The Freename Forum

Federal Minister of Justice Marco Buschmann (FDP) is going on the offensive when it comes to data retention: the bloggers at netzpolitik.org have published a draft bill that aims to establish the “quick freeze” procedure favored by the liberal party.

The legal situation seemed clear: in its ruling of September 20, 2022, the ECJ confirmed its case law according to which the German regulations on data retention are incompatible with EU law, as EU law precludes the general and indiscriminate retention of traffic and location data such as IP addresses. The ECJ clarified this case law in the “La Quadrature du Net” case due to French regulations on the protection of intellectual property on the internet, but ultimately relaxed it. In its ruling of April 30, 2024 (case no. C-470/21), the ECJ ruled that the general and indiscriminate retention of IP addresses does not necessarily constitute a serious interference with fundamental rights. According to this ruling, data retention is permissible if the national legislation prescribes storage modalities that ensure an effective and strict separation of the different categories of personal data and thus prevent precise conclusions from being drawn about the private life of the person concerned. A new debate promptly broke out in the traffic light coalition; while the Federal Ministry of the Interior under Nancy Faeser (SPD) is pushing for IP addresses to be retained, Buschmann is in favor of introducing the possibility of an ad hoc retention order for traffic data (“quick freeze”).

Buschmann emphasizes this wish with the “Draft of a law to introduce a security order for traffic data in the Code of Criminal Procedure”, which he recently submitted to the departmental vote and which is available to the activists of netzpolitik.org. In a revised Section 100g (6) of the Code of Criminal Procedure, the investigative instrument of a security order for existing and future traffic data is to be introduced. It should be permissible to secure such data on an ad hoc basis for the prosecution of serious criminal offenses, insofar as the traffic data may be of importance for investigating the facts of the case or determining the whereabouts of an accused person. In principle, the measure should only be permissible on the order of a judge; this would limit the amount of data to be stored to what is necessary, as only the traffic data already available to telecommunications service providers for operational purposes and which will be generated in the future may be secured (“freezing”). This data is to be available to the law enforcement authorities for a limited period of time for later collection and analysis; this requires a new court order (“unfreezing”). In the opinion of the Federal Ministry of Justice, this “quick freeze regulation” is in line with the case law of the European Court of Justice on data retention. The law enforcement authorities will be provided with a legally secure and effective investigative tool to combat serious crime in the digital space. The obligated companies should also be adequately compensated for their efforts.

De facto, data retention has not been carried out and used for law enforcement purposes in Germany for over 14 years. Whether and how many cases could have been solved if data retention had been in place is a matter of speculation, according to the Federal Ministry of Justice. In 2011, the Max Planck Institute for Criminal Law found in its study “Protection gaps due to the abolition of data retention?” that there are no such gaps in law enforcement. Since then, however, digital communication has become increasingly important; in many criminal proceedings, there are hardly any other investigative approaches available apart from digital traces.

You can find the netzpolitik.org article (in German) at:
https://netzpolitik.org/2024/statt-vorr ... ck-freeze/

Following the failure of the ‘traffic light’ coalition, Interior Minister Nancy Faeser (SPD) has renewed her call for data retention without cause. With the votes of the CDU/CSU parliamentary group, she is hoping for a new legal regulation before the general election.

In October 2024, the then Federal Minister of Justice Marco Buschmann (FDP) pushed ahead with the ‘Draft Act on the Introduction of a Preservation Order for Traffic Data in the Code of Criminal Procedure’, which was intended to establish the ‘quick freeze’ procedure he favoured. In a revised Section 100g (6) of the Code of Criminal Procedure, the investigative instrument of a protective order for existing and future traffic data was to be introduced. In principle, the measure should only be authorised by order of a judge; this would limit the amount of data to be stored to what is necessary, as only the traffic data that already exists with the providers of telecommunications services for operational purposes and will be generated in the future may be secured (‘freezing’). This data is to be available to the law enforcement authorities for a limited period of time for later collection and analysis; this would have required a new court order (‘unfreezing’). However, this is unlikely to happen: after Buschmann was dismissed from office at his request following the collapse of the traffic light coalition, Volker Wissing has now taken over the Federal Ministry of Justice until the next elections, which are expected to take place in February 2025.

