top | item 32911247

Germany's blanket data retention law is illegal, EU top court says

311 points| tyrion | 3 years ago |reuters.com

174 comments

order

Semaphor|3 years ago

Our data retention laws get overturned all the time. Usually already by our constitutional courts. Sadly our politicians don’t care much and don’t get punished, so they just try it again and again and again and usually it’s in effect for a while before the courts give judgement.

I really can’t explain where Politikverdrossenheit (political apathy) comes from.

edit: The last sentence is sarcasm

geewee|3 years ago

Seems like we've had basically the exact same case in Denmark. A law gets overturned by the ECJ and they just make another law that's slightly different. Then they say there's a certain "process risk" regarding the law which basically means it might not be compatible with EU law at all. Pisses me off.

Etheryte|3 years ago

Out of curiosity, doesn't Germany have the equivalent of a constitutional watchdog? For example in Estonia, the president fills this role (as do some other constitutions, but the president is a good example in this context). The president is otherwise a purely ceremonial figurehead in Estonia, but one functional role they fill is that before any new bill becomes law, they have to sign off on it and declare it's constitutional. If they find it not to be, they can send it back to the parliament (or to the highest national court, depending on the circumstances).

ajsnigrutin|3 years ago

> I really can’t explain where Politikverdrossenheit (political apathy) comes from.

I understand... it's simple... someone does something bad, nothing happens to them... bad thing again... nothing happens... people protest... nothing happens... bad thing again.. nothing happens...

If this was some other timeline, and people brought guillotines out every couple of years and "dealt with" the "bad" politicians in "the french way", politicians themselves would be calling for jail sentances, because they'd atleast be alive in there.

Otherwise, i live in a different country, and the political situation is the same.

tut-urut-utut|3 years ago

Don't worry. Today's newspapers reports that our fine ministerin is already looking to find and exploit loopholes in the judgement and will try to implement as much as possible [1].

It's a shame. We tend to criticize EU for a million valid reasons, but once in a while when they do something right, our government first reflex is to just ignore it.

[1] (German) https://www.zeit.de/politik/deutschland/2022-09/vorratsdaten...

retcore|3 years ago

From 51:25 in this BBC documentary [0] you're introduced to Horst Herold [1] the President of the BKA (Federal police) who instigated the creation of the Suchsystem Inpol sowie Analysen [2] to catch the Baader Meinhoff gang by trawling citizens data. Until the violence of the Baader Meinhoff gang, there was sufficient popular sentiment including in politics, against any Federal use of power as prohibited by the constitution. This was effectively reversed with the assassination of Alfred Herrhausen [3] using a enfilade of shaped charges to slice through his armoured limousine. Herold created the first European data dragnet to identify anyone who profiled similarly to his quarry. The gang were apprehended only using indirect evidence ,[edit: of their whereabouts]. Violence and the ensuing police reactions disheartened and suppressed opposition to Federal government enforcement.

[0] https://www.bbc.co.uk/iplayer/episode/p093wy1r/cant-get-you-... ,

[1] https://en.m.wikipedia.org/wiki/Horst_Herold ,

[2] https://de.m.wikipedia.org/wiki/INPOL ,

[3] https://en.m.wikipedia.org/wiki/Alfred_Herrhausen

salawat|3 years ago

It comes from fundamental constraints on signal propagation, socially reinforced bias towards abstaining or following anyone who sounds like they have expertise, confict aversion, the huge overhead involved with actually becoming known enough by people to get past change aversion, and a general willingness to accept that the emperor is far away even though in today's world they aren't.

We're literally living in a time where "global" namespace changes are made willy nilly by people who don't even spend the time reading everything they may have an effect on by doing them, which is just accepted as being "impossible".

Further, the only people with the time/resources to engage in politics in a tangible way are pgobably the most disconnected people from the way of life for the polises they are shaping.

Human beings are ruthless energy optimizers (biological constraint), and the cognitive load of actually productive political engagement is absurdly high. Thus, people with literally anything else to do avoid it, or find it pointless, leaving only those so bereft of anything else to do to be the most impactful on that arena. Which in turn creates more for the disengaged to have to do to keep them from getting in the way...

