Evaluierung Richtlinie

Die Europäische Kommission hat u.a. den AK Vorrat gebeten, einige Fragen zu beantworten, und zwar bis zum 13.11.2009.

Hier der Entwurf der Antworten:

Questionnaire with a view to take stock of the operation of on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC v 30 09 2009

Introduction

- Scope of the questionnaire

This questionnaire seeks to gather information about all relevant aspects of the operation of the Data Retention Directive that will allow the Commission to understand its practical functioning in a manner that is as complete as possible. On that basis in particular, the Commission will draft the evaluation report mentioned in Article 14 of the Directive, which is due for 15 September 2010.

The questionnaire addresses each of the four groups of stakeholders concerned by the application of the Data Retention Directive (hereafter referred to as DRD or Directive): Member States, the private sector, Data Protection Authorities and the European Parliament, and contains a chapter for each of these stakeholders (see below under “stakeholders concerned” for more details).

Moreover, the Commission wants to use chapter 1 of the questionnaire as guideline for the discussions that it intends to organise with Member States and non-EU EEA States individually between the end of September and the end of November according to a time table to be agreed upon in the meeting of 10 September 2009.

The first group of questions aims at providing the European Commission with feedback necessary to assist it in the evaluation of the Directive further to its article 14.

Article 14 DRD states:

1. No later than 15 September 2010, the Commission shall submit to the European Parliament and the Council an evaluation of the application of this Directive and its impact on economic operators and consumers, taking into account further developments in electronic communications technology and the statistics provided to the Commission pursuant to Article 10 with a view to determining whether it is necessary to amend the provisions of this Directive, in particular with regard to the list of data in Article 5 and the periods of retention provided for in Article 6. The results of the evaluation shall be made public.

2. To that end, the Commission shall examine all observations communicated to it by the Member States or by the Working Party established under Article 29 of Directive 95/46/EC.

Pursuant to Article 10 DRD, Member States are obliged to ensure they provide the Commission on an annual basis with statistics on the retention of data. The data collection template was developed by the Experts' Group on Data Retention and was presented to Member States at their meeting of 22 January 2009 in Brussels.

The input required to conduct the evaluation draws from multiple sources: the statistics provided under Article 10 DRD, the assessment of technological progress and of the market impact, but also on law enforcement specific information to establish whether the list of data mentioned in Article 5 and the length of the retention period in Article 6 are adequate and sufficient,

The second set of questions aims at obtaining feedback to carry out the analysis that was requested by the JHA Council at its meeting of 27 and 28 November 2008. In its Conclusions (see annex) the Council asked the Commission to evaluate the effectiveness of existing (non-) legislative measures or technical solutions to ensure traceability of users of communications services, in particular mobile phones with prepaid SIM cards. The Member States undertook to “supply, at the request of the Commission, all relevant information on legislative and non-legislative measures or technical solutions implemented to identify users of communications media, and their degree of operational effectiveness”. This questionnaire contains the specific requests from the Commission to obtain the relevant information.

The evaluation will therefore consist of two strands, namely, the assessment of

- the degree to which the Data Retention Directive is fit for purpose, i.e. to establish the extent to which the harmonisation of obligations on information service providers (hereafter referred to as ISPs) is able to ensure that data are available for the purpose of the investigation, detection and prosecution of serious crime, and

- the degree of effectiveness of national measures to trace the identity of users to combat the criminal misuse and anonymous use of electronic communications.

- Stakeholders concerned

The stakeholders that are concerned by these two sets of questions are the following

1. EU Member States and EEA States and in particular (). law enforcement authorities (Ministries of Interior, and of Justice) and (b). telecommunication authorities (Ministry of Telecommunication, National Regulatory Authorities) (concerning chapter 1 of the questionnaire)
2. European Parliament and Civil Society (concerning chapter 2 of the questionnaire)
3. National data protection authorities and the European Data Protection Supervisor (EDPS) (concerning chapter 3 of the questionnaire)
4. Private sector (communications service providers, comprising internet service providers, fixed and mobile telecommunication operators, network and cable operators, etc) (concerning chapter 4 of the questionnaire)

- Preparation of the questionnaire

The questionnaire was prepared by DG JLS and DG INFSO in particular on the basis of input received from the conference "Towards the Evaluation of the Data Retention Directive" of 14 May 2009. It was discussed for the first time by the Subgroup "Evaluation" of the Experts' Group on Data Retention on 9 September 2009 and presented to Member State representatives on 10 September 2009 in a meeting in the Secure Zone of DG JLS in Brussels. The Commission invited comments from the representatives to that meeting by 17 September 2009 with the drafting of the final questionnaire thereafter.

