
EU court rejects requirement to keep data of telecom users - eis
http://www.reuters.com/article/2014/04/08/us-eu-data-ruling-idUSBREA370F020140408
======
sentenza
This decision has immediate consequences for us here in Germany. As our own
constitutional court ruled that the law implementing the directive was
invalid, we did not have a data retention law for some time now, since
lawmakers wanted to wait out this decision.

So data retention is dead here in Germany and will fall in many other European
countries. It is still possible that the court will allow for a severely
restricted version of data retention and of course the police can access ISP
billing logs if they have a court order, but blind mass-surveillance is a
thing of the past.

Yay!

~~~
stfu
Experience tells me that it would be foolish to assume a court decision can
tame the data hungry beast that we call government.

~~~
skrause
At least in Germany it wasn't the government collecting the data, they simply
forced the ISPs to do so. And when the court ruled the law invalid the ISPs
were more than happy to stop the data retention because it cost them a _lot_
of money.

~~~
walshemj
ah so instead of properly security cleared people in one or two security
services having access to it every ISP from DBP down to a mom and pop
organization may have access.

Will the average ISP pay to put all its staff who have acess to those records
with access through TS (DV clearance) clearance its not cheap. And what
happens when some of the staff fail vetting - oops your now out of a job.

Oh and this woudl mean that ISP's would have to have judicial oversight.

------
frik
_Related news:_

NSA allegedly listening to everything in Austria

    
    
      As part of "Mystic" apparently the NSA monitored not only 
      all communications in Iraq, but also in Austria. The 
      basis for this was a secret treaty, by which the 
      government knew about it, writes an Austrian magazine. 
      [...]
    

[http://translate.google.com/translate?sl=auto&tl=en&js=y&pre...](http://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2Fmeldung%2FNSA-
hoert-angeblich-auch-Oesterreich-komplett-ab-2165101.html&edit-text=&act=url)
[heise.de, news article from yesterday evening]

 _Austria has implemented the data retention law and officially stores
"connection"-data for 6 months, apparently NSA stores "everything" and is
working together with the Austrian telekom companies and government._

~~~
Zigurd
I predict that it will eventually come out that other European nations have
similar secret treaties, and that their sovereignty is circumscribed by such
treaties. This is why you hear complaints, but see no action. It will be
interesting to see if any popular movements against such agreements arise.

------
eik3_de
EU Court of Justice press release:

english
[http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...](http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf)

german
[http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...](http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054de.pdf)

Full verdict text:

english [https://netzpolitik.org/wp-
upload/c_293_c_594-1.pdf](https://netzpolitik.org/wp-upload/c_293_c_594-1.pdf)

german [https://netzpolitik.org/wp-upload/C_0293_2012-DE-
ARR.pdf](https://netzpolitik.org/wp-upload/C_0293_2012-DE-ARR.pdf)

(Edit: direct link instead of scribd, thx eis. Added full verdict text.)

~~~
eis
Primary source:
[http://curia.europa.eu/jcms/upload/docs/application/pdf/2014...](http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf)

------
JoachimS
Hard to say how the Swedish government will react. One ISP, Bahnhof immeadetly
decided to stop collecting any data as specified by the Swedish DRD laws. And
erase anything collected.

Press release in Swedish: [https://www.bahnhof.se/press/press-
releases/2014/04/08/efter...](https://www.bahnhof.se/press/press-
releases/2014/04/08/efter-eu-domen-bahnhof-upphor-med-all-datalagring-
omedelbart)

~~~
eurleif
Are they literally collecting nothing now, not even enough to link IP
addresses with subscriber identities? I love privacy as much as everyone else,
but real crimes do happen online, and I wonder about the consequences.

~~~
tripzilch
Collecting and storing all that data indiscriminately is the wrong approach
for preventing online crime. We don't chip and tag everyone 24/7 to prevent RL
crime, either.

~~~
eurleif
Do you say that because you know of a practical alternative which allows law
enforcement to happen with a similar level of effectiveness?

~~~
tripzilch
Oh, sure. You can implement a curfew and shoot on sight everyone who ventures
out on the streets outside government-approved schedule. Then you don't need
to chip and tag them.

Or did you mean online crime? Outlaw computers, refer to above technique.

My point is, just because some type of enforcement has a certain level of
effectiveness doesn't mean it's _right_ to have it, nor does it mean that any
alternative is required to have the same level of effectiveness, in particular
given that it gets rid of something far worse.

~~~
eurleif
I run a chat Web site. On multiple occasions, my moderation team has found
people raping children live on webcam and reported them. People have been
arrested, and children have been saved from abuse. That was only possible
because they could be tracked down via their IP address. This isn't a
hypothetical "think of the children" argument; it's something that has
actually happened, multiple times, in the course of running my site.

