This applies unless their is a risk to national security. However, to combat serious crime, members states may, in strict compliance with the principle of proportionality, provide for the targeted or expedited retention of such data and the general and indiscriminate retention of IP addresses.
The Court of Justice of the European Union has ruled in Joined Cases C-793/19 | SpaceNet and C-794/19 | Telekom Deutschland.
SpaceNet and Telekom Deutschland provide publicly available internet access services in Germany. Telekom Deutschland also provides telephone services. They challenged the obligation imposed on them by the German Law on Telecommunications (TKG) to retain, with effect from 1 July 2017, traffic and lcoation data relating to their customers' telecommubications.
With some exceptions, the TKG requires providers of publicly available electronic communications services - to prosecute serious criminal offences or preventing a specific risk to national security - to retain, in a general and indiscriminate way, for a period of several weeks, most of the traffic and location data of the end users of those services.
The German Federal Administrative Court asked the CJEU if EU law precludes such national legislation. It said that the retention obligation in the TKG concerns less information and a shorter retention period (four or ten weeks) than that provided for by the national legislation in the Court of Justice's previous judgments. This made it less likely that the retained data may allow very precise conclusions to be drawn concerning the private life of the individuals whose data had been retained. In addition, it considered that the TKG ensured the effective protection of retained data against the risks of abuse and unlawful access.
The Court of Justice confirmed its previous case-law. It said that EU law precludes national legislation which provides, on a preventative basis, to combat serious crime and prevent serious threats to public security, for the general and indiscriminate retention of traffic and location data.
However, EU law does not prevent national legislation which:
In addition, such national legislation must contain clear and precise rules to ensure that the retention of data is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.
The CJEU further ruled that the obligations in the TKG apply to a very broad set of traffic and location data. Contrary to the German courts' view, the CJEU said that very precise conclusions could be drawn concerning the private lives of the individual whose data is retained and enable a profile to be created about them.
When considering the TKG rules that are intended to protect the retained data against the risks of abuse and against any unlawful access, the CJEU said that the retention of and access to that data constitute and separate interferences with the fundamental rights of the individuals concerned, requiring a separate justification. Therefore, national legislation complying with the EU case law cannot, by its very nature, be capable of either limited or even remedying the serious interference with the rights of the individuals concerned which results from the general retention of the personal data concerned.