The current version takes account of the comments from (in alphabetical order:) Austria, the Czech Republic, Estonia, Finland, France, Germany, Greece, Hungary, Latvia, Romania, Spain, Sweden, the United Kingdom, France.

The Subgroup “Evaluation” is composed in the same stakeholder groups as the Experts’ Group on Data Retention. It has 2-3 representatives of Member States, Industry, Data Protection and the European Parliament.

The questionnaire will be the backbone of the evaluation process.

- Content of the questionnaire

The questionnaire consists of two types of questions: qualitative questions that examine the modalities of and conditions under which the Directive operates, and quantitative questions to gauge data volumes, financial, technological and legal impacts, and ratios between different aspects.

The Subgroup “Evaluation” was of the opinion that replying to the qualitative questions would require less time than providing quantitative data.

In the questionnaire indicates all questions that require a quantitative reply as follows: “[Quantitative Reply]”. The other questions are qualitative questions by default.

- Time table for replying to the questionnaire

This version of the questionnaire was handed out to Member States during the meeting of 10 September 2009. The Commission invited Member States to give their views on the content and form of the questions until 17 September, in view of issuing a final questionnaire on thereafter.

According to the Subgroup “Evaluation” a period of eight weeks is a reasonable period to formulate answers to the quantitative questions, and a period of twelve weeks reasonable to gather information necessary to answer the quantitative questions.

On the basis of that assessment, the Commission would like to receive th first answers from each of the stakeholder groups within its own chapter (see before “stakeholders concerned”) to the first type of questions by 15 November 2009, and the second type of questions (quantitative) by 15 December 2009.

Processing of confidential or classified information

Transparency rules can require that the Commission discloses information upon request, unless stakeholders identify all or some (explicitly identified) replies to the questionnaire as coming under one of the exceptions mentioned in Article 4 (1) or (2) of Regulation 1049/2001/EC as appropriate. The intention of the Commission is to use the replies solely for the purpose of the evaluation. .Aggregated or anonymized results can be included in the report and will not expose individual stakeholders, for instance to illustrate certain positions and statements contained in the evaluation report.

Replying to certain questions could entail the disclosure of confidential or classified information.

Respondents are requested to indicate in their answer to the questionnaire whether answers should be treated as confidential or as classified information (EU Confidential or EU Secret] and to provide these answers separately via the appropriate procedure.

The Commission shall ensure that within its organisation the information received shall receive a level of protection that is equivalent to the level of protection offered by measures applied to that information by the stakeholder concerned. Stakeholders are invited to mention such measures and forward information accordingly. Information identified as such will be kept in the Secure Zone and will only be accessible to persons that have the appropriate clearance.

Comments about data categories

The Data Retention Directive covers three types of operational data: 1. Data concerning fixed network telephony; 2. Data concerning mobile telephony and 3. Data concerning Internet access, Internet e-mail and Internet telephony.

The subgroup “Evaluation” of the Experts' Group on Data Retention is of the opinion that in case precise quantitative data can not (yet) be provided, it is easier to provide the ratio between the different categories of data, in particular since the ration between Internet data in comparison to telephony data is changing in favour of the first.

Comment with regard to technological development

Article 14 DRD requires that the evaluation takes into account “further developments in electronic communications technology”.

The convergent market is moving beyond the technology that was available in 2004/2005 when the Directive was drafted.

New broadband type services delivered through 3G-GSM and WiFi enabled mobile handsets for instance have an impact on the ability to compare network events being generated on networks. All stakeholders are request to consider the impact of this and other developments on the application of the Directive.

Die Kommission überlegt also, weitere Daten speichern zu lassen. Stattdessen sollten wir darauf hinweisen, dass die technologische Entwicklung dazu geführt hat, dass inzwischen immer mehr Daten erzeugt werden (z.B. iPhone), dass also weniger Daten gespeichert werden sollten, um wenigstens die bestehende Tarierung der Gewichte nicht noch weiter zu verschieben.

Definition of “Request”

The Subgroup “Evaluation” noted that one “request” (cf Article 8 and 10(1) of the Directive and under 1.A.1 below) can concern several (many) “data”. The number of requests can therefore be significantly smaller than the number of data that are transmitted. Depending on the context, the answer should refer to the total number of requests or of data that are provided.

Apart from quantitative indications that provide meaningful insight in for instance in the volume of the data processing or of the impact of the operation of the Directive on economic operators, a qualitative assessment is required to establish inter alia whether the list of data in Article 5 of the Directive or the retention period mentioned in Article 6 are relevant and effective to achieve the purpose of the Directive, namely to detect, investigate and prosecute serious crime. In order to support fact-finding on this matter, Member States in particular are invited to forward case studies or examples of prosecution cases where retained data have assisted investigations and prosecutions.

