it's certainly something we've tried to do. And
to the extent that anybody listening to this now is from a group where they have a
professional interest in communications confidentiality, I think it's a good thing
if you can work through your group to try to develop that. It might be that you're
in an area such as technical security. It might be that you're in an area such as
the legal profession or in the medical profession or the like. But if you, as a
professional, have a special interest in communications confidentiality, then it
would be a good idea to not just go to your local digital rights group, but also
see if you can take this up through your own professional body.
Herald: OK, thank you.
Since I am the moderator for the Q&A questions, then I also sort of
get to rephrase the questions as passed on through me for the internet.
And the most recent question, but I think also the most fascinating question is,
Someone is asking to what extent the Gaia-X program and the Palantir
collaborations in the EU tied to this, and what can be done to stop this?
For those who are unfamiliar with Gaia-X,
that's an initiative to create a European- based, Europe-based cloud service.
But it should be mentioned that all sorts of American tech companies
are also participants in that, so the European nature of that could be disputed.
But to get back to the question…
How does Gaia-X and Palantir may or may not tie into this?
I think that might be a question for Patrick.
Breyer: I'm afraid I don't know enough to to answer it, Walter.
Palantir has their hands, of course, in managing databases.
And they will also offer products to police that will integrate data retention.
And of course, the impact of communications data grows potentially with
the capacities to analyze this data. It has long been established that, you know,
the idea that listening in to phone calls was more sensitive than
only knowing that the call details is wrong nowadays, because you can use the
the bulk of data that has been collected over weeks and months
to paint a picture of persons, and their networks, and their movements,
and their personalities. That is actually much, much more intrusive and
much more sensitive than what you can tell from just listening to to phone calls.
And yes, I think companies such as Palantir are taking this to to very great length
with the products they are offering. And certainly it's a commercial incentive.
Mass surveillance is big business, and we need to be very aware of this.
Herald: OK, I will also ask Jesper this,
because he may have some thoughts on this as well. Jesper?
Lund: Yeah, I think another worrying development we are seeing
is with the amendment to the European regulation,
which to a large extent is about allowing big data analysis and, in fact, legalizing
practices that are currently illegal. I could easily imagine that, so, police
authorities will not have access to the sort of complete data sets that are
retained by the telecommunications providers. But whenever they have a
criminal investigation and get access to some data, there's a risk that it would be
stored in the database and used for other purposes. I could easily see that systems
from Palantir could be used for analyzing such data, that it could be
disclosed to Europol and possibly analyzed by Europol using perhaps Palantir's
software as well. So. Even though the connection to Palantir and Gaia-X is a bit
speculative, it certainly fits the picture of more big data analysis for the police.
Herald: Chloé, you want to add something to that?
Berthélémy: Just a quick remark on the…
it's not linked to Palantir directly or Gaia-X, but like this is also part of the
French law that was actually brought down by the Court of Justice.
Like one part, was also like about black boxes used by intelligence services
not police authorities, not law enforcement authorities,
but intelligence services. And the new "Loi Renseignement 2", so like
the revival or the reform of the former law that was adopted this year that I've
mentioned before, also contains this kind of algorithmic based, big data analysis of
metadata, of communications data. And this is even further expanded in the new law by
including URL's. So also an analysis of internet network, and how websites
are being visited, and which ones and by whom in general. And all of this will be
done now from the premises of like the physical premises of the intelligence
services in France, and no longer at the premises of the service providers.
So it's kind of a huge shift, where like intelligence services are getting the copy
of metadata on the basis of a judge's decision. But basically everything is
copied, and then they're like applying an algorithmic analysis to it.
Something that is obviously not known by the public.
This isn't in the sense, it's…
It follows the same trend.
Herald: OK, thank you. Another question from the audience is…
I think I'm going to give that one to TJ, because this may
also require a expansion into other fundamental rights or a broader set of
fundamental rights – someone is wondering what is actually so bad about a general
data retention for just IP addresses, for just severe crimes? TJ.
McIntyre: Well, that's a very good question. So first of all, what do we mean
by "just serious crimes"? In Ireland, a "serious crime" includes stealing a Mars
bar from your local shop or a sweet of your choice from your local shop, because
that theoretically carries a possible seven year prison sentence. And in fact,
the Irish police have been using this so- called serious crime provision to
investigate things like theft of a mobile phone from a locker and theft of 100 €
from an ATM machine. So first of all, the problem here is that scope creep is a
thing. And even if you describe something as being limited to serious crime, it's no
guarantee that what you think of a serious crime and what it will be used for are in
fact the same things. The second is that registration of any sort is a gateway to
registration of everything. The kinds of registration we see talked about
and Jesper mentioned already, and Patrick has fought against in different contexts;
registration of SIM cards, for example, generally require identity verification of
some sort. And that, in turn, is a real threat then to the people who rely on
confidentiality – the whistleblowers who want to get information about what
government is doing out to you, the people who want to talk to their doctors or their
support helplines in confidence – and that is a threat to them. But I think Patrick
probably is better placed to discuss those points than I am,
so perhaps I'll just hand over to him.
