Legitimacy of renewed EU legislative intervention

While anecdotal evidence is often criticised for lacking representativeness, robust quantitative evidence demonstrating the effectiveness of data retention regimes remains limited, if not absent altogether. This evidentiary gap is often invoked to challenge the necessity or proportionality of data retention rules and to support calls for more stringent transparency and reporting obligations.

Already in 2005, a broad range of stakeholders, including civil society organisations and regulators, challenged the necessity of the past Data Retention Directive, pointing to a lack of supporting evidence. In its 2011 Member State consultation on the envisaged revision of the former Data Retention Directive, the Commission acknowledged a continued perception that there was limited evidence of the value of data retention for law enforcement and public security purposes by itself, or in comparison with alternative investigative methods.

More recently, a 2020 study for the European Commission concluded that law enforcement respondents 'were unable to provide precise and reliable statistics on the number of cases for which non-content data were determinative evidence during investigations and prosecutions', although qualitative interviews suggested an indirect value of data retention in some cases.

A first academic study published in 2026 examined the impact of data retention on crime prevention across 11 Member States over 2000-2019. It reports a lagged but significant reduction in aggregate crime rates after the introduction of a retention scheme, with effects appearing only after at least one year and strengthening over time. However, the crime-reducing effect of data retention schemes appears to be caused by deterrence (perception of surveillance) rather than incapacitation (arrests and prosecution).

In a similar vein, CJEU and European Court of Human Rights (ECtHR) case law do not so far refer to quantitative evidence but recognise that proportionate data retention may be necessary for effective law enforcement. In Škoberne v Slovenia (2024), the ECtHR explicitly stated 'Although this point has not been demonstrated by any empirical data, the Court has no doubt that the tracing of telecommunications traffic … could be of considerable importance for effective law enforcement and effective public security measures'.

Additionally, civil society organisations and academics have repeatedly suggested that the preservation of and access to commercially retained data (through 'expedited retention orders' or 'quick freeze') would offer a more privacy-preserving alternative, thereby calling into question the necessity of indiscriminate data retention. Most Member States permit such re-use of commercially retained data and some Member States have used it as a stop-gap measure in the absence of a broader data retention scheme. However, Member States and their authorities maintain that divergences in the scope of quick freeze powers and in the duration and categories of commercially processed data,¹ limit the effectiveness of this law enforcement tool. Nevertheless, several Member States expressed interest in maintaining the possibility of accessing metadata that providers already store should a new framework be adopted. Besides quick freeze, alternatives to data retention, such as login traps, are being discussed.

Excluding data retention for national security from EU law

Member States have signalled that, in contrast to the current situation under EU data protection and privacy laws, they would prefer to exempt all national data retention measures adopted for national security purposes from the scope of EU law. To advance towards this outcome, Member States might suggest excluding data retention for national security purposes from the scope of any future data retention framework, the existing e-Privacy Directive, and other applicable secondary laws, such as EU data protection rules. This would reduce the cases in which Member States are 'implementing Union law' within the meaning of Article 51(1) of the Charter, and thereby narrow the scope of the data retention scenarios to which the Charter applies.

Nevertheless, this does not imply that data retention measures would fall entirely outside the scope of supranational judicial review. Data retention for national security purposes may still be subject to control by the European Court of Human Rights. Additionally, the CJEU has shown a clear willingness to defend the reach of fundamental rights and may do so incidentally when assessing whether national data retention measures unduly restrict treaty provision. In line with Mayer, Schlikker, Bäcker/Moini, and Boehm/Cole, the CJEU may consider that national mass surveillance programmes and data retention schemes interfere with the EU's fundamental freedoms and, by extension,² the Member States would have to comply with EU fundamental rights. Ewer/Thienel oppose this notion.

Given the uncertain effectiveness of this approach in limiting supranational judicial review – the fact that similar efforts presented a major sticking point in the negotiations on the now withdrawn e-Privacy Regulation proposal, and the likelihood of strong opposition from civil society organisations – the costs, benefits, and design of this approach would require careful consideration. Critics may argue that excluding national security-related data retention from the scope of EU secondary law risks diminishing opportunities for supranational oversight and judicial review, raising concerns over accountability, transparency and the risk of disproportionate surveillance.

