Concerns about fresh EU-level requirements mandating the retention of user information by electronic communications service providers for law enforcement have been raised by the EDRi network and its partners.

Civil society strongly opposes the new rules forcing service provides to retain massive amounts of data

The joint submission responds to a Commission call for evidence regarding an impact assessment (Ares(2025)4081079) and materials developed by the High Level Group on "Access to Data for Effective Law Enforcement". EDRi and its member organisations have filed a formal objection to any new EU legislation that would obligate telecommunications providers to retain traffic and location information from their users in quantities far exceeding what is required for service delivery and billing functions.

The organisations contend that such an obligation would be problematic for three principal reasons:

  • It amounts to mass surveillance that gravely infringes the rights to privacy and data protection, thereby jeopardising other fundamental freedoms including expression, information access, assembly, association, fair trial protections, healthcare access, and social support entitlements
  • The Court of Justice of the European Union has already determined such practices to be incompatible with the EU Charter of Fundamental Rights
  • It introduces unacceptable risks to data security, as the enormous volumes of personal information held for law enforcement purposes remain susceptible to cyberattacks, which occur regularly with severe impacts on affected individuals

EDRi's recommendation is that the Commission should prioritise launching infringement proceedings against Member States whose data retention frameworks breach CJEU precedent. According to recent assessments and data, this would apply to the majority of Member States. Following alignment of all non-compliant national legislation with EU law, the Commission should then undertake a thorough evaluation of impacts, particularly regarding fundamental rights compliance, before considering any EU-level instrument to address remaining gaps.

The submission additionally emphasises that no scientific evidence establishes a causal relationship between indiscriminate data retention and reductions in crime rates or crime resolution. The organisations also identify six substantive deficiencies in the current impact assessment process that require attention.

Source: EDRi (European Digital Rights)