In April of this year, the Court of Justice of the European Union ruled that the data retention directive is invalid. That alone doesn’t invalidate the Dutch implementation directly. The Dutch governments response can be summarized as “Let’s keep data retention mostly unchanged.” Here’s an update.

On 18 November, the Dutch government finally issued its response to the Court of Justice of the European Union (CJEU) ruling. Despite all the debate about the legality of data retention practices, the government wants to retain its current data retention legislation. The Ministry of Security and Justice wrote a letter to the Parliament saying the CJEU’s judgements doesn’t affect the Dutch law on data retention directly.

Small remedies, ignoring the fundamental problems

The government wants to remedy the problems that the ruling creates for the Dutch law by making a few cosmetic changes to the national legislation. A request for data now would need to be approved by a judge, while until now the approval of the public prosecutor was sufficient. In addition to that, a request for data older than six months may only be made for “the most serious category of offenses with very long prison sentences”. The retention periods, twelve months for phone-related data, six months for internet-related data, are to be kept unchanged.

No longer innocent until proven guilty

The Dutch government’s response to the CJEU’s decision to invalidate the data retention directive is shocking. “The retention of specific data regarding all citizens is necessary, because during retention we cannot differentiate beforehand between suspects and non-suspects,” writes Ivo Opstelten, the Dutch Minister of Security and Justice, in his response. “We will retain data about everybody because we cannot predict who might later turn out to be a bad guy.”

The comments of Mr Opstelten, as well as Dutch government’s position on data retention go against one of the basic principles of our rule of law: You are innocent until proven guilty. Everyone has the right to privacy, and only when there is a targeted and concrete suspicion of an unlawful act, can the government suspend this right temporarily, with strict safeguards.

Government to be taken to court

On 1 December, the Dutch EDRi-member Bits of Freedom heated up the public debate by showing the Dutch law may not be executed by the government, nor by providers. The Dutch Constitution stipulates that a law which violates international treaties, such as the EU Charter of fundamental rights, is invalid. The government was quick to respond by saying it would nevertheless enforce this law. A group of organizations, among them internet provider BIT, is taking the government to court, demanding suspension of the enforcement.