The general German industry association (BDI) and the two telecommunication associations (BITKOM and VATM) have jointly published a strong position paper against the European proposals for mandatory data retention.

The German industry calls on both the European Commission and the ministers of Justice and Home Affairs to provide a solid and adequate impact assessment, since "LEAs have demonstrated neither the concrete need for a data retention regime nor the alleged lack of effectiveness of the current practice."

"Industry would like to point out that the European Union is confronted with a crisis of acceptance and a loss of confidence because politicians are too often unable to explain the purpose and benefits of European activities to citizens and industry."

The industry mentions 5 more specific demands on both Commission and Council:

1) Any period, if the necessity can be proven, must not exceed 6 months; 2) Any obligation to retain data must not include data types currently not centrally processed and recorded within the networks; 3) Any obligation can only address services provided directly by the provider of a customer; 4) Full cost reimbursement for both infrastructure and operational costs, in stead of the vague wording of 'additional costs'; 5) No additional obligation on the industry to collect statistics.

With regards to the second demand, the paper details the problems with data that are only generated but not used for billing or service delivery, such as failed caller attempts and registration of type of communication used. Storage of unsuccessful connection attempts (amounting to 40% of all calls according to GSM Europe!) would require fundamental rebuilding of all switching centres, resulting in costs "within the three-figure million Euro range." Storing whether a user sends a fax or makes a phone call is equally irrelevant to the operators, and would require equally substantial technical upgrading.

Specially addressing the demands on mobile communications, the industry explains that the demand to store the 'end' location of a mobile phone connection is unjustified, because it often goes to another provider. Law enforcement has "not yet proven an added value, as the retention of the cell ID at the beginning of every call already suffices to establish a movement profile." The demand for IMEI meets equal criticism from the German industry. In a consultation with German law enforcement, no need could be proven and the demand was dropped immediately.

With regards to Internet data retention, the paper notes that "communication data of the internet services used are not available for most services. Technical facilities to record, retain and analyse these data would first have to be created and would lead to a tremendous rise in the volume of data to be stored." Storage of the MAC address is completely unrelated to the ISP business, and "the added value of a MAC, in addition to an IP address, with regard to a clear identification of the user is questionable and has not been demonstrated."

On the demand for statistics, the industry justifiably points out that should have been the start of the legislative process to estimate the effectiveness and proportionality of a data retention regime. Industry also claims such an obligation exclusively resides with the competent authorities. True as that might be, from a digital civil rights perspective it would be a very good idea if the Commission would create a shadow-obligation on the service providers to collect statistics and jointly publish them in an annual report. But the Commission proposal doesn't address the public availability of the statistics, and given the lack of public supervision in many EU countries on the actual use of interception and surveillance powers, that is not a promising start.

Demands of German Industry (in German and English, 04.08.2005)
http://www.bitkom.org/Default_33225.aspx