Operationalising the CJEU's system of graduated objectives and safeguards for retaining traffic and location data

The CJEU has ruled that legislative and administrative measures may require the retention of traffic and location data that can reveal sensitive information only to combat serious crime, or pursue certain objectives of equal or greater importance, and only where proportionate safeguards are guaranteed. Traffic and location data can be retained indiscriminately for safeguarding national security. By contrast, measures requiring the retention of traffic and location data to combat serious crime must ensure, on the basis of objective and non-discriminatory criteria, that only strictly necessary and relevant data is retained. The Court found that this could be achieved by targeting the retention of data through temporal, personal, geographical or other distinctive limitation criteria. In line with the principle of proportionality, traffic and location data retained for combating serious crime can also be used to pursue objectives of greater importance such as safeguarding national security. Each tier must include appropriate safeguards, with the level of protection varying by objective and intrusiveness (graduated system of safeguards).

Conditions permitting the indiscriminate retention of IP addresses

The La Quadrature du Net II (LQDN II) judgment (case C-470/21) has prompted a debate over whether and under which circumstances the retention of source IP addresses can be considered as a non-serious interference permitting their general retention for detecting and prosecuting ordinary crime.³ In prior case law, the CJEU had determined that retaining IP addresses generally constitutes a serious interference if combining such data with other contextually available information could reveal sensitive private life details. On that basis, retention of IP addresses was considered justifiable only for combating serious threats or for certain objectives of equal or greater importance (e.g. safeguarding national security). However, the subsequent LQDN II judgment confirmed that cases exist where retention arrangements rule out sensitive private life insights, rendering IP addresses generally retainable for identifying and prosecuting copyright infringements. This would require that Member States prescribe specific legal, organisational, and technical measures, including the watertight separation of the different categories of data retained.⁴

The design of any future EU data retention framework would depend on whether LQDN II and earlier judgments are read as broadly permitting the indiscriminate retention of source IP addresses. Some classify the LQDN II judgment as a doctrinal turnaround, while others suggest that it merely nuances previous jurisprudence, and yet others view it as a context-specific judgment limiting its precedential value. M. Maurer and E. Tuchtfeld argue that the CJEU failed to adequately consider the severity of the interference and its necessity in light of less intrusive alternatives, suggesting that the judgment should not serve as a blueprint for a future EU data retention law, or only with careful nuance. M. Rojszczak shares the view that the interference is serious, arguing that the CJEU did not sufficiently consider authorities' potential to combine data and draw inferences and questioning whether TOR⁵ users' IP addresses are truly low-sensitivity data.⁶ By contrast, the Bavarian State Minister of the Interior, for Sport and Integration, Joachim Herrmann, supports the CJEU's proportionality assessment in LQDN II and considers that 'quick freeze' is not a viable alternative. He considers that the threat levels have changed in Europe and that the compulsory retention of IP addresses would be compatible with Union law.

The European Union Agency for Law Enforcement Cooperation (Europol) and Eurojust as well as the high-level group suggest retaining both IP addresses and port numbers. EDRi flags that this may lead to potentially serious interference with the right to privacy. The German government envisages partially storing port numbers at a national level.

Retention periods

According to CJEU case law, the retention period of traffic and location data must be limited in time to what is strictly necessary by clear and precise rules. If justified, the retention period may be extended. Data retention periods vary across Member States and depend on the type of data retained. A controversial example involves Italy, which maintains an expansive regime with a de facto 72-month retention period of traffic data for serious crimes of particular social concern (particolare allarme sociale). Despite disproportionality concerns raised by the Italian Data Protection Authority and some academics for failing to meet the CJEU's requirement of strict necessity, the Italian Court of Cassation has repeatedly held that the measure complies with the principle of proportionality, since the regime 'limits the duration of storage and entrusts the judicial authority with the effective control'.

