14 ms·

Germany: Data retention to be abolished

270 points by seesawtron 5y ago

Goety 5y ago
The new center of the world
adolph 5y ago
It is unclear to me if this means that ISPs cannot retain data, or a revocation of the law requiring ISPs to retain data.
- onli 5y ago
  That should be pretty much the same thing. The moment the illegal data retention law gets disabled the ISPs have no right to collect and retain that data anymore.
  - realityking 5y ago
    That’s not true. It’s perfectly reasonable to keep some operational logs for debugging purposes for a few hours or even days.
    - onli 5y ago
      It's illegal to keep personal data of users without either legitimate interest or a direct agreement, that's completely clear under the DSGVO. If the operational logs are needed to fulfill the contract with the user then sure, the provider can keep them (for as short as possible), otherwise not. Days? I highly doubt it. The Vorratsdatenspeicherung counteracted that principle, if it falls away storing this data gets really complicated.
      - Jensson 5y ago
        Keeping server logs for a few days is considered necessary for running servers. Therefore you accessing a server means you implicitly give them the right to store your access request for a few days, because it is unreasonable to assume they would run a server without access logs. Edit: For example, you can't assume people will work on weekends. So if an issue occurs on a weekend and someone needs to look at it, then the log need to at least last throughout the weekend.
        adambatkin 5y ago
        And if it is May 29 and you notice an attacker has been lurking in your network for at least 2 weeks (but you don't yet know exactly when it started or how they got in) you will be very happy that you have netflow and access logs going back 30 or 60 days or a year. And that's considered an operational requirement for anyone who cares about the safety and security of their systems and networks.
        hodgesrm 5y ago
        We store certain audit logs forever--or close to it--for exactly this reason. You don't know when you'll need the data to assess possible breaches and report back to users. (Which not coincidentally is a requirement of GDPR.) Edit: clarified "forever"
      - adolph 5y ago
        Is DSVGO the same as GDPR? Why wouldnt ISPs bake personal agreement into the TOS like every other cookie clickthru? (Even if they don’t plan to retain it, better to get permission in case unintended retention occurs or business needs change.) https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
        onli 5y ago
        > Is DSVGO the same as GDPR? Yes, just the german name :) > Why wouldnt ISPs bake personal agreement into the TOS like every other cookie clickthru? Personal agreement baked into a TOS is illegal. It has to be declinable and the service be offered regardless. Those cookie clickthroughs are getting those publishers sued now, see https://www.huntonprivacyblog.com/2019/10/03/cjeu-reaches-decision-in-case-involving-cookie-consent-under-eu-data-protection-law/ https://www.huntonprivacyblog.com/2019/10/03/cjeu-reaches-de... for an example. > better to get permission in case unintended retention occurs or business needs change. Which exactly is why this is not allowed. You can't just collect data just in case. Or you can of course, until you get caught and fined.
  - adolph 5y ago
    Is there some other law requiring no data retention? It doesn’t logically follow that the revocation of a data retention law means that an ISP can’t still retain data.
    - onli 5y ago
      Yes, this all follows from the DSGVO/GDPR and - depending where you are - their local implementations. When data means personal data, which includes IPs and certainly things like websites one visits, connection metadata an ISP would collect.
- pmontra 5y ago
  From what I read it seems that they have to stop logging. They can start logging only after they got a request from whoever is allowed to issue such requests in Germany.
- realityking 5y ago
  The latter. An ISP - within the guard rails set by GDPR and other privacy laws - can store customer data for their own purposes. But the government won’t require them to do so.
lgrapenthin 5y ago
Since June, the German government allows even police to secretly spy on Germans "preventively", i. e. without suspicion or proof of crime or future crime and without decision by court of law, by installing trojans on their phones and PCs, i. e. through the app store. "Your right to privacy is being respected in Germany!" - This is not true.
- 3np 5y ago
  Not that I doubt you, but do you have a source?
  - St_Alfonzo 5y ago
    Maybe I mixed up something and this is the wrong law: The "Gesetz zur Modernisierung der Rechtsgrundlagen der Bundespolizei" was accepted by the Bundestag, but finally the Bundesrat did not agree. https://dip.bundestag.de/vorgang/gesetz-zur-modernisierung-der-rechtsgrundlagen-der-bundespolizei/273527 https://dip.bundestag.de/vorgang/gesetz-zur-modernisierung-d...
- ashtonkem 5y ago
  The German government is pretty good at putting on a face of respectability and proper process, while also doing bad things. I'm reminded of the fact that the state began a criminal investigation of FT after they reported on Wirecard's fraud on the insistence of Wirecard itself.
  - drited 5y ago
    Yep all while people working for the financial regulator Bafin traded Wirecard stock in their personal accounts.
  - y4mi 5y ago