As a reminder, we are talking about logging IP addresses only here, not sites
you visit, etc. What actual, specific consequences of that logging are "far
worse" than making it impossible to catch child rapists?

~~~
tripzilch
If you want to seriously discuss this topic and bring child rape into the
discussion, then I think it would be best to steer away from hyperbole.

We were talking about EU/government mandated retention of IP + header[0]
information at the ISP level, for periods of 6-18 months (depending what
country we're looking at).

Refraining from this does NOT make it "impossible to catch child rapists" and
if that sort of hyperbole is going to be your argument then I'm pretty much
done with the conversation.

[0] it also turns out that you can't tell from "logging IP addresses only"
whether someone is a child rapist or not.

 _EDIT:_ I see from your profile that you founded Omegle.com. That's cool, I
love the concept of that site. I now understand the context of what you say
somewhat better (btw didn't know Omegle had webcam support, I thought it was
just chat).

However, this is an entirely different situation! Omegle is not an ISP. There
are already laws for this! If you're running a chat+webcam website that is
going to be used by children, then why yes, your business does have a
responsibility for what goes on there. This has nothing to do with EU mandated
data retention laws.

Maybe that's the source of the confusion here, Omegle is not situated in the
EU, so maybe you weren't aware that there's actually all sorts of mechanisms
in place for catching child rapists that do not hinge solely on the
indiscriminate ISP-level logging of everybody EU-citizen's usage of the
Internet for any purpose, ever. The great thing is that these methods also
work against criminals that do not operate on the Internet.

~~~
eurleif
>We were talking about EU/government mandated retention of IP + header[0]
information

The beginning of this thread, the first comment you replied to, was me talking
about the IP information in particular.

>However, this is an entirely different situation! Omegle is not an ISP.

Omegle's reports would be much less useful to law enforcement if they couldn't
subpoena ISPs to track people down from their IP addresses.

>it also turns out that you can't tell from "logging IP addresses only"
whether someone is a child rapist or not.

That's also why logging IPs only is less of a privacy issue: the data is
pretty much only useful when you're investigating a specific crime.

------
haakon
In Norway, politicians have promised that they want to go ahead with data
retention regardless of the legality of the EU directive. It has been
postponed multiple times due to cost and technical issues, but we'll probably
get it eventually :-(

~~~
danbruc
Then just join the EU and the problem is solved.

~~~
widdershins
This ruling just means that the law _requiring_ ISPs to retain data is
invalid. It doesn't ban national governments from passing their own laws to
the same effect.

~~~
danbruc
There are probably a lot of technical details involved but I don't think you
can make such national laws or in case you can you probably can challenge them
and get them retracted. The decision is more or less based on universal human
rights and they should apply to EU and national law in the same way.

~~~
ctolsen
The Data Retention Directive has already been struck down locally in every
state where it has reached the highest courts, so especially after this, a
similar law will probably not survive.

It might actually be better if a high court deems the national law to be just
fine, since you might get a verdict in the European Court of Human Rights.

------
higherpurpose
I love EU! US, pay attention. This is how you do civil liberties. It seems EU
is becoming the new beacon of democracy and civil liberties in the 21st
century (if we ignore UK, which seems more interested in being another US
state than an EU one, anyway, but without any rights to vote in the former).

~~~
weavejester
There's a vocal anti-EU minority in the UK, but it's still a minority. It just
seems larger than it actually is because it's loud, and to some extent act as
swing votes (the Conservatives want to avoid losing too many votes to UKIP,
for fear of Labour beating them in the next election).

~~~
Silhouette
_There 's a vocal anti-EU minority in the UK, but it's still a minority._

That statement is true but potentially misleading.

In a poll earlier this month, as reported by the BBC[1], voting intentions if
we had an in/out referendum immediately were 35% in, 32% out, 27% undecided,
and 6% would not vote.

A different poll from back in December, mentioned in the same article, had a
result of 32% in and 45% out, so it looks like the balance of opinion on this
issue varies considerably over time, too.

(Both polls came from reputable sources, so I'm assuming that the sampling was
done sensibly.)

In short, while it's true that the "anti-EU" group are a minority, the "pro-
EU" group appear to be a minority of approximately the same size.

[1] [http://www.bbc.co.uk/news/uk-
politics-26892237](http://www.bbc.co.uk/news/uk-politics-26892237)

------
eis
Great news, though I guess politicians will find loop holes in this decision
that will let them do it anways, albeit slightly differently.

I also wonder if this could have implications on drag net data collections by
intelligence agencies.

~~~
rossng
Most likely the individual countries will keep doing it - even if EU may no
longer require them to.

~~~
eis
Can they do this though? It would be against EU law after all.

~~~
malka
Some countries (such as France) shit on EU laws and prefer to pay fines with
the citizen taxes. Yay.

