Germany

The new federal government is currently planning to introduce a third data retention programme in Germany. The coalition agreement states: “We are introducing a proportionate three-month data retention obligation for IP addresses and port numbers that complies with European and constitutional law.”

Current status: Tense

Even if the application of the provisions of the second data retention from 2015 remains suspended in Germany due to court decisions (the corresponding passage was never removed from the law by the Bundestag), a new edition is expected soon.

History of data retention in Germany

• 2023, Aug 14

  The German Federal Administrative Court confirms the incompatibility of the second German data retention regulation with EU law. The regulation is thus finally invalid.

• 2022, Sep 20

  European Court of Justice declares second German attempt to introduce data retention incompatible with European law.

• 2017, Jun

  The German Federal Network Agency suspends enforcement of data retention following a ruling by the Münster Higher Administrative Court. This de facto suspends data retention until a decision is made in the main proceedings, the progress of which had been decided in Münster. The BGH ultimately referred the basic issue of the proceedings to the ECJ for clarification, meaning that data retention remained suspended until a decision was reached by the ECJ.

• 2015, Dec 17

  The second data retention law enters into force. It obliges telecommunications providers to store: Location data of phone callers and, in the case of mobile internet use, phone numbers, time and duration of all phone calls and SMS, as well as assigned IPs.

• 2010, Mar 02

  The Federal Constitutional Court declares the German regulations on VDS invalid.

• 2007, Nov 09

  The Bundestag passes the first data retention law with the votes of the CDU/CSU and the SPD alone. Data that must be stored for up to seven months, among other things: Phone numbers, IMEIs, IPs and location data of callers and called parties, time stamps of communications as well as email addresses, IPs and time stamps of sent emails. In addition, usernames, IPs and timestamps of mailboxes as well as email addresses, IPs and timestamps of sent mails. In addition, usernames, IPs and timestamps for mailbox retrievals. The inventory data disclosure (name, address, date of birth, start of contract, user name, passwords) is expanded to include all users of permanent connection IDs.

News from Germany