    Germany has a massive corruption problem on the higher levels. It's not as visible for outsiders, because nations with corruption issues usually also have police and office workers essentially doing shakedowns to do their jobs, and that's not really a thing in Germany. What is quiet widespread is politicians and office worker enriching themselves either directly from budgets theyre responsible for or by doing things for corporations which pay them handsomely.
johnnycerberus 5y ago
I totally support this. It still amazes me that companies still do not delete/anonymize user accounts after periods of inactivity. Everything that is linked to your email address should be purged after 3-12 months of inactivity, including ecommerce like Amazon, game platforms like Steam, cloud storages like Dropbox, or even Hackernews. Good luck trying to find old accounts that you have used years ago, what if they were breached and now they are used by people with bad intentions. In my country (Romania), even barber shops that store user accounts for longer periods than necessary are fined the shit out of them for not closing accounts due to inactivity. Some years ago, I woke up with an inactive G2A account telling me that I have to pay a fee for inactivity. NO! I don't have to pay anything, purge it!
- akersten 5y ago
  > Everything that is linked to your email address should be purged after 3-12 months of inactivity, including That is such a horrible idea, I go on vacations longer than that. My Dropbox should be deleted if I don't log in for 4 months?
  - johnnycerberus 5y ago
    Do you have a paid account or a free account? If I store my documents on a free account for a one time send to the university application and then I forget about it, then Dropbox should purge it after a time to protect my data, as I don't have any "contract" with them like a subscription or something. The same for G2A, I have bought from them some game keys at a cheap price sometime ago and then I totally forgot that I have one, I couldn't even find the activation mail in my inbox, lol. One day in the summer I woke up with a mail that I have to pay an inactivity fee even if I'm just a row in their database and I have no contractual obligation with them.
    - fiddlerwoaroof 5y ago
      I had a family member go through a major life event that left his OneDrive account unused for about a year. When we needed to access tax documents on it, Microsoft had deleted it. I’m strongly against non-user initiated account deletion.
pmontra 5y ago
I'm glad about this decision. Anyway removing all personal data from logging will be a huge project in large organizations. I'm thinking about IP addresses [1] which are often used to aggregate requests, debug, etc. Wireshark could become a hot tool to handle. I didn't spend much time to think about it so I might be totally wrong but anonymizing IP addresses is probably not easy unless we give up aggregation. I think that anything that uniquely maps IP addresses also becomes personal data, e.g. cookies. [1] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
- notimetorelax 5y ago
  Wireshark is very much a hot tool to handle already. To be in compliance with GDPR all the traces have to be dropped within the data removal grace period.
cblconfederate 5y ago
except for tax reasons. then you have to keep track of every penny for a thousand years.
amelius 5y ago
Are Messenger/WhatsApp messages also telecommunications data?
nkmnz 5y ago
This is about ISPs (no one else) that currently have to store a lot of data way longer than necessary to serve the customer or for technical reasons, so that law enforcement can „travel back in time“ once they have a judicial order. It‘s like putting a GPS into anyones pocket so that the government can always trace your whereabouts. In the future, storing that data will already require a judge to be involved, preventing mass surveillance (or at least, makes it a little bit harder for everyday law enforcement to access the surveillance data).
dmitriid 5y ago
Also, quite relevant for data processing and consent: German DSK issues cookie guidance with strict requirements for cookie banners, consent and using US-based providers, https://twitter.com/OdiaKagan/status/1473725634102939650 https://twitter.com/OdiaKagan/status/1473725634102939650 Germans are quite pissed about their privacy, and for good reason. I also like that they are taking matters into their hands.
usrbinbash 5y ago
And what can we learn from this story? Middle-Left coalitions are actually a pretty good idea.
- iqanq 5y ago
  As if data retention was the only thing the government had to decide on...
  - johnnycerberus 5y ago
    To be fair, data retention is a hot topic right now in Europe, the pandemic and the increased screen time that resulted from it, the amount of accounts we had to create left and right require new regulations.
    - iqanq 5y ago
      I live in Europe and the only hot topic I can think of, apart from the virus, is energy prices. The same energy prices the center-left wants to increase via CO2 taxes.
      - ChuckNorris89 5y ago
        >I live in Europe and the only hot topic I can think of, apart from the virus, is energy prices. And real estate prices. Don't forget the insane real estate market.
        iqanq 5y ago
        Ah indeed. But that bubble has been in the making for 10+ years. It's not a topic of conversation because we are all used to it.
      - chmod775 5y ago
        > The same energy prices the center-left wants to increase via CO2 taxes. The alternative is worse. Fire is hot. Water is wet.
mytailorisrich 5y ago
Key seems to be "without any reason". An example: here in the UK the limit on taking legal action on most civil issues is 6 years. This means it is perfectly reasonable to have a 6 year retention policy and indeed that's what most companies do.