It's a vicious cycle.

themitigating|3 years ago

Political apathy comes from the political party that would most benefit from low turnout.

If you are disappointed with politics that is a reason to vote. If you don't care, that's a valid reason not to vote

hok|3 years ago

The fact that a court overturns a law is proof that our democracy actually works.

No need to be 'verdrossen'.

It would be worse if the courts just approves all laws the government conceives.

pgorczak|3 years ago

The process makes sense from a separation of powers perspective. When there’s an especially fine line between what legislative wants and (constitutional) judicative allows, there has to be some rejections.

This is probably one of the cases where lawmakers feel some spite about constitutional courts exerting too much influence over their work. It would be easier if they’d just talk about it before going through the whole process but I guess creating frustration is part of the point here.

pelasaco|3 years ago

Me as german citizen would be interested to know how much such processes costs from our taxes money. From bringing such law again to debate, convicting the parlament to vote it, then approving it, then the whole courts costs... I'm not sure why at least once a year we see that there.. regardless of who is in the government.. Is it Lobby driven?

ekianjo|3 years ago

Its funny that it happens in Germany of all places. Its not like they had a case of excessive use of data by the state before (stasi) against their own citizens

Either memories are short or there is political fantasy of being control freaks going on

amelius|3 years ago

> I really can’t explain where Politikverdrossenheit (political apathy) comes from.

It comes from voter indifference.

therealmarv|3 years ago

hold on, what Germany wanted to do (blanket data retention) is a reality for a long time in other states in EU. There are many countries collecting for 6+ months all connection data (e.g. France or Spain). A map is in this German article from 2019

https://netzpolitik.org/2019/vorratsdatenspeicherung-in-euro...

So this becomes illegal in other EU member states now too? Does anybody have any inside how this will change EU data retention in general?

eivarv|3 years ago

It has been illegal at least since the Grand Chamber judgments on the cases of "Big Brother Watch" and "Centrum för Rättvisa" last year [0]. Though, really, the outcome was fairly predictable for anyone following the field.

TLDR; Continuous "General and indiscriminate retention" is not compatible with EU fundamental rights.

[0]: https://europeanlawblog.eu/2021/06/08/big-brother-watch-and-...

unity1001|3 years ago

I believe you have to retain tax-related data (customer invoices, bills, payments etc) for ~2 years or however long your local jurisdisction requires. I don't think that will go away since such laws mirror the long-standing laws used in normal accounting. This should be related to non-ecommerce related data.

sschueller|3 years ago

We have 6 months and 10 years for tax stuff here in Switzerland too. I thought it was quite reasonable. At least there is a set date when you can and have to delete stuff.

You are also not allowed to use a customer database for advertising if the customer is no longer one for more than 6 months.

omgomgomgomg|3 years ago

Yet another time Germany needs external intervention measures to get in line.

Time and time again, history has proven everywhere that if the population does not keep their politicians in line, they will get drunk from all the power.The people do not even vote reasonably, so it is very difficult.

Have these lawmakers ever presented good results which can be attributed to their work?

Sebb767|3 years ago

> The people do not even vote reasonably, so it is very difficult.

You get three votes [0] every four to five years, where you need to vouch for someone from a short list to make all the choices to represent you. And this is actually the good case, in the US it's reduced to just two options. Deciding whether someone votes reasonably is very hard when they weigh certain decisions (and how likely politicians are to keep their promises) completely different.

Just as an example, you might say that you think climate change is the most important topic overall right now, so you vote for the German Green party - except, of course, if you doubt that they'll actually change much or if you think that nuclear power is the answer, which they don't like. So you think of voting for a small party, but they'll be in the opposition at best, but most likely not even hit 5%, making your vote nothing more than a gesture completely ignored by the ruling parties. So what's the unreasonable choice here?

Long story short, what I'm trying to say is that whenever I heard the accusation of people voting unreasonably, so far, the actual argument always was "people disagree with my [clearly optimal] opinion or voting strategy".

[0] Local, federal and state each.

int_19h|3 years ago

There's a curious comment on that article from a person in support of that retention law:

"Google can do that [blanket data collection], my Chinese mobile phone manufacturer too, why shouldn't the government be able to do it?"