Breyer: Just to add to what TJ said
about IP addresses specifically… On the internet, the major providers of services
will log your every click and search term that you enter and keep that data for
months. And so basically, if you know a person's IP addresses, it's easy to
request from Google all the search terms that they entered. Or if somebody is
publishing anonymously using a Twitter account, or they think it's anonymously,
then you'll ask for the IP address. And you can establish, you can lift the
anonymity of that whole account. And that's why IP addresses or being able to
trace IP addresses really means that you can follow whatever a person has done on
the internet. And you can even determine their location because IP address tells
about your movements more or less, roughly. Whether you're at home or at work
can be determined, according to research. And it's very telling, it's not true that
it's somehow less sensitive. You know, if you call somebody and
suppress your phone number, you can't you wouldn't be allowed to retain data on this.
But if you use digital services to send an email, you'll have the
IP address in the header. If you use messaging services, they will be logging
your IP address. So very similar things as making phone calls will be able to be
retained indiscriminately and be tracing the IP address.
Herald: OK, I have a very specific question about Chloé's bit in the presentation
*unintelligible*
I didn't quite get what the Socialist Party did block
and how, and what happened there.
Berthélémy: Sure. That went very by fast.
It's not just the socialists, obviously, I forgot to mention that the right parties
had the big role to play there. Basically, there is like a procedure in
France every time, like a legislation is adopted by the parliament, so both
the French National Assembly and the Senate. There is a possibility there's
this rule where either 60 senators or 60 MP's, members of National Assembly can
just vote in favor of submitting the bill, before it is adopted and officially
published in the official journal and can come into force, there is this possibility
of submitting it to the Constitutional Council. So the Constitutional Council in
France is composed of nine members. They're not elected, there are designated.
So it's not the best kind of democratic counter-power you can imagine. But this is
still there, and has been proven effective in the past years, especially since the
presidency of Macron. To, a little bit, hold responsible what the government is
proposing and has annulled or prevented some provision in several security laws to
pass and to come into effect. And so for the second, the "Loi Renseignement 2",
so like the reform of the intelligence service law that contains the provision
about the data retention, so when this reform was finally like adopted by both
the Senate and the National Assembly, there wasn't the majority. There wasn't
enough majority to send the text in front of the Constitutional Court, or at
least not on the provision related to data retention. And some other provision
contained in the bill were sent to the Constitutional Council. And the reason why
data retention wasn't included is because the socialists didn't support it, this
submission, this reference to the Constitutional Council. So not just the
socialists' fault. It's also I just said the right parties and the party in power,
so the La République en marche. But I think one assumption that we can make
and this is not like verified information, but this is one assumption we can make
is that the reason why the socialists didn't support it, the submission to
another scrutiny or constitutional scrutiny, is because they were the ones
introducing those measures in 2015 when they were in power under François Hollande
Herald: I've been told by the translators that we really have to wrap it up.
So I probably will be asking the last question, depending on the length of
the answer, maybe another question. And I'm going to ask them to Friedemann,
because he hasn't been talking much during the Q&A.
One of the questions is, and that was by a viewer, who understood the
explanations about the Court of Justice as potentially being willing to revise the
earlier jurisprudence on data retention which I understood quite differently,
so maybe you could explain it as well. But the question is…
In case the Court of Justice of the European Union were to revisit its
earlier opinions and weakens its stance, what will be possible to do against that?
Ebelt: Well, to be honest, I would love to pass this question on to the speakers,
since I'm not actually a speaker of this talk, and just the host and moderator.
So would somebody of the speakers take the question?
Herald: Then I suggest Chloé does it.
Berthélémy: Oh, wow, what a nice gift. Can I pass the ball to Jesper? *laughs*
I don't know what can be done as a citizen counter the Court of Justice's future rulings.
One thing that Patrick mentioned, for example, is the influence of several
interventions during hearings in front of the courts. And notably, when the
European data protection supervisor is kind of weakening what the court has said
previously and said that access is more important than the mere retention of data,
it's problematic. Even though it didn't impact it this time too much,
there is a risk that this kind of narratives build up
and becomes like very influential in the judges' ears.
So this is something to be avoided. But Jesper, please complete, because
I'm probably far from the comprehensive answers to this question.
Lund: In the hypothetical situation that the court would revise its position and
say, allow general and indiscriminate data retention, not just for national security
in extraordinary circumstances, but for combating serious crime in general.
That would put us back to sort of square one,
before the…
when the campaign against data retention started. And,
then we can no longer say that it's against fundamental rights.
But it's still a bad idea.
It still has problems for vulnerable groups,
persons with professional privileges, and so forth.
So in that situation, ideally, we want to convince our parliamentarians
at a national level that it's a bad idea. And if that is not possible, at least make
exceptions so that these groups with professional privileges are not included
in data retention. It may be possible.
Germany has, in its current data retention law, has some provisions on where
certain phone numbers of help groups, help phone lines are excluded.
And also make sure that access to this data is subject to prior court review.
That is not the case in all member states.
And that access is exceptional, also.
And so these are the options remaining
should the Court of Justice revise its position, which…
I would consider unlikely at this stage, and certainly the advocate general is in
*audio breaking up*
…the three cases pending is not suggesting this at all. Rather the contrary.
Herald: OK, thank you. And we have run out…
oh, and also for those who want to look up the website, it's edri.org
And that contains the map Chloé mentioned.
But again, thank you all. And this is it for the session.
Take care. Bye bye.
* rC3 2021 Chaos-West TV postroll music *
Subtitles created by c3subtitles.de in the year 2021. Join, and help us!