270 points by seesawtron 5y ago

The new center of the world

It is unclear to me if this means that ISPs cannot retain data, or a revocation of the law requiring ISPs to retain data.

onli 5y ago
That should be pretty much the same thing. The moment the illegal data retention law gets disabled the ISPs have no right to collect and retain that data anymore.
- realityking 5y ago
  That’s not true. It’s perfectly reasonable to keep some operational logs for debugging purposes for a few hours or even days.
  - onli 5y ago
    It's illegal to keep personal data of users without either legitimate interest or a direct agreement, that's completely clear under the DSGVO. If the operational logs are needed to fulfill the contract with the user then sure, the provider can keep them (for as short as possible), otherwise not. Days? I highly doubt it. The Vorratsdatenspeicherung counteracted that principle, if it falls away storing this data gets really complicated.
    - Jensson 5y ago
      Keeping server logs for a few days is considered necessary for running servers. Therefore you accessing a server means you implicitly give them the right to store your access request for a few days, because it is unreasonable to assume they would run a server without access logs. Edit: For example, you can't assume people will work on weekends. So if an issue occurs on a weekend and someone needs to look at it, then the log need to at least last throughout the weekend.
      - adambatkin 5y ago
        And if it is May 29 and you notice an attacker has been lurking in your network for at least 2 weeks (but you don't yet know exactly when it started or how they got in) you will be very happy that you have netflow and access logs going back 30 or 60 days or a year. And that's considered an operational requirement for anyone who cares about the safety and security of their systems and networks.
        hodgesrm 5y ago
        We store certain audit logs forever--or close to it--for exactly this reason. You don't know when you'll need the data to assess possible breaches and report back to users. (Which not coincidentally is a requirement of GDPR.) Edit: clarified "forever"
    - adolph 5y ago
      Is DSVGO the same as GDPR? Why wouldnt ISPs bake personal agreement into the TOS like every other cookie clickthru? (Even if they don’t plan to retain it, better to get permission in case unintended retention occurs or business needs change.) https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
      - onli 5y ago
        > Is DSVGO the same as GDPR? Yes, just the german name :) > Why wouldnt ISPs bake personal agreement into the TOS like every other cookie clickthru? Personal agreement baked into a TOS is illegal. It has to be declinable and the service be offered regardless. Those cookie clickthroughs are getting those publishers sued now, see https://www.huntonprivacyblog.com/2019/10/03/cjeu-reaches-decision-in-case-involving-cookie-consent-under-eu-data-protection-law/ https://www.huntonprivacyblog.com/2019/10/03/cjeu-reaches-de... for an example. > better to get permission in case unintended retention occurs or business needs change. Which exactly is why this is not allowed. You can't just collect data just in case. Or you can of course, until you get caught and fined.
- adolph 5y ago
  Is there some other law requiring no data retention? It doesn’t logically follow that the revocation of a data retention law means that an ISP can’t still retain data.
  - onli 5y ago
    Yes, this all follows from the DSGVO/GDPR and - depending where you are - their local implementations. When data means personal data, which includes IPs and certainly things like websites one visits, connection metadata an ISP would collect.
pmontra 5y ago
From what I read it seems that they have to stop logging. They can start logging only after they got a request from whoever is allowed to issue such requests in Germany.
realityking 5y ago
The latter. An ISP - within the guard rails set by GDPR and other privacy laws - can store customer data for their own purposes. But the government won’t require them to do so.

lgrapenthin 5y ago

Since June, the German government allows even police to secretly spy on Germans "preventively", i. e. without suspicion or proof of crime or future crime and without decision by court of law, by installing trojans on their phones and PCs, i. e. through the app store. "Your right to privacy is being respected in Germany!" - This is not true.

3np 5y ago
Not that I doubt you, but do you have a source?
- St_Alfonzo 5y ago
  Maybe I mixed up something and this is the wrong law: The "Gesetz zur Modernisierung der Rechtsgrundlagen der Bundespolizei" was accepted by the Bundestag, but finally the Bundesrat did not agree. https://dip.bundestag.de/vorgang/gesetz-zur-modernisierung-der-rechtsgrundlagen-der-bundespolizei/273527 https://dip.bundestag.de/vorgang/gesetz-zur-modernisierung-d...
ashtonkem 5y ago
The German government is pretty good at putting on a face of respectability and proper process, while also doing bad things. I'm reminded of the fact that the state began a criminal investigation of FT after they reported on Wirecard's fraud on the insistence of Wirecard itself.
- drited 5y ago
  Yep all while people working for the financial regulator Bafin traded Wirecard stock in their personal accounts.
- y4mi 5y ago
  Germany has a massive corruption problem on the higher levels. It's not as visible for outsiders, because nations with corruption issues usually also have police and office workers essentially doing shakedowns to do their jobs, and that's not really a thing in Germany. What is quiet widespread is politicians and office worker enriching themselves either directly from budgets theyre responsible for or by doing things for corporations which pay them handsomely.