Faeser is promptly pushing for IP addresses to be stored again in future. At the BKA Autumn Conference 2024 on 20 November 2024, she said: ‘In an international comparison, however, we have to conclude that the German law enforcement authorities are not up to date in terms of their technical powers. We fall short of our capabilities in many areas. One example of this is the issue of IP address retention. I am crystal clear in my position: we need this data.’ The Federal Constitutional Court and the European Court of Justice have pointed out corridors that can be utilised. In the analogue world, the police have access to the register of residents; in the digital space, this is not the case without IP address storage. ‘Despite this, it was unfortunately not possible to reach agreements on the necessary improvements in this legislative period, in particular due to a coalition partner. Improvements that even the ECJ now considers to be urgently needed. If it had been up to me, we would have implemented mandatory storage long ago. Others prevented it,’ said Faeser, taking a jab at the FDP and Buschmann. According to heise.de, Faeser is currently in talks with the CDU/CSU parliamentary group in the Bundestag, apparently in order to obtain the necessary majority in favour of data retention without cause; as recently as October 2024 (printed matter 20/13225), the CDU/CSU once again called for the minimum retention of IP addresses to combat serious crime to be regulated in accordance with ECJ case law.

In its ruling of 20 September 2022, the ECJ confirmed its case law according to which the German provisions on data retention are incompatible with EU law, as EU law precludes the general and indiscriminate retention of traffic and location data such as IP addresses. According to its own statements, the ECJ clarified this case law in the ‘La Quadrature du Net’ case due to French regulations on the protection of intellectual property on the internet, but ultimately relaxed it. In its judgement of 30 April 2024 (case no. C-470/21), the ECJ ruled that the general and indiscriminate retention of IP addresses does not necessarily constitute a serious interference with fundamental rights. Accordingly, data retention is permissible if the national legislation prescribes storage modalities that ensure an effective and strict separation of the different categories of personal data and thus prevent precise conclusions from being drawn about the private life of the person concerned.

Source (German): https://www.heise.de/news/Nach-FDP-Auss ... 08048.html

A controversial debate has broken out in the Bundestag about the minimum retention of IP addresses. However, the outcome is already becoming clear: data retention is coming back - with either a one-month or three-month retention period.

During a debate in the Bundestag on 5 December 2024, MPs were presented with three draft bills. The CDU/CSU parliamentary group's bill ‘to improve crime investigation - introduction of a minimum retention period for IP addresses and restoration of the radio cell interception option’ (printed matter 20/13366), the FDP parliamentary group's bill ‘to introduce a traffic data retention order in the Code of Criminal Procedure’ (printed matter 20/14022) and a bill from the Bundesrat ‘to introduce a minimum retention period for IP addresses to combat serious crime’ (printed matter 20/13748). The FDP's draft bill provides for a revised Section 100g (6) of the German Code of Criminal Procedure and is based on the ‘quick freeze rule’. The Federal Government had agreed on this solution in principle; however, following the failure of the ‘traffic light’ coalition, this draft is considered to have little chance of success. The CDU/CSU draft provides for the introduction of a minimum retention of IP addresses and the restoration of the possibility of radio cell interception. The bill is intended to adapt the data retention provisions in Sections 175 and 176 of the Telecommunications Act, which are contrary to EU law, to the case law of the European Court of Justice, the Federal Constitutional Court and the Federal Administrative Court and limit them to a three-month retention period for IP addresses, including any port numbers assigned, for the purpose of combating serious crime and preventing serious threats to public security.

