Alexander Alvaro est un membre libéral allemand du Parlement européen et de la Commission des libertés civiles, de la justice et des affaires intérieures.
"The Data Retention Directive was contentious when it passed five years ago and it remains so today. In the aftermath of the terrorist attacks in Madrid and London, the European Union wanted to reinforce data retention requirements to better combat acts of terrorism.
While I strongly support providing our law enforcement and other government agencies with the necessary tools and resources to stop and deter acts of terrorism, the EU must respect the privacy of its citizens.
A recent European Commission report highlighted a host of issues associated with the application of the directive. The report raised privacy concerns, shed light on flawed and inconsistent data retention practices, and brought into question the effectiveness of the law.
Responding to the report, the European Data Protection Supervisor (EDPS), Mr Peter Hustinx, issued an opinion stating that the directive did not meet the requirements imposed by the rights to privacy and data protection, both of which are guaranteed as fundamental rights under EU law. He recommended either repealing the directive or developing a 'more targeted' measure.
The directive required each member state to ensure implementation 2007 with the option of delaying certain obligations until early 2009. Years later, the directive still faces hurdles of implementation in many member states, including Germany. Indeed, the German Constitutional Court ruled that the national law transposing the directive was void.
Inconsistencies exist among the member states who have transposed the directive. In one of the many examples of inconsistencies among member states, the European Commission found discrepancies in the basis for data retention. Eight out of the 19 member states went further than the directive's intent to provide data for the prosecution and prevention of serious crimes. Instead, the eight countries allowed data to be retained for all criminal offences.
Other significant differences concern the periods of retention. The directive specifies that data have to be retained for 'periods of not less than six months and not more than two years,' and it is possible to observe how inconsistent the approach is across the EU.
Only 15 member states specify a single period for all categories of data but that period ranges from two years in Poland to six months for Cyprus, Luxembourg and Lithuania. The others have different retention periods for different categories of data, ranging from 14 months for telephony data in Slovenia to six months for Internet email in Malta. With such a system, legal certainty for businesses and citizens operating across Europe is substantially weakened, while the complexity and costs of compliance are increased.
It is also worth observing that one member state, Greece, transposed the directive into their national legislation by requiring that data generated and stored on physical media located within Greek territory remain within Greek territory during the data retention period. The Greek law violates the principle of free movement of data.
After five years, Europe remains confronted with an obvious confusion of the laws that apply in each member state. The Commission should listen to its own data and repeal the directive."