johnnycerberus 5y ago

I totally support this. It still amazes me that companies still do not delete/anonymize user accounts after periods of inactivity. Everything that is linked to your email address should be purged after 3-12 months of inactivity, including ecommerce like Amazon, game platforms like Steam, cloud storages like Dropbox, or even Hackernews. Good luck trying to find old accounts that you have used years ago, what if they were breached and now they are used by people with bad intentions. In my country (Romania), even barber shops that store user accounts for longer periods than necessary are fined the shit out of them for not closing accounts due to inactivity. Some years ago, I woke up with an inactive G2A account telling me that I have to pay a fee for inactivity. NO! I don't have to pay anything, purge it!

akersten 5y ago
> Everything that is linked to your email address should be purged after 3-12 months of inactivity, including That is such a horrible idea, I go on vacations longer than that. My Dropbox should be deleted if I don't log in for 4 months?
- johnnycerberus 5y ago
  Do you have a paid account or a free account? If I store my documents on a free account for a one time send to the university application and then I forget about it, then Dropbox should purge it after a time to protect my data, as I don't have any "contract" with them like a subscription or something. The same for G2A, I have bought from them some game keys at a cheap price sometime ago and then I totally forgot that I have one, I couldn't even find the activation mail in my inbox, lol. One day in the summer I woke up with a mail that I have to pay an inactivity fee even if I'm just a row in their database and I have no contractual obligation with them.
  - fiddlerwoaroof 5y ago
    I had a family member go through a major life event that left his OneDrive account unused for about a year. When we needed to access tax documents on it, Microsoft had deleted it. I’m strongly against non-user initiated account deletion.

pmontra 5y ago

I'm glad about this decision. Anyway removing all personal data from logging will be a huge project in large organizations. I'm thinking about IP addresses [1] which are often used to aggregate requests, debug, etc. Wireshark could become a hot tool to handle. I didn't spend much time to think about it so I might be totally wrong but anonymizing IP addresses is probably not easy unless we give up aggregation. I think that anything that uniquely maps IP addresses also becomes personal data, e.g. cookies. [1] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...

notimetorelax 5y ago
Wireshark is very much a hot tool to handle already. To be in compliance with GDPR all the traces have to be dropped within the data removal grace period.

cblconfederate 5y ago

except for tax reasons. then you have to keep track of every penny for a thousand years.

amelius 5y ago

Are Messenger/WhatsApp messages also telecommunications data?

nkmnz 5y ago

This is about ISPs (no one else) that currently have to store a lot of data way longer than necessary to serve the customer or for technical reasons, so that law enforcement can „travel back in time“ once they have a judicial order. It‘s like putting a GPS into anyones pocket so that the government can always trace your whereabouts. In the future, storing that data will already require a judge to be involved, preventing mass surveillance (or at least, makes it a little bit harder for everyday law enforcement to access the surveillance data).

dmitriid 5y ago

Also, quite relevant for data processing and consent: German DSK issues cookie guidance with strict requirements for cookie banners, consent and using US-based providers, https://twitter.com/OdiaKagan/status/1473725634102939650 https://twitter.com/OdiaKagan/status/1473725634102939650 Germans are quite pissed about their privacy, and for good reason. I also like that they are taking matters into their hands.

usrbinbash 5y ago

And what can we learn from this story? Middle-Left coalitions are actually a pretty good idea.

iqanq 5y ago
As if data retention was the only thing the government had to decide on...
- johnnycerberus 5y ago
  To be fair, data retention is a hot topic right now in Europe, the pandemic and the increased screen time that resulted from it, the amount of accounts we had to create left and right require new regulations.
  - iqanq 5y ago
    I live in Europe and the only hot topic I can think of, apart from the virus, is energy prices. The same energy prices the center-left wants to increase via CO2 taxes.
    - ChuckNorris89 5y ago
      >I live in Europe and the only hot topic I can think of, apart from the virus, is energy prices. And real estate prices. Don't forget the insane real estate market.
      - iqanq 5y ago
        Ah indeed. But that bubble has been in the making for 10+ years. It's not a topic of conversation because we are all used to it.
    - chmod775 5y ago
      > The same energy prices the center-left wants to increase via CO2 taxes. The alternative is worse. Fire is hot. Water is wet.

mytailorisrich 5y ago

Key seems to be "without any reason". An example: here in the UK the limit on taking legal action on most civil issues is 6 years. This means it is perfectly reasonable to have a 6 year retention policy and indeed that's what most companies do.