Member States generally recognise that uniform retention periods across the EU enhance predictability and facilitate cross-border investigations, while reducing the risk that criminals exploit shorter retention periods in certain Member States. Most Member States support retention periods of around one year and, in any event, no less than six months. Some favour longer periods for complex investigations or serious crimes, while others prefer to set only a minimum mandatory period. There is also openness towards establishing an EU framework setting a range of minimum and maximum retention periods, providing flexibility for national needs, 'taking into account the type of data, their relevance to specific crime areas, the technical capabilities of service providers, and the practical needs of law enforcement'.

The Commission's 2020 study suggested that law enforcement authorities most frequently request data that is up to one year old in Member States with mandatory retention regimes, and data three to six months old in those without such regimes. Statistics disaggregated by age of data requested were only available for Estonia and Germany. Despite very different data retention frameworks, the figures indicate that most requests in these countries concern non-content data that are up to six months old (calculated from the moment the data are generated and retained by electronic communications service providers, e.g. when the communication took place, up to the point that the data are requested by law enforcement authorities). Some law enforcement authorities support longer data retention periods for certain crimes, such as cybercrime, child sexual abuse material offences, and fraud, because these crimes are often detected only much later. In its call for evidence, the Commission suggested that 'different legislative solutions might be designed depending on the non-content data to be retained in conjunction with the crime to be pursued'.

The 2011 evaluation of the former Data Retention Directive drew similar conclusions: the Commission signalled it would consider different periods for different categories of data and different categories of serious crimes in possible reform efforts, but these were superseded by the CJEU's invalidation of the directive. At the time, quantitative data from Member States suggested that when law enforcement first requests access, around 90 % of the retained data are six months old or less, and around 70 % are three months old or less.

Conditions and safeguards for accessing retained data

The CJEU has ruled that the subsequent law enforcement authority access to data retained by providers presents a separate interference with fundamental rights from that of the retention itself. Consequently, such access must be subject to specific, access-related safeguards, which vary depending on whether traffic and location data or subscriber data are accessed.

The national framework for accessing non-content data varies among Member States, with a vast majority requiring (prior) judicial review for accessing traffic and location data. Many Member States limit their security authorities' access to traffic and location data held by electronic communications service providers to the purposes of combating serious crime, qualified threats to public security, or ICT-facilitated crimes. By contrast, basic subscriber data can usually be accessed for investigating ordinary crimes.

There is no uniform definition of 'serious crime' across Member States. Instead, they operationalise this threshold through different legal mechanisms, for instance by prescribing minimum custodial sentences and by limiting access to an enumerated catalogue of offences classified as serious. In some cases, the restriction also arises indirectly from the security authority's limited mandate, which covers only specific offences or security threats. The types of subscriber, traffic, and location data retained and accessible to authorities vary across jurisdictions. In Austria, authorities exercising security police functions are exempt from the serious crime threshold for accessing certain traffic and location data in specifically defined cases. Poland does not provide for a serious crime threshold, but suggested it would consider reforms. Other relevant access conditions include the degree of suspicion and proportionality requirements.

In relation to a possible EU intervention, some Member States favour minimum harmonisation of access requirements, while a majority consider that the EU system should include robust access safeguards. Some Member States suggest that an EU data retention framework should not literally codify CJEU case law, because it related to specific factual contexts, but should rather be based on a proportionality assessment in line with the CJEU's general guidelines. The high-level group discussed the need to 'design access rules which differ depending on e.g. the type and seriousness of the crime, the degree of threat posed to the victims by the offence, the purpose of access and the authorities competent to access the data'.

Member States diverge on whether access conditions should borrow from the e-Evidence Regulation and include elements such as standardised request formats, deadlines, and secure communications channels. Several Member States support this approach, whereas others consider that there is no need to introduce standardised formats and communication channels. They argue that these are domestic matters between law enforcement authorities and electronic communications service providers within a single Member State, and that cross-border cooperation is already governed by the e-Evidence Regulation.

