The supervisor presented his findings in a 16-page official opinion published earlier this week (31 May) on the application of the EU's 2006 directive on data retention.
Hustinx said in a statement that "the quantitative and qualitative information provided by the member states is not sufficient to draw a positive conclusion on the need for data retention as it has been developed in the directive".
"Further investigation of necessity and proportionality is therefore required, and in particular the examination of alternative, less privacy-intrusive means," he added.
Hustinx argues in particular that the need for data retention has been insufficiently demonstrated, that the regulation could be less intrusive, and that existing legislation leaves too much scope to member states on the issue.
As a result, the supervisory body has called on the European Commission "to seriously consider all options in this further process," including a possible repeal of the 2006 directive.
It stresses that any new legislation must be "proportionate" and have a "clear and precise purpose which cannot be circumvented".
The European Commission has committed itself to taking into account the conclusions of the European Data Protection Supervisor.
Based on reporting from EurActiv.fr