The Federal Council's draft bill is new. The chamber of the federal states also wants to adapt the national regulations on data retention in line with case law and limit it to one month - instead of the three months demanded by the CDU/CSU - for the storage of IP addresses and any assigned port numbers. A more extensive and intrusive obligation for additional minimum storage of location data for mobile internet use is not provided for in this draft. Storage without cause for the purpose of averting danger is also dispensed with. The IP address of the perpetrator is often the only, but always the first, most efficient and quickest investigative approach for law enforcement authorities in the case of criminal offences committed via the internet. Without the assignment of the IP address to a connection owner, investigations would often come to nothing if no other traces were available. In order to enable this assignment with certainty, a regulation is needed for the mandatory storage of IP addresses by internet access providers that makes use of the leeway that the ECJ opened up for traffic data retention in its ruling of 20 September 2022.

Following the almost 70-minute debate, all drafts were referred to the committees. The Committee on Legal Affairs will take the lead in the further deliberations, with the Committee on Home Affairs and the Committee on Digital Affairs also involved. However, what is not included in the debate is statistical data and a systematic evaluation of cases in which investigations actually come to nothing without the IP address being assigned to a connection owner.

You can find the CDU/CSU parliamentary group's draft bill (in German) at:
https://dserver.bundestag.de/btd/20/133/2013366.pdf

You can find the Federal Council's draft bill (in German) at:
https://dserver.bundestag.de/btd/20/137/2013748.pdf

You can find the FDP parliamentary group's draft bill (in German) at:
https://dserver.bundestag.de/btd/20/140/2014022.pdf

While the duration of data retention was the only point of contention, the German government has now shown itself to be open to further discussions on the subject of data retention. This is suggested by statements from a government spokesperson.

Three draft bills have been submitted to the members of the Bundestag on the new regulation of data retention. The CDU/CSU parliamentary group's bill “to improve crime investigation - introduction of a minimum retention of IP addresses and restoration of the possibility of radio cell interrogation” (printed matter 20/13366), the FDP parliamentary group's bill “to introduce a security order for traffic data in the Code of Criminal Procedure” (printed matter 20/14022) and a bill from the Bundesrat “to introduce a minimum retention of IP addresses to combat serious crime” (printed matter 20/13748). While the FDP bill has little chance of success following the collapse of the traffic light coalition, the other two bills essentially differ in terms of the retention period; the chamber of states wants to limit the national regulations on data retention to one month - instead of the three months demanded by the CDU/CSU - for the retention of IP addresses, including any assigned port numbers. The draft legislation is currently in the Bundestag committees, with the Legal Affairs Committee taking the lead.

This position was considered to be firm. At the government press conference on 30 December 2024, deputy government spokesperson Christiane Hoffmann emphasized the “legally secure obligation to store IP addresses”; this was essential in the fight against crime and terrorism and had been declared not only permissible but necessary by the European Court of Justice. “But the position is that we need a legally secure obligation to store IP addresses,” said Hoffmann. The U-turn followed on January 3, 2025. According to information from heise.de, which is based on the second deputy government spokesperson Wolfgang Büchner, the German government intends to “find a good solution”; however, the talks of the German government “have obviously not been concluded”. It is possible that Hoffmann's statement was not agreed with the parliamentary groups of the governing parties in the Bundestag or with all ministries. Büchner did not say what changes were in the pipeline. The 2021 coalition agreement did not provide for mandatory data retention, which would mean data retention without cause. Instead, “it should be possible to store data in a legally secure manner, on an ad hoc basis and by court order.”

Meanwhile, eco - Association of the Internet Industry reiterated its criticism of the controversial measure. “The mass storage of private IP addresses without cause is contrary to fundamental rights and violates EU law. This was already decided by the European Court of Justice in 2022 and confirmed by the Federal Administrative Court in 2023,” said eco CEO Oliver Süme. Furthermore, it regularly brings no added value in terms of criminal prosecution in connection with the circumstances in which it is repeatedly called for. “I therefore recommend that the current German government adhere to this ruling and the position set out in the coalition agreement and thus avoid years of renewed legal disputes and the associated legal uncertainties,” Süme continued.

You can find the CDU/CSU parliamentary group's draft bill (in German) at:
https://dserver.bundestag.de/btd/20/133/2013366.pdf

You can find the Federal Council's draft bill (in German) at:
https://dserver.bundestag.de/btd/20/137/2013748.pdf