Something to ponder when we talk about data collection by private parties: like it or not, it does provide justification for governments doing the same.

ghiculescu|3 years ago

You can opt out of using Google or buying Chinese phones more easily than you can opt out of being German. Governments have more unchecked power and should be held to a higher standard accordingly.

eivarv|3 years ago

No, it does not – for two reasons:

  - Two wrongs don't make a right: Someone behaving unethical does not excuse unethical behavior from someone else.
  - There is a difference in the power dynamics of the relationships: Consumer and service provider VS citizen and state.
If anything, laws and right should be strengthened to explicitly ban this behavior.

uhuruity|3 years ago

Governments have a monopoly on (legal) violence, and by default it's not possible to move countries (that is, unless you get a visa or live in a free movement area). I think it's reasonable to hold governments to a qualitatively higher standard than companies.

caskstrength|3 years ago

Because neither Google nor your Chinese mobile phone manufacturer can put you in jail.

ls15|3 years ago

> like it or not, it does provide justification for governments doing the same.

No it does not. I can (and mostly do) evade the data slurping of private players, at least in theory, by not using and blocking Google, Meta and the likes. I cannot reasonably evade the data crimes that the government does.

superjan|3 years ago

It works the other way too: If a politician objects to FAANG privacy violations, they should not introduce laws that allow such violations themselves.

novok|3 years ago

Google and others are also not allowed to do blanket data collection by law, they are restricted in how and who's data they can collect with stuff like the GDPR.

You can debate how effective it is, but they are not allowed to do it, and nobody should be allowed to either.

shuuv4678igt|3 years ago

look no further then all the data cloudflare collects on us all.

did you ever see a cloudflare gdpr consent popup?

rmbyrro|3 years ago

Is the ECJ kind of a Supreme Court that can overturn member state laws and rulings?

I had the impression member states were 100% sovereign within the EU...

dagw|3 years ago

ECJ can only rule on EU laws. So as such they are not overturning any German laws, just stating the the German law is not in compliance with EU regulations. What that means in practice varies a lot from case to case, but in general the EU has the power to fine members that are in breach of EU regulations.

For practical reasons most EU countries want to be in compliance with EU law and will often follow ECJ recommendations and change their own laws if found to not be compliant. Also many EU countries have laws that essentially state that all their laws must comply with EU law.

The other option is to apply for an explicit opt out of certain a EU regulation that you feel is incompatible with your own laws.

chippiewill|3 years ago

Member states are sovereign insofar as the EU institutions only have jurisdiction because the member states allow them to do so. EU law only applies because local law says it applies. The ECJ is the highest court in any of the member countries because the law in those countries say it is.

This differs from the situation in the US where Texas couldn't pass an amendment to their state constitution declaring that they are no longer subject to federal law. State law is subordinate to federal law / the US constitution.

NoboruWataya|3 years ago

The supremacy of EU law is a pretty interesting one. It is a fundamental principle of the EU that EU law takes primacy/supremacy over national law (in areas where the EU has competence). How this actually works in practice can be a bit fuzzy, because the EU is certainly not going to send tanks into a member state's capital to enforce its laws.

As I understand it, the way this usually works is by national law explicitly endorsing EU law (usually at the level of the national constitution) and stating that in the event of any contradiction between EU law and domestic law, EU law will prevail. So EU law is "supreme" in practice, but that supremacy is granted/recognised under the domestic constitutional order.

In some countries, this recognition is limited, such that national courts will not permit EU law to override certain aspects of the national constitutional order. When that happens, there is really no easy solution.

An interesting recent example is https://www.politico.eu/article/brussels-closes-case-against... where the German court found that an ECB bond-buying programme was unconstitutional and in doing so refused to follow a prior decision of the ECJ.

