The latest version of the Commission proposal for a directive and a framework decision has been leaked to EurActiv. It contains a retention obligation of one year for all data except for "data related to electronic communications taking place using wholly or mainly the Internet Protocol", which is to be retained only six months. According to the draft, which will be discussed at the 21 September 2005 Commission meeting, telecom operators and internet service providers have to be reimbursed for "demonstrated additional costs" resulting from the retention obligation.
A draft framework decision by the UK, Ireland, Sweden and France has been effectively withdrawn after it was voted down unanimously in the European Parliament and after UK Home Secretary Charles Clarke failed to convince his colleagues from other EU countries of the benefits of a retention scheme which had in the meantime been considerably amended.
In parallel, the Commission has data retention plans of its own, which are composed of a draft directive and a draft framework decision. After the defeat of its own draft framework decision, the UK Presidency is now said to be ready to use the Commission proposal as the basis for its data retention plans. Until recently, the Presidency had ignored warnings from the Council's own legal service as well as from the Commission's that only the Commission had competence to propose this kind of legislation, and that the Parliament must have full co-decision rights.
The Commission proposal differs from the Council's draft Framework Decision in that it
- proposes EU-wide identical retention periods of one year for fixed and mobile telephony data, and six months for IP based communication data. The Council FD sets a minimum term of retention for all data categories of one year, but allows for possible exceptions to this for periods between 6 and 48 months;
- obliges Member States to compensate service providers for additional costs resulting from the retention obligation;
- facilitates the extension of demands for retained data by making it possible to add new types of data in a comitology procedure and without first consulting an advisory forum of data protection experts and industry representatives;
- gives responsibility for providing statistics on demands for retained data to the member states (the Council wanted service providers to collect the data);
In the EU, data retention has been disputed for about five years, when Article 15 was introduced into the e-privacy directive. This article introduced an exception explicitly allowing for data retention, which would otherwise have been outlawed by the directive.