DG Information Society The EU and Data Retention Data Retention Meeting London, 14 May 2003 Philippe GERARD, DG Information Society The positions expressed are those of the author and do not necessarily represent the views of the Commission EUROPEAN COMMISSION

DG Information Society State of play in the EU  National laws or plans  Directive 2002/58/EC on Privacy and Electronic Communications  updating and replacing current 97/66/EC Directive)  Recent EU developments e.g.:  Commission’s 8th implementation Report 3 Dec 2002 (COM 2002 (338))  JHA Council Conclusions of 19 December 2002 on IT and organised crime  see also: Data Protection Working Party’s Opinions (see in particular 5/2002)

DG Information Society Data retention under EC law  Limits: ‘First’ pillar (EC Treaty) v. ‘Third’ pillar (EU Treaty)  Main sources of EC law  General principles of Community law e.g. proportionality  European Convention on Human Rights ( e.g Arts 8 and 10 ECHR)  EU Charter of Fundamental Rights (see Art 8 on personal data protection)  The ‘general’ DP Directive 95/46/EC, and the ‘specific’ DP Directive 2002/58/EC

DG Information Society The Directive on Privacy and Electronic Communications Directive 2002/58/EC  Confidentiality requirements (Art 5)  Security requirements (Art 4)  Rules on traffic data (Art 6)  ‘Public order derogations’ (Art 15 (1)) Clarification: Data retention measures NOT required NOR authorised by the Directive Margin for Member States BUT if a given MS adopts such measures, they must be in line with Directive 2002/58/EC

DG Information Society Two ‘tests’ under Article 15 (1)  Data retention and the internal market  Proportionality e.g. burden on operators, cost  Avoid as much as possible a patchwork of national laws  Data retention and Human Rights  Specific, listed purposes  Necessity, appropriateness and proportionality in a democratic society  Adequate safeguards  Legislative measures  Limited period of time

DG Information Society Issues for discussion  Current levels of availability of traffic data for business purposes  Look at the various services and business models  Data retention v. data preservation  Where would retention be necessary beyond storage for business purposes and preservation? (e.g. industry positions, Article 29 DP Working Party)  The data retention period  The overall cost to industry and how to address it  e.g. hardware, software, security requirements, staff, information to consumers and access by consumers  Impact on consumer confidence

DG Information Society Some URLs  Directive 2002/58/EC:  tory/new_rf/documents/l_ en pdf  8th Implementation Report:  mentation/annual_report/8threport/finalreport/com2002_0695en 01.pdf  Documents adopted by the Article 29 Data Protection Working Party:  /wp2003/wpdocs03_en.htm  JHA Council Conclusions on IT and organised crime: 