The European Commission has initiated steps that could pave the way for a broad EU-wide regime requiring telecom and digital service providers to store user metadata, despite a long trail of court rulings that have found such measures unlawful.
On May 21, the Commission launched a formal call for evidence, outlining its intent to develop legislation obligating providers to retain metadata for what it terms a “reasonable and limited” duration to aid criminal investigations.
Although framed as a necessity for law enforcement, the proposal raises serious alarm within the privacy community. Metadata, often dismissed as mere technical data, can in reality expose extensive and intimate details about a person’s life.
Even without accessing the content of communications, metadata can reveal who someone talks to, for how long, how frequently, from where, and at what times.
When aggregated over time, this data forms a revealing map of personal habits, routines, relationships, political affiliations, religious practices, and even medical conditions.
The European Court of Justice has repeatedly ruled against such indiscriminate data retention. In a landmark 2014 decision, it struck down the EU’s Data Retention Directive, calling it a “serious interference with fundamental rights” and noting that the directive failed to set meaningful limits or protections.
Follow-up decisions, including a pivotal one in 2020, reinforced that general and indiscriminate retention of metadata violates EU law.
Internal assessments, including a leaked 2023 analysis, echoed these conclusions, warning that reintroducing blanket data collection under different terminology, such as “communications metadata screening,” would likely fall short of legal proportionality standards.
Still, the Commission frames the lack of a unified retention policy as a hindrance to effective law enforcement, claiming that “often the necessary data is…no longer available when the investigation is conducted.”
The current proposal outlines several avenues, from voluntary cooperation through non-binding tools like standardized data request forms, to a more coercive legislative route that would impose mandatory retention obligations under the European Electronic Communication Code.
These requirements would apply to metadata, such as IP addresses and subscriber records, and would be calibrated based on the type of criminal investigation.
While the Commission concedes that the measures could grant authorities access to deeply personal information, it justifies this by pledging to install “adequate safeguards.”
However many privacy advocates argue that no safeguard can fully offset the inherent risks of building massive stores of behavioral data. The mere existence of such a dataset invites abuse, misuse, and unauthorized access, whether by state actors, private entities, or malicious hackers.
Furthermore, experience has shown that data retained for one purpose often ends up being repurposed, expanding the scope of surveillance beyond its original intent.
Thousands of submissions have already been filed in response to the call for evidence, with many warning that the proposal would revive mass surveillance structures that European courts have already dismantled.
Privacy defenders stress that metadata is not a benign category of information; it is, in many cases, more revealing than the content of communications themselves.
Concerns are further compounded by the Commission’s declared right to censor public feedback it deems “abusive, obscene, vulgar, slanderous, hateful, xenophobic, [or] threatening.” Transparency groups argue that such provisions could be used to suppress legitimate dissent, especially when the topic in question carries profound implications for civil liberties across the EU.
The call for evidence is open until June 18 and is expected to be followed by a more formal public consultation in the second quarter of 2025. A draft legislative proposal is planned for early 2026.