Throughout the first set of questions (on the evaluation of the Directive) the expression “country” is used to denote the fact that the addressees of the questionnaire are not only the EU Member States, but also non-EU EEA States.

Questions to Member States and and non-EU EEA States

Qualitative and quantitative aspects of the application of Directive 2006/24/EC, taking into account further developments in electronic communications technology and the statistics provided pursuant to Article 10,

Law enforcement issues

Adequacy and law enforcement relevance of the data retained under Article 5 of the Data Retention Directive

Please indicate whether the data the service providers must retain under Article 5 of the Directive are relevant and sufficient from a law enforcement perspective, and mention which data either should be removed from the list of Article 5 where redundant or be added where relevant data is not yet retained.

Member States are invited to motivate their answer and provide examples of situations that demonstrate the redundancy or the law enforcement requirements.

Details of the requests that are issued

Did your country standardise or seeking to standardise the format for the acquisition and disclosure of communications data between public authorities and communications service providers (for instance in service level agreements, or by making reference to relevant ETSI standards)? If so, please provide information about the standard (form or format) for requests, the message format, the technical modalities and/or interface.

Die Kommission plant eine Vereinheitlichung der Datenschnittstellen. Hier Textbaustein aus Stellungnahme gegenüber dem Bundestag einfügen.

Reimbursement of costs

Does your country make the reimbursement of costs conditional on the respect of certain conditions, such as, for instance, guaranteeing a certain quality of service (request profiles, amount of requests to be handled, speed of retrieval)? If so, could you please provide information about the conditions that service providers have to meet and the link between reimbursement scheme.

Hier Textbaustein aus Stellungnahme gegenüber Bundestag einbauen.

Effectiveness - What is the success rate of the use of retained data

How can cost-effectiveness of the acquisition and use of retained data be increased? [entails quantitative elements]

Entscheidend ist die Frage, ob Kriminalitätsrate oder wenigstens Aufklärungsrate nicht nur vorübergehend erhöht werden, und ob die aufgewandten Mittel nicht andernorts mehr Sicherheit bewirken würden. Einzelfälle genügen nicht. Text einfügen: Nützlichkeit ist nicht gleich Sicherheit.

National and transnational requests and answers

Within this questionnaire, a "transnational request" means a cross-border request for the acquisition of communications data between EU Member States and non-EU EEA States as appropriate where: law enforcement authorities from another county requests you to provide data retained by service providers within your country (the “incoming requests”) and requests initiated by your competent authorities for data held within another country's jurisdiction (the “outgoing requests”).

Does your country have a central point that issues outgoing requests or receives incoming requests? If so, please provide details about these central points.

Hinweis darauf, dass die Cybercrime-Konvention (Auslieferung an 52 Vertragsstaaten) verfassungswidrig ist und auch dem Rahmenbeschluss zum Datenschutz widerspricht.

Data security

Which measures (rules, procedures, audit provisions) are enforced to protect data against misuse?

Textbaustein Schriftsatz an BVerfG zu Datensicherheit

Telecommunications authorities

Allocation of tasks

Centralised storage of data by Service providers

Da ein ähnlicher Plan in Großbritannien gerade gescheitert ist und es auch sonst nirgendwo eine zentrale Aufbewahrung stattfindet, sollte die Kommission nicht einmal daran denken, derartiges vorzuschlagen oder zu befürworten. Eine zentrale Speicherung führt dazu, dass Datenpannen und Missbrauch den größtmöglichen Schaden nach sich ziehen. In der IT-Sicherheit ist anerkannt, dass eine zentralisierte oder auch nur vernetzte Speicherung aus Sicherheitsgründen zu vermeiden ist.

Questions addressed to national supervisory authorities and the European Data Protection Supervisor (EDPS)

Which problems have supervisory authorities identified with the practical implementation of the Directive? (legal, practical, other; please provide details) [can entail Quantitative elements]

3.A.5 What experience do authorities have with the supervision of data that service providers have stored centrally, i.e. either within their jurisdiction or beyond? If so, please provide details about the challenges met in that context, also with regard to data stored outside of the EU/EEA. Please specify in particular the data protection issues that have been addressed that that context and the approach that has been followed to settle the contentious issues. [can entail Quantitative elements]

3.A.6 Please provide details about case law (jurisprudence), if any, with regard to the implementation or use of the Data Retention Directive or concerning the use of retained data within criminal investigations?

