Advocate General ‘outlaws’ Data Retention Directive

The shallowness that the European Commission shows, while asked to protect the basic civil rights of EU citizens and companies, was ostentatiously proven in the case of the Data Retention Directive. According to the Advocate General of the Court of Justice of the European Union, Cruz Villalón, the Directive doesn’t provide the basic guarantees that the data stored for two years by the telephone or electronic communications providers won’t be used for other purposes than the ones stated in the Directive. The opinion of the Advocate General was published this morning. Of course the opinion of the Advocate General does not bind the judges of the Court. However, the legal soundness of the opinion is considered to be of extreme quality. In must be noted that the Directive relates only to the traffic and the location of data for telephone and other electronic communications of all EU citizens and companies, and not to their content. Still, according to the Advocate general, “the use of those data may make it possible to create a both faithful and exhaustive map of a large portion of a person’s conduct strictly forming part of his private life, or even a complete and accurate picture of his private identity”. The logical conclusion of this observation is that when it comes to the business universe, the ‘map’ of an economic entity’s communications, if in the wrong hands, can be used even for industrial espionage purposes. Let alone that it leaves all citizens completely unprotected from unduly use of their communications mapping. Open to industrial espionage What Villalón briefly says is that the Directive doesn’t make sure that the communication providers take special care to protect the data neither are they obliged to store the data within the borders of the country in question. In reality, the data will be lying somewhere in the world, stored for two years available to any able intruder. Even the provider itself can make large profits, also somewhere in the world, out of selling the access to such data, even in a case by case basis. In this way the storing of the data may create another business ‘department’ for the provider. The Commission’s directive doesn’t pay any attention whatsoever to all those factors. It truth, it facilitates the ‘commercial’ exploitation of the data. The opinion of the Advocate actually observes, that “There is, moreover, an increased risk that the retained data might be used for unlawful purposes which are potentially detrimental to privacy or, more broadly, fraudulent or even malicious”. This said, the opinion notes also that “the Directive – which indeed regulates neither access to the data collected and retained nor their use – assigns the task of defining and establishing those guarantees to the Member States. Accordingly, the Directive does not comply with the requirement, laid down by the Charter of Fundamental Rights”. No guarantees provided Consequently, “when the European Union legislature adopts, as in the case of the Data Retention Directive, an act imposing obligations which constitute serious interference with the fundamental rights of citizens of the Union, it must assume its share of responsibility by defining at the very least the principles which must govern the definition, establishment, application and review of observance of the necessary guarantees”. Last but not least, the opinion says that two years of retention time for the data is disproportionate. No interested party has submitted to the court evidence supporting a time detention period larger than one year. The Judges of the Court are now beginning their deliberations in this case. Judgment will be given at a later date.