Another consequence of this approach to supremacy is that significant changes to the EU treaties require a constitutional amendment in Ireland, which requires a referendum. To my knowledge Ireland is the only country to have such a binding legal requirement, with the effect that a number of amendments to the treaties have in the past been delayed or defeated by the Irish public voting against them.

anony999|3 years ago

Who is 100% sovereign? Any kind of treaty makes you less "sovereign". I believe it's the same question about freedom. Are you a free person if you have a job, pay mortgage or marry someone?

sofixa|3 years ago

> I had the impression member states were 100% sovereign within the EU...

~80-90% depending on how you measure.

The judiciary of all countries is technically under the ECJ jurisdiction. People can sue their countries, and local court decisions can be appealed to the European court structure (ECJ/ECHR).

That was in fact one of the Brexit talking points, judiciary independence.

AdrianB1|3 years ago

The member states are not 100% sovereign within the EU, there are some mechanisms to control it. For example, Romania (EU member country) has a provision that international treaties signed by the country override local legislation, so that EU directives - while not directly in effect - are above local legislation.

Practically, if a national law is found to be not compliant with the EU legislation, the country has some time to adjust it to make it compliant or to repel it. In court cases, the Constitutional Court can directly strike the provision in the law or the entire law, as appropriate.

xyzzyz|3 years ago

A good mental model is that EU works pretty much like US did 100 years ago. The US states were roughly as sovereign as EU states (with some important differences, especially in defense and immigration), and US federal government was similarly powerful to EU government.

This has, of course, changed over the last century, and US states lost most of their sovereignty. I predict the same will happen to EU states over the next century.

drooopy|3 years ago

I hate to break it to you, but there is no such thing as a 100% sovereign country anywhere in the world.

arlort|3 years ago

Define sovereignty

Member states have agency to leave the EU whenever they'd like if they wish not to be bound by agreed upon laws

tokai|3 years ago

The sovereign members of the EU have ratified treaties of European Union law themself.

BlueTemplar|3 years ago

In related news, the EUropean Data Protection supervisory authorities are complaining that their budget isn't being significantly increased even as the complaints they have to process have exploded in the recent years :

https://euobserver.com/tickers/156038

that_guy_iain|3 years ago

Germany is a weird one. On one side of things, they really like their privacy. People will routinely upload pictures to instagram where they find their faces and faces of others for pictures they posed for. I don't get it, if you posed for a picture to go on Instagram why do you need your face covered?

On other side of things the goverment does more data collection and data requests than nearly every other goverment. The goverment is super willing to record everything you do. While at the same time making it illegal for you to record someone without their knowledge.

shadowgovt|3 years ago

Interesting that it was a German law. I was under the impression that German law was pretty conservative on data collection.

bakuninsbart|3 years ago

In general, yes, and I think Germans are (at least in theory) much more protective of their data than others. Nonetheless, every government since the late 00s has been trying to push this through in one form or another.

I suspect there is heavy lobbying from within the professional bureaucracy (including police and IC) for this. Possibly also diplomatic pressure from countries like the US.

rad_gruchalski|3 years ago

Let’s not forget: we are talking about a country where every visit to a new doctor results in having to sign a Datenschutz form in order to agree to data processing. This is a country where personal data supposed to be saint. Double standards.

dane-pgp|3 years ago

I'd be interested to know if the EU law that the ECJ relied on differs from or goes further than the case law from the European Court of Human Rights that the UK is still a member of.

A ruling against mass data retention in the UK could help Privacy International in their on-going case against the government for its mass surveillance and use of "bulk personal datasets".

https://www.privacyinternational.org/long-read/4598/briefing...

gpderetta|3 years ago

Mass data retention and surveillance has been ruled illegal multiple times both by ECJ and ECHR (as it is in direct contravention with the right to privacy in article 8). In particular UK is still supposedly bound by the ECHR even after Brexit. Unsurprisingly, EU governments and UK in particular, do not care, and there is only so much these courts can do to enforce their judgments.

tgsovlerkhgsel|3 years ago

Doesn't sound great:

"allows, for the purposes of safeguarding national security, an instruction to be given requiring providers of electronic communications services to retain, generally and indiscriminately, traffic and location data in situations where the Member State concerned is confronted with a serious threat to national security that is shown to be genuine and present or foreseeable. Such an instruction must be subject to effective review, either by a court or by an independent administrative body, and can be given only for a period that is limited in time to what is strictly necessary, but which may be extended if that threat persists"

-- that is just asking for a "perma-emergency" to justify such an exception for a long time until the court can (years later) maybe decide that that goes go far.

