"The digital space must not be a paradise for criminals," said Federal Minister of Justice Stefanie Hubig — a line the government is using to justify a fresh, narrowly framed bid to compel internet service providers to store customer connection data.
Cabinet approval and the new three‑month requirement
The national cabinet approved Wednesday a draft law that would require internet service providers to retain customers' IP addresses and port numbers for three months as a "precautionary measure," though the measure still needs parliamentary approval. The draft says this retention is intended to aid investigations of online crimes; the government describes the proposal as protecting "fundamental rights" while strengthening law enforcement online, and Hubig called it "the opportunity to bring a 20 year debate about freedom and security online to a sensible conclusion."
The draft explicitly avoids a blanket requirement to store traffic or location data. However, law enforcement agencies would be able to demand retention of traffic metadata in specific cases when a crime is suspected, and to request cell‑site location data for a broader range of serious crime investigations than is currently allowed.
A two‑decade legal tug‑of‑war: court rulings and earlier German laws
Germany's new proposal is the latest episode in a long legal history. Between 2008 and 2010 Germany implemented a retention regime tied to the 2006 EU Data Retention Directive that required six‑month to two‑year retention and covered extensive data including IP addresses and metadata relating to internet access, email and telecommunications. The German Federal Constitutional Court overturned that law, finding it conflicted with the country's fundamental right to telecommunications privacy; the court concluded the law was too heavy‑handed for precautionary aims and lacked sufficient limits on authorities' use of the data and on data‑security requirements.
In 2014 the Court of Justice of the European Union (CJEU) scrapped the Data Retention Directive for similar reasons. A second German attempt after the 2015 Charlie Hebdo attack narrowed retention to 10 weeks, limited database access to "severe" crimes, and required encryption and storage on air‑gapped servers with court orders for access. That law hit legal and regulatory roadblocks: in mid‑2017 a complaining service provider won a temporary suspension in a regional court, the CJEU reiterated that untargeted data retention was unacceptable, and the German Federal Networks Agency said it would not enforce the rules. The second law never took effect and was finally killed by another CJEU ruling in 2022.
Critics from the Chaos Computer Club and eco
Not all observers accept the government's reassurance. Constanze Kurz, spokeswoman for the Berlin‑based Chaos Computer Club, called the proposal "a mass surveillance law" and warned it "does not take into account the massive potential for misuse and the high IT security risks." Kurz told ISMG the stored information would be "attractive to all kinds of data criminals," creating "attack points for cybercrime," and urged evidence‑based, differentiated solutions instead of "forced storage of all IP addresses."
Eco, the German internet industry trade association, was also critical. Board member Klaus Landefeld said the draft "fails to meet the requirements of the European Court of Justice and once again creates indiscriminate data retention without demonstrable added value for law enforcement." Landefeld argued providers would face excessive burdens to build complex, highly secure storage infrastructures and warned the measure would create planning uncertainty, high costs and weaken "Germany's position as a digital business location."
Telecommunications groups: split views on cybersecurity and burden
Trade groups offered a mixed response. The German Broadband Communications Association criticized the draft's three‑month retention period as disproportionate and said storing IP addresses and port data "poses a significant risk of massive technical and economic burdens." At the same time, a spokesman for the association told ISMG that it views the draft law's cybersecurity provisions "as sufficient," signaling acceptance of technical safeguards even while objecting to scale and cost.
What this means for ISPs, law enforcement, and privacy advocates
- ISPs: The draft would push providers to create or expand secure retention systems for IP and port data, a move eco's Klaus Landefeld said would impose high costs, planning uncertainty and legal risk if the law's status remains contested.
- Law enforcement: Investigators would gain mechanisms to demand retention of traffic metadata in suspect cases and broader access to cell‑site location data for serious crimes, a practical expansion of investigative tools compared with current rules.
- Privacy and security advocates: Groups such as the Chaos Computer Club warn that even narrowly scoped retention creates "attack points for cybercrime" and amounts to mass surveillance, arguing for targeted, evidence‑based alternatives rather than broad forced storage.
Europewide tensions frame the German debate. Some member states already retain more extensive records — Italy mandates telephone and internet metadata for six years — while a 2024 CJEU ruling suggested that retaining IP addresses can be acceptable if they generally cannot be linked to identity‑related stored data. The European Commission is expected to propose a new data retention measure in the coming months, which the government and critics alike say could influence legal alignment across the bloc.
The German cabinet has cleared a carefully worded compromise, but the history of court rulings and the sharply divided reactions from civil‑society and industry voices make parliamentary debate and likely legal challenges more than a formality. Whether this draft survives that next stage — and whether a coming European Commission proposal smooths the continent's divergent approaches — are the immediate questions left on the table.
