The Dutch Data Protection Authority (DPA) has advice on a draft bill containing amendments to the existing data retention obligations for telephony and internet communications data. The draft bill follows a ruling in April 2014 by the Court of Justice of the European Union (CJEU), which found the EU Data Retention Directive (2006/24/EC) was invalid. The Dutch DPA found that the retention of the historical telephony and internet data of virtually all Dutch citizens for six to 12 months is a “far-reaching measure, requiring an irrefutable demonstration of necessity”.
The Dutch DPA further stated that the infringement of the private life of virtually all Dutch citizens is too big and disproportionate. The Dutch DPA therefore recommended that the bill should not be presented to Parliament.