BlueTemplar|3 years ago

And laws about the data collection, collation, and usage by governments date quite a way back...

For instance, the 1974 French SAFARI scandal,

where the government wanted to build a centralized computer database that would collect country-wide administrative data, starting with the 400 (physical) police files, and IIRC with a single social security number for each citizen,

has caused such an uproar that the project was abandoned and the data privacy regulator CNIL was soon created.

(Note the totalitarianism (aka "high modernism") inherent in computers, by the way what they show tends to be accepted as truth, the way they don't have any common sense, the way their digital nature tends to classify people into strict categories, which then become set in stone by their limited capacity to forget, the way the free flow of information turns qualitative and how they give a lot of power to the State while democracies try to limit this power.)

Sadly, we've recently seen its failure - caused in a big way by it being stripped of its power in 2004, leaving only a consultative (non-)power - in 2010 a law about "a general principle of information sharing between administrations" has still been created.

Some notable worries are about the preceding 2007 law that authorized ethnic statistics - while personal data treatment using ethnic or racial data, and adding race and religion values in the administrative files are still forbidden - the potential of ethnic data becoming racial data is still very high.

Another worry is about the genetic prints file : created in 2002 and first limited to sexual criminals, it has since been extended to a whopping 5% of the population, 87% of which have NOT (yet, quite a lot of the debate being how long these files should be kept) been condemned for the reason they got added to the file. It gets worse, and shows how quantitative can become qualitative : because genetic information is NOT independent between family members, a staggering third of the population ends up having its genetic identifiers at least partially stored in these files.

A 2022 project (submission date ending 2 weeks ago) to interconnect the digital prints file with the criminal records file has mentioned a potential future project of connecting both with the generic prints file... (among others) with also a policemen-suggested requirement that "the solution be compatible with remote work [...] not requiring strong authentication".

kurupt213|3 years ago

I would think it’s also against the spirit of the bill of rights, yet here we are in America, with secret courts reviewing secret surveillance and meta data.

aksss|3 years ago

And it's not even a secret process half the time - witness the recent conversations about CBP imaging phones of intl travellers.

layer8|3 years ago

Note that the ruling defines a number of exemptions. See the text following “However, EU law does not preclude national legislation which” in the press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/202...

In particular, service providers will probably still have to maintain the infrastructure to activate “general and indiscriminate” data retention on demand.

numlock86|3 years ago

Is this from the same guys who want to get rid of cryptography for the public or at least get some backdoors?

gpderetta|3 years ago

The ECJ never 'wanted to get rid of cryptography' nor has the power to do so. It has the power to declare that such a law would violate EU treaties though.

sva_|3 years ago

I posted this earlier:

https://news.ycombinator.com/item?id=32909698

I don't care about the points, just think it is a bit weird that a promotional commercial company post is now on the frontpage instead of a more neutral news site.

Although now, Reuters would probably be the better source than what was available earlier today:

https://www.reuters.com/technology/indiscriminate-data-reten...

nonethewiser|3 years ago

Is Germany a sovereign country if an international court presides over them?

This tends to get brushed aside by people defending the EU. Isn't this a step in the direction of the EU becoming something like the United States? There tends to be a lot of double-speak on this: "That's not true" and "it's a good thing" at the same time.

gpderetta|3 years ago

Any country that signs any form of international agreement is giving away part of its sovereignty in exchange of some benefit. It is just a matter of degrees.

karatinversion|3 years ago

It is not. The whole point of the EU is to pool sovereignty for common benefit. Germany is constrained in things it can do: it cannot ban the importing of French wine, give huge subsidies to its domestic steel industry to gain market share in Europe, or stop Bulgarians entering the country.

Of course, there is no EU army enforcing EU law, so a sufficiently damn-the-consequences German government could do these things, at the cost of destroying the single market.

layer8|3 years ago

Germany is free to leave the EU if they don’t want to follow the accords anymore. Its being subject to EU law is voluntary.