The Council of European Ministers of Justice and Home Affairs (JHA council) seems set for a frontal collision with the European Commission with the proposal for a framework decision on mandatory data retention. On 14 April 2005 the Council will discuss the proposal, possibly including a functional list, in spite of the urgent request from EU Justice Commissioner Frattini to drop the proposal completely and wait for a proper democratic initiative from the Commission. For national members of parliament all over Europe the national preparatory debate about the agenda for this JHA Council will probably be the last chance to stop their ministers from agreeing and first demand a thorough investigation into the necessity and proportionality of data retention.

The last publicly available Council document dates from 24 February 2005. The proposal now demands a retention period of 12 months for all data generated or processed by telecom providers, with a maximum of 36 months. There is also a new minimum of 6 months for countries that wish to derogate from the proposal. Any such derogation has to be reviewed annually and reported to Commission and Council.

The footnotes show some countries have expressed reservations, but the names have been deleted from the document. At least one delegate has tried to remove failed caller attempts from the list of data to be retained, the lobbying focus from the powerful telecom companies, but apparently unsuccessful.

Meanwhile the European Parliament is left in its powerless role as consultant on the decision, without any right to amend or veto the proposal. The critical questions from Dutch social democrat MEP Edith Mastenbroek on 14 October and 12 December 2004 have finally been answered by the Council on 14 March 2005 in a very condescending manner, summing up the well-known factual history of the proposal without answering any of the questions about the proportionality and democratic content of the proposal. Why it has taken the Council this long to answer the questions will probably remain as mysterious as the precise contents of the proposal itself until after it has been adopted. The deadline for the (unanimous) adoption remains set at June 2005.

The united national and regional data protection authorities of Germany have strongly criticised the plans during their annual conference in Kiel on 10 and 11 March 2005. The German DPAs were relatively quiet the last few months about the subject after the German parliament had clearly ordered the minister of the interior not to agree with any kind of mandatory data retention for German companies. But surprisingly Schily, the minister of the Interior, used the opening of CeBIT 2005 (a mega IT exhibition in Hannover, Germany) on 13 March 2005 to speak out in favour of 12 months mandatory data retention. Law enforcement authorities should "use all possibilities to discover planned crime and terrorist actions" but negotiations with the telecom industry "were not closed yet". The next day Schily joined the informal meeting of the interior ministers in Granada of the 'big 5' (UK, France, Germany, Spain and Italy). The ministers discussed data retention measures amongst other proposals to "monitor and control the use of the Internet in international terrorism and organised crime."

According to the president of the DPA conference, Dr. Thilo Weichert, also chair of the Schleswig-Holstein DPA, "the systematic surveillance of the telecommunication behaviour of all innocent citizens can only provide minimal help in solving criminal cases, because internationally organised criminals and terrorists have the technical means to circumvent the tracking of their traffic data." Weichert also pointed at the costs for the telecom industry, raising the costs for individual subscribers and hurting competition and innovation.

The German DPAs note that the proposal is not only unconstitutional in Germany, but also in violation of the draft European Constitution in which privacy and telecommunications secrecy are enshrined as pillars of a free democratic society.

In Spain the Public Prosecutor's Office has allegedly produced a set of recommendations for the Ministry of Economical Affairs on the exact type of data that should be stored by telecom providers. In spite of several appeals by the Spanish Internet user association Internautas to the freedom of information act, drafts have not yet been made public. Spain was the first country in the EU to adopt general framework legislation demanding data retention in the summer of 2002, immediately after the EU privacy directive was adopted which allowed for national legislation on data retention. But like in all other EU countries except for Italy, the legislation never materialised in specific regulations. According to Internautas the Public Prosecutor demands a longer period for data retention than 12 months and also wishes to give regular police officers access to the data without any judicial order. Remarkably, the Prosecutor seems to defend general data retention without any reference to terrorism. He only refers to child pornography, which also makes it necessary to create mandatory identification by service providers of all IRC users (internet chat networks) and visitors of cybercafes.

Last (partially public) version of the draft framework decision on data retention (24.02.2005)
http://register.consilium.eu.int/pdf/en/05/st06/st06566.en05.pdf

UK and EU allies plan moves against terror websites (18.03.2005)
http://www.theregister.co.uk/2005/03/18/g5_granada_meet/

Deutschland prescht bei Speicherpflicht vor (German, 14.03.2005)
http://futurezone.orf.at/futurezone.orf?read=detail&id=262957

La retención de datos y el secreto de las comunicaciones (Spanish, 17.03.2005)
http://www.internautas.org/html/1/2790.html