Certain forms of quick freeze mechanism raise additional concerns.For instance, the French quick-freeze and access mechanism appears to allow data originally retained on national security grounds to be subject to a targeted preservation order and subsequently accessed for the investigation of (serious) crime.⁴⁰ However the CJEU has ruled that access to retained data can only be accessed for the purposes for which the data were originally retained or for objectives of greater importance. The 2023 report by the French Senate's Committee of Laws highlighted legal uncertainty in this regard. In the same vein, the conditions governing the issuance of quick-freeze orders and subsequent access to the preserved data may become a subject of discussion at the EU level.

Besides this, the high-level group experts supported establishing stronger voluntary cooperation mechanisms between the public and private sector, including through memoranda of understanding and fuller use of existing EU networks such as SIRIUS, the European Judicial Network (EJN) and the European Judicial Cybercrime Network. They also highlighted the need for standardised data retention and transmission formats, as inconsistent application of existing standards and the absence of common formats for internet-based communications service providers increase complexity for law enforcement data analysis. The Commission's data access roadmap and its call for evidence also suggest that it is committed to strengthening cooperation between public authorities and service providers.

Automated analysis of retained data

As more electronic intelligence is made available, authorities increasingly rely on automated analysis to process data efficiently. The Commission even committed to fostering the uptake of AI solutions among Member States' law enforcement solutions in its roadmap.

In its first case on automated analysis in the context of data retention, the CJEU held that a legislative measure empowering authorities to instruct providers to carry out an automated analysis of all retained traffic and location data is permissible only for national security purposes and in compliance with specific safeguards (see below). Against this backdrop, legislators may consider a range of possible approaches in relation to automated analysis, including:

Taking as an example the rationale behind the former Data Retention Directive, the Law Enforcement Directive, and the Passenger Name Record Directive, a case could be made that specific data protection and privacy standards for automated analysis of retained data should be regulated at EU level. Common standards would create a level playing-field for communications services operators, deliver consistent protection for end-users across the EU, and strengthen cross-border law enforcement. Following a rationale similar to that which could underpin a future data retention scheme, data protection rules – depending on their design – could enhance the robustness of analysis outcomes, contribute to meeting admissibility criteria, facilitate cross-border sharing of analysis results by increasing trust in equivalent standards, and simplify the handling of outputs from multiple jurisdictions within a single investigation.

The CJEU clarified necessary conditions and safeguards for certain types of analysis in LQDN I. It ruled that a legislative measure requiring providers to implement measures allowing the automated analysis of all traffic and location data retained is only permissible for national security purposes and insofar as the following conditions are met: (i) the analysis is limited in time; (ii) the competent authority publishes general information about the analysis; (iii) an effective review of the authorising decision is guaranteed; (iv) the pre-established (as opposed to self-learning) models and analysis criteria are specific, reliable, non-discriminatory, not based solely on sensitive data, and subject to regular re-examination; (v) and positive results are reviewed individually by non-automated means. These standards could be further refined based on CJEU's case law on passenger information and supplemented with additional clarification. In particular, a future framework could also address the permissibility and treatment of self-learning algorithms; effective measures to counter indirect discrimination; standards for human review that would avoid risks of human bias and effectively mitigate the base-rate fallacy; and qualified measures for auditing algorithms.

Extending data retention rules to internet-based communications service providers

The high-level group, certain Member States, and the EU Counter-Terrorism Coordinator favour extending data retention rules to additional services, including internet-based communications services providers (OTT), given their central role in providing electronic communications. This would level the playing field among traditional and modern communications service providers. Given that some OTT providers do not collect non-content data voluntarily and are not obliged to do so under national law, it would ensure the availability of non-content data necessary for effective law enforcement. Some Member States noted that the potential impact of such an extension on OTT business models, as well as the associated costs, should be taken into consideration. Telecom and online-service providers warn that general long-term obligations on data retention would be costly and that a new regulation should provide for a cost compensation mechanism.

The high-level group experts suggest obliging electronic communications service providers to supply data in an intelligible format. In its written input to the group, EDRi highlights that some communication services (such as Signal) apply concepts such as 'sealed sender' that render it technically impossible to retain metadata as would be obliged under a potential framework. This would be comparable to a backdoor requirement that allows access, bypassing normal security controls.⁴¹ Here the tension between decryption for law enforcement purposes and general communication privacy and security resurfaces.