The obligation to store traffic and location data ("data retention") in effect from July 2017 violates EU law.
Effective July 1, 2017, Section 113b German Telecommunications Act obligates providers of publicly available telecommunications services to store traffic data for ten weeks and location data for six weeks. According to the North-Rhine Westphalia Higher Administrative Court, said data retention is not compatible with Union law (June 22, 2017, Case 13 B 238/17).
The decision was issued in response to an internet provider's emergency appeal to be temporarily exempted from the obligation to retain customer data. While the Cologne Administrative Court of had rejected the application (January 25, 2017, Case 9 L 1009/16), the Higher Administrative Court has now accepted the internet provider's appeal.
The court held that Section 113b Telecommunications Act violates the Data Protection Directive of 12 July 2002 (Directive 2002/58/EC). According to the decision of the European Court of Justice (21.12.2016, C-203/15 and C-698/15), an obligation to retain data is lawful only where the number of data subjects from the outset is restricted to cases associated with the prosecution of serious criminal offenses or the defense of serious dangers. Since Article 113b Telecommunications Act does not provide for any such restriction, the provision is not compatible with EU law.
The decision of the Higher Administrative Court only has a binding effect on the internet provider that filed the application. It cannot be ruled out, therefore, that other courts will arrive at a different conclusion in comparable proceedings. The Federal Constitutional Court has recently refused to rule on the constitutionality of data retention prior to July 1, 2017.