eco calls for lawmakers to change course
- The requirements are causing financial ruin for small and medium-sized enterprises
- SMEs need financial compensation for the implementation and ongoing costs
- Legislator must define practical rules compliant with EU law
At the latest a year from now, on 1 July 2017, providers are supposed to start collecting data. They will, however, not be in a position to do so. The Association of the Internet Industry, eco, is calling for a change in course. “If changes aren’t made quickly, then the government is facing another fiasco with blanket data retention,” Oliver Süme, eco Director Policy & Law, warns.
The requirements are causing financial ruin for small and medium-sized enterprises
The background is the draft “Catalog of Technical Provisions and Other Measures” recently published by the German Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railway (Bundesnetzagentur). The catalog finally specifies the requirements for blanket data retention, which was decided upon last year. The specifications must be implemented within a year, so by 1 July 2017. However, implementation is technically impossible for many companies, as it required the development of completely new systems. While the planned implementation is theoretically plausible, operators’ network infrastructure is nowhere near technically ready. Also, the manufacturers have already said that they are not currently planning on developing new systems – as it is not sure whether blanket data retention will hold up in the courts this time. “Whether they are willing to do so or not, when in a year the deadline for the implementation of the retention obligation is reached, small and medium-sized internet providers, in particular, will not be able to fulfill the requirements – technically, financially and in terms of manpower. Either the legislator must reduce the requirements for small operators to a realistic level, increase the financial compensation or release small providers from the obligation,” Süme demands.
SMEs need financial support for implementation and ongoing costs
eco already took a stance on the most difficult points directly after the draft was published. The catalog of provisions of the Bundesnetzagentur involves a much higher administrative and staff burden for companies than the industry anticipated. Just in order to put in place the storage infrastructure required, the companies affected by the regulation will need to invest an estimated EUR 600 million.
Financial support for the running costs is not foreseen, even given the extremely high demands made of the operators. While compensation for individual requests is allowed for, the compensation rates defined in Para. 23 of the Judicial Fee and Compensation Law (JVEG) for such requests are far too low. What was apparently not considered at all in the calculation is that, in future, there must always be two members of staff involved in every interaction with the storage software; the four eyes principle. Updating the existing compensation regime to represent the changed demands on the companies affected by the new regulation is therefore a must.
The only allowance for the high cost of implementation is an unfortunately vague hard-case clause. “The government must urgently make improvements, and to finally define more exact and concrete regulations,” Süme urges. Providers with less than 10,000 customers should be automatically considered to be hardship cases. “That way, at least there would be a guarantee that the state will covered the implementation costs for these providers,” Süme recommends.
The currently foreseen regulations in their entirety jeopardize the existence of small and medium-sized enterprises. Süme predicts; “If blanket data retention is not stopped for legal reasons by the German Federal Constitutional Court or the European Court of Justice, then it will fail due to the very real practical challenges in its implementation.”
Legislator must define practical rules compliant with EU law
eco believes that blanket data retention, as decided upon by the governing coalition last year, conforms neither with German Basic Law, nor with European law. In 2010 the previous regulation was found to be unconstitutional by the German Federal Constitutional Court. “The legislator must define practical rules compliant with EU law,” Süme urges.
eco is currently backing the Internet provider SpaceNet AG, which filed a suit on 25 April 2016 Â with the Administrative Court of Cologne against the new blanket data retention regulation.
The aim of the legal proceedings is to trigger a landmark decision through the posing of fundamental legal questions – a decision that ultimately can only be made by the European Court of Justice (ECJ). In 2014, the ECJ already ruled that the unjustified retaining of all communication data without differentiation, restrictions or exceptions is a clear violation of European fundamental rights.
The eco background paper on the lawsuit can be downloaded here.
