21 EU countries unlawfully retaining citizens online data

Most European countries are unlawfully retaining their citizen’s personal data. That’s according to a new report from Privacy International which claims that no fewer than 21 EU member states are routinely retaining data they shouldn’t.

The lengthy list of countries which have been identified includes France, Germany, and the UK. Perhaps most worrying of all, Privacy International’s report only looked at these 21 countries, which raises the very real question of whether any country actually complies with data retention laws.

In breach of EU court judgements

The report compared the data retention practices in each of the 21 countries with the rulings of two landmark judgements from the EU Court of Justice. These are the Tele-2/Watson and Digital Rights Ireland judgements which concluded that under EU law it is illegal to undertake general and indiscriminate communications data retention.

EU law requires that any member state data retention regimes must “comply with the principles of legality, necessity, and proportionality”. However, none of the member states which were examined were found to fulfil these basic tenets.

This means that all of the EU countries looked at are still undertaking the bulk retention of citizens online communications data, despite the court rulings. This information can tell governments a great deal about individuals and give them excessive insight into the lives of their citizens. It also places this data at risk should government data storage ever be compromised.

Revealing data at risk

As Tomaso Falchetta, the Head of Policy and Advocacy at Privacy International explains, “Blanket and indiscriminate retention of our digital histories — who we interact with, when and how and where — can be a very intrusive form of surveillance that needs strict safeguards against abuse and mission creep.”

“It is clear that current data retention regimes in Europe violate the right to privacy and other fundamental human rights,” he continued. “In particular, the European Court has made clear that general, indiscriminate retention of communications data is disproportionate and cannot be justified, not even on the grounds of fighting crime.”

Whilst the findings of this report will come as little surprise to some, what is even more worrying is the lack of any evidence that states are beginning the process of reform to bring their data retention laws in line with legal requirement.

That ‘head-in-the-sand’ approach is likely to lead to legal challenges, with Privacy International just one of the campaign groups with the resources to mount a case. Indeed, they are already suing the ‘Five-Eyes’ countries of the UK, USA, Canada, Australia, and New Zealand over their surveillance practices. Separately, a legal challenge to the UK’s recent Investigatory Powers Act is also imminent.

Privacy International has held back from legal threats in this report. Instead, they have suggested that the EU provides guidance on reviewing national retention laws. They have also called on all EU states to urgently review their data retention laws and take steps to bring it in line with European standards.

Recommendations unlikely to be implemented

They have also suggested a closer engagement with stakeholders and urged telecoms companies and ISPs to put pressure on Governments to change their practices rather than simply comply with illegal practices.

However, there is little sign that these recommendations are being put into practice and legal action is likely to take time to deliver results. In the meantime, internet users throughout the EU have to face up to the fact that their governments are going to continue to illegal collect their online communications data.

Of course, there are ways that they can take steps to protect their own online privacy and stop their governments from being able to see their online activity.

By using a reputable VPN such as IPVanish or ExpressVPN, which encrypt all your online traffic and retain zero user data, it is still possible to enjoy the online privacy the European courts believe you are entitled to. But for the foreseeable future, a VPN is the only real way you can enjoy these rights.