~~~
digitalengineer
Same here in Holland. We have an extra tax (called BPM) on all new cars. It is
so high (25K on a BMW X5) we are fined by the EU every year. But it is so
profitable our government pays the fine smiling.

~~~
koyote
Probably paying the fine using the BPM; thus going in a full circle.

------
DanBC
One mildly interesting / infuriating pre-Snowden tidbit: the UK was having a
national discussion about this kind of mass surveilance. GCHQ were asked for
their response a few times. They replied saying things like "it's useful for
some crime prevention; you need checks and balances" and so on. What they did
't say was "this isn't relevant to us, because the law already allows us to do
it (also, we already are doing it)".

With hindsight I can see how carefully they crafted all their answers. It is
very frustrating to me that journalists did not read the relevant laws (which
clearly list exemptions for GCHQ) and did not question the relevant oversight
bodies or GCHQ for more information.

I tend to agree that slurping and storing all content data or all metadata is
probably the wrong approach.

It does make me wonder if the technology got released in any form, even as
university research, back to the public. I can understand keeping bomb design
documets secret, but better database and better data mining tech is less
sensitive.

------
tempodox
So, contrary to well-founded despair in the U.S. of A. & the U.K., there are
still civilized regions on this planet. This gives me hope.

~~~
NicoJuicy
Actually, the U.K. is part of the EU, so this should affect them...

~~~
Tyrannosaurs
Yes, but if we don't already we'll soon have our own national law requiring
this data be collected.

This government aren't at all liberal in this regard and would never have been
wild about trusting the EU to do this (or anything else) in the first place.

~~~
NicoJuicy
Yes, you have your own censorship law, but protesters now have a legal
standing to challenge the law at national level.

Because EU law > United kingdom law.

~~~
Tyrannosaurs
I understand that but that challenge will take years and will potentially
still result in nothing happening.

Look at prisoner voting rights in the UK. The UK passed a law in 1983 saying
prisoners couldn't vote. In 2001 someone mounted a legal challenge to it which
was dismissed and arrived in Strasbourg later that year.

That court ruled in 2004 saying a blanket ban on prisoner voting was illegal,
the UK appealed and lost in 2005. The government messed around before bringing
a bill before parliament in 2009 to allow some voting rights - this bill was
defeated.

And since then.... Nothing. 2014, 13 years after the original case was bought,
5 years after is was won and prisoners have no right to vote and the
government have repeatedly stated they aren't going to get the right to vote.

And the UK isn't the only country where this happens - I can't remember which
but either France (I think) or Italy are notorious for ignoring EU court
rulings where it doesn't suit them.

EU Courts are great where the national governments feel inclined to do what
they say or don't feel too strongly about it but if they don't want to do what
the court says, quite simply they don't.

~~~
NicoJuicy
You get 3 years to implement this or financial penalties will follow...

Want proof?

[http://europa.eu/rapid/press-
release_IP-12-530_en.htm](http://europa.eu/rapid/press-
release_IP-12-530_en.htm)

If it wouldn't have been invalidated, Germany would have received financial
penalties.

~~~
Tyrannosaurs
You can explain why prisoners in the UK still don't have the vote then?

------
NicoJuicy
I'm actually curious about which effects this ruling in the United Kingdom
(Brittain).

Although they are subject to this regulations, considering their censorship
the last years, i don't believe they are willing to coöperate on this (like
they are not willing to drop the British pound in favor of the €)

Just a thought.

------
CharlesKCarillo
Great news, though I guess politicians will find loop holes in this decision
that will let them do it anyways, albeit slightly differently.

------
shmerl
Great decision. I hope in US something similar will happen. But somehow I
doubt that it will in the current sick climate.

------
atmosx
hm. This is important, extremely important. I'm very happy as an EU citizen
for the direction the EU has been taking lately on technology matters.

I'm not fond of the EU, Brussels or anything, but there's a string of positive
decisions in technology related matters that not many people seem to
understand. That's good.

~~~
junto
My assumption is that a UK individual, backed by an organisation such as
Liberty will start the long road to the European Court of Human Rights, but
first they need to take this to court in the UK (and lose to qualify).

------
acd
EU is run by a leader who is an ex Mao communist and the head banker is ex
Goldman Sachs. I trust them not.

[http://en.wikipedia.org/wiki/Jos%C3%A9_Manuel_Barroso](http://en.wikipedia.org/wiki/Jos%C3%A9_Manuel_Barroso)
[http://en.wikipedia.org/wiki/Mario_Draghi](http://en.wikipedia.org/wiki/Mario_Draghi)

~~~
astrange
That sounds like a reasonably trustworthy set of people if they're ideological
opponents.

