Developments and insights – European Commission

After years of reflection following the annulment of the EU Data Retention Directive in 2014, the Commission is now preparing a formal answer to the repeated calls by the Council¹ for a new EU-wide data retention framework. In June 2023, the Commission launched and co-chaired the High-Level Group (HLG) on access to data for effective law enforcement. The experts largely agreed that 'a harmonised EU framework regulating the retention of metadata for law enforcement purposes is needed'. Following up on the group's recommendations, the Commission committed to launching an impact assessment with a view to updating the EU rules on data retention in its European internal security strategy (ProtectEU) and its Roadmap for lawful and effective access to data for law enforcement. In preparation for this impact assessment, the Security in the Digital Age Unit (HOME D4) within the Commission's Directorate-General for Migration and Home Affairs recently launched a call for evidence and a public consultation, with the support of Council. Originally, the Commission had planned to finalise the impact assessment in the first quarter of 2026, but the results have not yet been published. The Commission has suggested that it could present a proposal by the end of the second quarter of 2026, subject to a positive outcome from the consultation. While past Council documents indicated support for and openness to a legislative proposal, the prospects for such a proposal now appear more uncertain owing to reservations expressed by at least one influential Member State.

Why is the initiative important?

Law enforcement authorities increasingly rely on electronic data in the course of criminal investigations. This not only includes access to content data, but also to non-content data, such as subscriber information, internet protocol (IP) addresses, device location data, and records of the timing and duration of communications. Non-content data helps to identify suspects or victims, and to reconstruct the factual circumstances of a crime. However, the ability of authorities to access such information depends on whether the relevant data are available, presupposing that they have been retained by communications services providers.

In 2006, the EU adopted the (meanwhile defunct) Data Retention Directive. The directive required providers to retain certain categories of communication traffic and location data for the investigation and prosecution of serious crimes. However, in 2014, the CJEU annulled the directive in its Digital Rights Ireland judgment (joined cases C-293/12 and C‑594/12). The Court held that the directive’s framework on general and indiscriminate retention of personal data constituted a disproportionate interference with the fundamental rights to privacy and data protection.

Since the annulment of the directive, the EU has lacked a common legal framework on data retention for law enforcement purposes. Member States have adopted different national approaches, varying in scope, types of data covered, retention periods and safeguards, while a few Member States have no data retention rules in place.² While CJEU jurisprudence has settled general data retention requirements, the finer details remain uncertain.

A common data retention scheme could create a level playing-field and legal certainty for communications services providers, ensure consistent protection of end-users across the EU, and improve cross-border law enforcement investigations and cooperation. As consistently demonstrated by CJEU case law, data retention is also closely intertwined with data protection considerations. While data protection and freedom of expression are often viewed as competing with security objectives, they may well contribute to attaining them. Data protection rules can improve the reliability of datasets, improve certainty that admissibility standards for evidence are met, facilitate cross-border data sharing through trust in equivalent standards, and simplify handling of datasets from different countries in a single investigation. By contrast, digital rights advocacy organisations, led by European Digital Rights (EDRi), oppose the adoption of a new EU data retention framework on the grounds that (i) law enforcement authorities can already access an ample amount of data collected by communications providers, (ii) there is insufficient evidence that data retention frameworks significantly improve law enforcement outcomes, (iii) less intrusive yet equally effective investigative methods are available, and (iv) existing mechanisms would sufficiently facilitate cross-border cooperation between law enforcement authorities.

Member States and interested parties' opinions

European Parliament views

Parliament has continually advocated a high level of data protection in legislative and non-legislative procedures. In view of the (at the time) 28 different legal frameworks on data retention, Parliament adopted a resolution in December 2018 urging the Commission to evaluate a new legislative proposal on data retention that upholds the principles of purpose limitation, proportionality and necessity. Two years later, Parliament focused its attention on compliance. In its November 2020 resolution, it called on the Commission to initiate infringement proceedings against Member States that had failed to repeal national transposition acts ensuing from the annulled Data Retention Directive. In its resolution of March 2021, Parliament urged the Commission to apply the conclusions of the CJEU case law, including La Quadrature du Net I (joined cases C‑511/18, C‑512/18 and C‑520/18) and Privacy International (case C‑623/17) rulings, to all reviews of adequacy decisions as well as ongoing and future negotiations. In the context of the Pegasus spyware scandal, Parliament set up a committee of inquiry and, in its recommendation of June 2023, derived key standards for spyware surveillance operations from CJEU case law relating to data retention.

Future debates within the European Parliament are likely to reflect the recurring tension between the demand for robust safeguards and strict respect for fundamental rights, on the one hand, and the pressure to respond to the operational needs of law enforcement and judicial authorities in an increasingly digital environment, on the other. Any Commission proposal would be subject to close parliamentary scrutiny, particularly regarding the scope of retained data, the strength of safeguards and remedies, and the overall compatibility of the framework with the EU Charter of Fundamental Rights and CJEU case law.