Questions to the private sector (ISPs, telecom operators, network and cable operators)

Which means do providers have to identify users of prepaid SIM cards? Please describe the number of cases or ratio of cases where information could not be provided in relation to the means used.

.

Annex

Council Conclusions on combating the criminal misuse and anonymous use of electronic communications

2908th JUSTICE and HOME AFFAIRS Council meeting Brussels, 27-28 November 2008

The Council adopted the following conclusions:

"THE COUNCIL OF THE EUROPEAN UNION,

RECALLING the importance it attaches to the development in the territory of the European Union of electronic communications and of roaming, which are corollaries of the principle of the free movement of persons and of the establishment of a real "People's Europe";

WELCOMING the efforts of the European Commission, the Member States, national regulators and providers of electronic communications to improve communications between users, in particular through roaming agreements;

WELCOMING the reduction of roaming costs resulting from Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (the framework Directive) and Regulation (EC) No 717/2007 of the European Parliament and of the Council of 27 June 2007 on roaming on public mobile telephone networks within the Community and amending Directive 2002/21/EC;

RECALLING that the free movement of persons and the development of electronic

communications must go hand in hand with the establishment of an area of freedom, security and justice, one of the substantive objectives of the European Union;

BEARING IN MIND Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) and Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks, and amending

Directive 2002/58/EC;

EMPHASISING the importance of the rules contained in the abovementioned instruments for both the protection of data derived from electronic communications and the conservation of such data for the purposes of criminal investigations;

DRAWING ATTENTION to the fact that organised criminal groups take advantage of the implementation of the principle of free movement of persons and the development of electronic (and especially mobile) communications to conduct their criminal activities in the territory of the Union;

NOTING that the impossibility, for the competent authorities, of identifying users of mobile telephones working with prepaid SIM cards can allow perpetrators of criminal offences to communicate with co-perpetrators or accomplices with complete impunity;

NOTING also that cross-border crime can be facilitated by the fact that, in roaming, the identity of the subscriber of the telephone line, registered with the home operator, is unknown to the host country operator registered in the destination country, whether that line operates on the basis of a subscription or a prepaid SIM card;

CONSIDERING the advantage there would be in being able to know the identity of the purchaser of a prepaid SIM card, in order to trace the user of a terminal;

EMPHASISING furthermore that mobile telephony is the medium of numerous criminal offences against mobile phone operators such as fraudulent reloading of prepaid phone cards and VAT fraud;

INSISTING that the development and intensification of police and judicial cooperation in criminal matters in European Union territory must be accompanied by improvements in the partnership between the public and the private sectors;

BEARING IN MIND its conclusions of 8 May 2003, in which it considered that the tracing of the use of prepaid mobile telephone cards could improve criminal investigations and particularly those relating to serious criminal offences,

CONCLUDES THAT IT IS NECESSARY TO COMBAT THE CRIMINAL MISUSE AND ANONYMOUS USE OF ELECTRONIC COMMUNICATIONS, AND TO THAT END:

RECALLS the importance of making the best possible use of the potential offered by the abovementioned European instruments;

INVITES Member States to supply, at the request of the Commission, all relevant information on legislative and non-legislative measures or technical solutions implemented to identify users of communications media, and their degree of operational effectiveness;

INVITES the Commission, in the context of the report referred to in Article 14 of the

abovementioned Directive 2006/24/EC, and by 15 September 2010, to inform it of the legislative and non-legislative measures or technical solutions notified by the Member States and, on that basis, to propose non-legislative and technical solutions to help the services and authorities responsible for compliance with the law to better identify users of electronic communications services such as users of mobile phone lines opened with prepaid SIM cards and, if after evaluation it is apparent that these measures are unsuccessful in effectively ensuring traceability, to propose legislative measures;

SUGGESTS that these proposals also address the question of the reasonable retention period for information necessary to identify the phone user, given the time required for criminal investigations and in particular for those relating to serious forms of crime;

STRESSES that these proposals must take account of the objective of keeping the processing of personal data to a minimum and of using anonymous or pseudonymous data where possible, pursuant to the abovementioned Directive 2006/24/EC;

STATES that it is important that these proposals take account of their cost in relation to their anticipated benefit, and of a fair balance between the needs of the authorities and services responsible for criminal investigations and the economic development of operators and distributors bearing in mind the constraints which already weigh on them;

HOPES, finally, that the Commission proposals will, if appropriate, address any other difficulty encountered by Member States or their competent authorities in the framework of criminal investigations relating, in particular, to serious forms of crime, as regards the traceability of electronic communications, whether mobile or not – for example, difficulties relating to instant messaging used from a portable computer."

---