eco Sharply Criticises Law on IP Address Storage: Endangers Fundamental Rights, Undermines Investment Security and Weakens Germany as a Digital Location

The draft law presented by the German federal government to introduce a three-month IP address storage is facing criticism from the Internet industry. eco - Association of the Internet Industry warns of violations of European Court of Justice case law, a reduction in judicial control and considerable financial burdens for the sector.

"The draft law once again fails to meet the requirements of the European Court of Justice and creates a system of indiscriminate surveillance without proven benefits for law enforcement," explains eco Board Member Klaus Landefeld. "We are particularly critical of the weakening of the judicial reservation. Mere notification of those affected cannot replace missing judicial oversight - especially since it is not even clearly regulated whether this obligation lies with the investigating authorities or the service providers."

From the perspective of the Internet industry, the draft significantly exacerbates existing legal uncertainties. Through expanded query options - including those directed at service providers based in other EU countries, such as messengers - there is a risk of access to data stocks that should not have been stored at all under national law, or should no longer be stored. At the same time, companies are to be obligated to set up new, technically complex and highly secure storage infrastructures - despite the unclear legal situation and without any demonstrable added value for investigations.

"Companies are once again expected to invest heavily in an infrastructure that is highly likely to be legally vulnerable. This endangers fundamental rights, creates planning uncertainty and weakens Germany as a business location," Landefeld continues.

eco therefore calls for the draft law to be withdrawn in its current form and urges the development of a proportionate solution that complies with fundamental rights and strictly follows European legal standards. Investigative powers should be targeted, event-driven and subject to effective judicial oversight.

Background

• The draft law provides for the three-month storage of IP addresses and port numbers.
• The European Court of Justice has set narrow limits for data retention in several rulings (including C-793/19, C-794/19 and C-470/21).
• In eco's view, the draft law effectively allows for comprehensive usage profiles to be created through correlation with other traffic and usage data.
• In addition, a study by the German Federal Criminal Police Office (BKA) has shown that traffic data is generally only relevant for investigations for a few weeks after it is generated.
• eco has published a German statement on the draft law that details the legal, technical and economic impacts.