A court in The Hague has suspended the Dutch legislation requiring the retention by communication providers of customer data for eventual law enforcement purposes. The judge found that the law violates personal privacy and personal data protection rights and also goes beyond what's necessary for its purposes of fighting serious crime. This is in line with a ruling in April 2014 by the EU Court of Justice that struck down the EU data retention directive on which the Dutch law is based.
The request for an injunction against the law was filed by the groups Privacy First, the Dutch association of human rights lawyers, the association of defense lawyers, the journalists union NVJ and the telecom providers BIT, SpeakUp and Voys Telecom. They started the suit after the Dutch government said it plans to maintain the data retention requirement in an adapted form, despite the EU court ruling. The Council of State and privacy regulator CBP earlier advised against maintaining the current legislation.
It was unclear what impact the ruling would have on the already collected data. The Justice and Security Ministry said it regretted the ruling and is considering an appeal. However, it noted positive elements in the decision, as the judge said that data retention was necessary and effective and served a legitimate purpose. Furthermore, certain forms of criminality could only be countered with the use of historical telecommunications information.
The government is working on new legislation to continue with data retention requirements. A consultation was held on the proposed law last year, and the ministry said it hopes that parliament will pass the amended legislation quickly.
The providers Vodafone, BIT and Tweak said they would stop immediately collecting customer data as a result of the ruling. KPN also said it would respect the ruling and stop collecting data, including at its subsidiaries Telfort, XS4All and Hi.
In addition, KPN plans talks with the government soon on the consequences of the ruling. Vodafone noted that it continues to collect and store some traffic data legally required for conducting its business, which may still be requested by law enforcement officials. The company called for clarity in the law in terms of operator requirements, as well as transparency over the government's powers and how they are used.
