BVerwG: Data retention is contrary to EU law

The provisions of § 175 para. 1 sentence 1 in conjunction with. § Section 176 TKG (Section 113a (1) sentence 1 in conjunction with Section 113b TKG old version), which requires providers of publicly available telecommunications services to store the telecommunications traffic data specified therein, is fully incompatible with Article 15 (1) TKG. 1 of the ePrivacy Directive (Directive 2002/58/EC) and therefore not applicable. This was decided by the Federal Administrative Court in Leipzig in two proceedings.

The plaintiffs, two telecommunications companies, are contesting the first-mentioned decision taken against them by Section 113a (1) of the German Telecommunications Act. 1 in conjunction with. § 113b TKG as amended by the Act of December 10, 2015, and now largely unchanged in terms of content in § 175 (1). 1 sentence 1 in conjunction with. § 176 TKG to retain telecommunications traffic data of their customers.

The data to be stored for a period of ten weeks includes, among other things, the call numbers of the connections involved, the start and end of the connection or Internet use or the times at which a short message was sent and received, assigned Internet protocol addresses and user IDs, and identifiers of the connections and terminal devices. Location data, i.e. essentially the designation of the radio cell used at the start of the connection, must also be stored for a period of four weeks.

In response to the actions, the Cologne Administrative Court had ruled that the plaintiffs were not obliged to store the telecommunications traffic data specified in the law for their customers to whom they provide Internet access or access to public telephone services.

The storage obligation is contrary to Union law and is therefore inapplicable in the plaintiffs’ cases. The fundamental legal questions of Union law relevant in the present context had been clarified by the case law of the Court of Justice of the European Union (ECJ). In response to the jump appeal by the defendant, represented by the Federal Network Agency, the Federal Administrative Court had suspended the proceedings and obtained a preliminary ruling from the ECJ pursuant to Article 267 TFEU (BVerwG, decisions of September 25, 2019 – 6 C 12.18 and 6 C 13.18, see press release 66/2019 of September 25, 2019).

After the ECJ answered the questions referred in its judgment of September 20, 2022 (Joined Cases C-793/19 and C-794/19, Space Net et al.), as corrected by order of October 27, 2022, the Federal Administrative Court dismissed the defendants’ appeals.

In doing so, it has applied the provisions based on Section 113a para. 1 in conjunction with. § Section 113b TKG (old version) to the now applicable provisions in Section 175 (1) of the German Telecommunications Act (TKG). 1 sentence 1 in conjunction with § 176 TKG adjusted.

Taking the ECJ’s decision into account, the Federal Administrative Court concluded that the provision in the Telecommunications Act prescribes the retention of a large proportion of traffic and location data without any reason, covering the entire country and undifferentiated in terms of personnel, time and geography.

This does not meet the requirements of Union law, if only because no objective criteria are determined that establish a connection between the data to be stored and the objective pursued. Since the retention of the aforementioned data and access to them constitute different encroachments on the fundamental rights concerned, which require separate justification, the limitation of the purposes of use in Section 177 para. 1 TKG (§ 113 c (1) TKG old version) is not suitable from the outset to fulfill the Union law requirement of clear and precise rules for the upstream measure of storing the data.

To the extent that the statutory regulation concerns the provision of telephone services and, in this context, in particular the data required to identify the source and addressee of a message, the date and time of the beginning and end of the connection or, in the case of the transmission of short, multimedia or similar messages, the times at which the message was sent and received, as well as, in the case of mobile use, the designation of the radio cells used by the caller and the called party at the beginning of the connection, there is also a lack of the strict limitation of the general and indiscriminate retention of traffic and location data to the purpose of protecting national security as required by the ECJ.

Insofar as the obligation for general and indiscriminate retention relates to the provision of Internet access services and in this context, among other things, to the IP address assigned to the subscriber, the purposes permitted under European Union law also include, according to the decision of the ECJ, the fight against serious crime and the prevention of serious threats to public security.

However, the regulation in the Telecommunications Act does not provide for a corresponding restriction on the purposes of storage. The regulation of the purposes of use in the context of an inventory data disclosure, which is decisive for the determination of the purposes of storage, clearly goes beyond the framework of Union law. This applies not only to the former legal situation under Section 113 c para. 1 No. 3 in conjunction with. § 113 para. 1 sentence 3 TKG old version, but also for the provision now applicable in § 177 (3). 1 No. 3 in conjunction with. § 174 para. 1 sentence 3 TKG, which is intended to take into account the requirements of the case law of the Federal Constitutional Court.

Since an interpretation in conformity with Union law is out of the question due to the principle of certainty and clarity of norms emphasized by the ECJ, the provision in the Telecommunications Act may not be applied due to the primacy of Union law.