With effect from 1 January 2008, the German parliament implemented EU directive 2006/24/EC on the “retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks” (EU Directive).
Pursuant to the German implementing law, communication providers in Germany were obliged to store without having to show cause for six months all (1) call detail records of telephony and (2) internet traffic and transaction data of their users. Under the legislation, the German authorities were entitled to recall and use such data for the purpose of actual criminal proceedings and the avoidance of imminent danger.
After the German implementing law became effective, more than 35,000 constitutional complaints (Verfassungsbeschwerden) were filed against the law on the grounds that it violated fundamental constitutional rights.
On 2 March 2010, the German Federal Constitutional Court (Bundesverfassungsgericht / BVerfG) decided that the data storage obligations would no longer have effect. The German implementing law was ruled as unconstitutional with immediate effect.
The BVerfG was of the opinion that the German implementing law did not preserve the principle of proportionality. The storage of data without actual cause was deemed to constitute a breach of the fundamental rights of the users and therefore would only be legal if stringent conditions for the forwarding of such data to the German authorities were defined. Such conditions were not contained in the German implementing law. In addition, the law did not sufficiently define the purpose for which the data might be used and did not sufficiently ensure the security of the data. As the forwarding and use of the stored data had not been settled correctly the storage of the data was unconstitutional.
However, the BVerfG also stated that, in principle, data storage laws are permissible if the above-mentioned requirements are met. The provisions of the EU Directive give enough scope to implement the EU Directive in line with the German constitution. Therefore, the BVerfG was not obliged to refer the German implementing law by way of a preliminary ruling procedure to the European Court of Justice. The interpretation of the provisions of the EU Directive was not relevant to the case.
Communication providers in Germany must now immediately (1) stop the storage of data in accordance with the old law and (2) delete all stored data.
Although the deadline for the implementation of the EU Directive has already expired (15 September 2007 for telephone data and 15 March 2009 for internet data) the EU Directive will not have direct effect in Germany. An EU directive may have direct effect after the expiration of the relevant deadline for implementation where relevant to the rights of EU citizens included in the EU Directive. In this case, however, the EU directive only includes restrictions on individuals (and not rights) so it cannot have direct effect.
The German parliament is in the process of discussing and passing a new implementation law which meets the requirements defined in the judgment.