Overview of national data retention policies
Please update this table by entering information on data retention in your country:
Data retention transposition schedule
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
(EU directive) |
- |
6-24 months |
directive, 15 March 2006 |
Directive's requirements:
|
Directive's requirements:
|
Directive's requirements:
|
Directive's requirements:
|
Directive's requirements:
|
- |
providers of publicly available electronic communications services or of a public communications network |
competent national authorities in specific cases for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law |
yes, action brought by Ireland |
|
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Austria | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Belgium |
- |
none as yet |
|||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Bulgaria |
yes |
? |
|||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Cyprus | yes | 6 months | |||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Czech Republic | yes | 12 months |
Act on Electronic Communications No. 127/2005 Coll. as amended by law 247/2008 Coll. |
1. pre-paid phone card identificator 2. public phone box identification (number and geographic position data) |
1. IP adresses of terminals from which were sent SMS (service od sending SMS from web form, quite widespread service in the Czech Rep.) 2. every link between MSISDN and IMEI used together in the network 3. ID of recharging coupon and its link to mobile phone number (at anonymous SIMs) 4. "additional information" not more specified. |
1. amount of data transferred 2. use of secured communication 3. identificator of user´s device
|
1. status of event (e.g.fail/success, usual/unusual termination of connection) 2. amount of uploaded/downloaded data 3. "identificators of interest" (except IP adress is named as example port number) 4. method and status requests for service 5. URI identificators and its parametres requirements
|
1. transport protocol 2. amounf of data trasferred |
Providers of public communication network or of publicly accessible services of electronic communications |
Police, public prosecutors and courts in penal proceedings. Provisions in Police Act enable to resend the data to Interpol, SIS and Europol or foreign policies in case of "serious danger". Similar vague backdoor for tranfer of rateined data to intelligence services are in current and also in proposed new Police Act.
|
In preparation. |
Iuridicum Remedium (IuRe) | |
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Denmark |
yes |
12 months |
|||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Estonia |
yes |
12 months |
|||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Finland | yes | ||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
France | yes | 12 months | |||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
'Who is authorised to access retained data and for what purposes?' |
Legal challenges pending? |
Competent NGO |
Germany |
yes |
6 months |
statute, 1 January 2008 |
- |
- |
user IP address upon every checking of the mailbox and every sending or receiving of e-mail |
- |
- |
anonymization services are obliged to retain logs on when they replaced which data by which |
providers of publicly accessible telecommunications services for end users |
|
yes, several complaints with the Federal Constitutional Court |
Working Group on Data Retention (AK Vorrat) |
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Greece | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Hungary | yes | yes, Constitutional Court challengebrought by theHungarian Civil Liberties Union (HCLU) |
Hungarian Civil Liberties Union (HCLU) | ||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Ireland |
No. Irish government has issued draft transposing measure only. Criticism of draft here.
|
3 years. |
Secret ministerial direction of April 2002 and Criminal Justice (Terrorist Offences) Act 2005 |
All "traffic data" and "location data" within the meaning of Directive 2002/58/EC. |
All "traffic data" and "location data" within the meaning of Directive 2002/58/EC. |
The 2005 Act does not expressly apply to email. However the language used may be wide enough to include it also - if e.g. a mobile phone operator provided an email gateway. |
The 2005 Act does not expressly apply to internet access. However the language used may be wide enough to include it also - e.g. in relation to WAP or GPRS internet access from a mobile phone. | The 2005 Act does not expressly apply to VOIP. However the language used may be wide enough to include it also - if e.g. a mobile phone operator provided a VOIP client | N/A |
|
Section 64. The police may access for "(a) the prevention, detection, investigation or prosecution of crime (including but not limited to terrorist offences), or (b) the safeguarding of the security of the State." The army may access for "the safeguarding of the security of the State". Otherwise the information may be accessed: (a) at the request and with the consent of the person to whom the data relate, (c) in accordance with a court order, |
yes, High Courtchallenge brought by DRI |
See background on Irish law here. |
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Italy | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Latvia | yes | 18 months | |||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Lithuania | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Luxemburg | partial | 6 months | |||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Malta | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Netherlands | No. Legislation pending in Senate as of 12 July 2008. |
12 months proposed. |
location data during phone call. |
||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Poland | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Portugal | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Romania | |||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Slovenia | yes | ||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Slovakia | yes | 24 months, 6 months for Internet services | |||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Spain |
yes |
12 months |
|||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Sweden |
|||||||||||||
Member State |
EU directive transposed? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
United Kingdom |
partial |
12 months |
|||||||||||
Non-EU- State |
Data retention implemented ? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Brazil |
|||||||||||||
Non-EU- State |
Data retention implemented ? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
Switzerland |
|||||||||||||
Non-EU-State |
Data retention implemented ? |
Data Retention Period |
Legal instruments and date of entry into force |
Data to be retained beyond the directive's requirements: fixed line telephony |
Data to be retained beyond the directive's requirements: mobile telephony |
Data to be retained beyond the directive's requirements: E-Mail |
Data to be retained beyond the directive's requirements: Internet access |
Data to be retained beyond the directive's requirements: Internet telephony |
Data to be retained beyond the directive's requirements: other |
Who is compelled to retain data? |
Who is authorised to access retained data and for what purposes? |
Legal challenges pending? |
Competent NGO |
... |
Please update this table by entering information on data retention in your country: