The Future of GDPR Enforcement

The ongoing trilogue negotiations on the GDPR procedural regulation aim to address significant enforcement shortcomings. From strengthening complainants' rights to harmonising Data Protection Authorities' discretion and improving cross-border cooperation, these discussions carry major implications for data protection in Europe. This analysis highlights the urgent need for reforms to ensure effective and fair enforcement.

Prioritising Member States Over Citizens

The classic story about the right to privacy and data protection in the EU is one of a high level of protection. Yet, this original rosy image is increasingly fading away, most visibly in the La Quadrature du Net litigation, which is a continuation of two dynamics. First, the Court is still cleaning up the residual mess that lingers on from the now annulled Data Retention Directive. Second, in so doing, it is incrementally allowing the Member States indiscriminately retain personal data. Hence, the Court is carving out space for Member States’ preferences to the detriment of the protection of the individual.

Die Vorratsdatenspeicherung

Die jüngeren Urteile des EuGHs zur Vorratsdatenspeicherung sind nicht als „kopernikanische Wende“ zu verstehen, in der der EuGH sein Selbstverständnis als Grundrechtsgericht aufgegeben hätte. Sie sind keine autoritär motivierte Abkehr von einer vormals grundrechtsfreundlichen Rechtsprechung. Vielmehr fügen sich die Urteile ein in die komplexe Entwicklung des ursprünglich national geprägten Sicherheitsverfassungsrechts. Diese Einordnung bedarf eines genaueren Blickes.

Data Retention

The recent judgements of the CJEU on data retention should not be regarded as an authoritarian move towards a less fundamental rights-sensible position of the Court. Rather, the case law adapts the ever more complex development of the constitutional security law, which was originally dominated by the Member States. As a European court, the CJEU cannot simply ban certain police measures but must respect the complexity and heterogeneity of national law enforcement agencies.

Die Gewerbsmäßigkeit als Arme-Leute-Strafrecht

Wer von der wachsenden Armut in Deutschland betroffen ist, dem droht im Falle eines Strafverfahrens eine Ungleichbehandlung. Das Regelbeispiel der Gewerbsmäßigkeit als besonders schwerer Fall einer Straftat führt dazu, dass ein zentrales Versprechen des Rechtsstaats gebrochen wird. Es gibt keine Gleichheit vor dem Gesetz, wenn Armut straferhöhend wirkt.

Protecting Victims Without Mass Surveillance

Mass data retention is on the rise. In the current heyday of security packages in Germany, we are now witnessing a “super grand coalition” in favor of mandatory IP address retention. Some are calling for greater protection for victims through data retention. Yet, what one often overlooks is the following: The investigative capacities of law enforcement authorities have never been better, and the digital data pools that can be analyzed have never been larger. Hence, victims must be protected without mass surveillance.

More Protection for Victims Through Data Retention

Mass data retention is all about proportionality. The threat level determines the proportionality of the means – both of which are subject to the perpetual flux of time. Data retention is intended to protect victims of digital crimes. To protect freedom online, our security services urgently need to be able to access stored IP addresses. The alarming developments in our security situation are calling many certainties from the past into question. This also involves a re-evaluation of traffic data retention.

Eyes Everywhere

Ten years after its groundbreaking judgment declaring the Data Retention Directive incompatible with the EU Charter, the Full Court significantly eased its previously strict requirements. On 30 April 2024, it issued La Quadrature Du Net II and, for the first time, declared the general and indiscriminate retention of IP addresses permissible for the purpose of fighting general crime. Given the CJEU’s fundamental change of heart, we have gathered a range of scholars to contextualize the judgment and situate it within the broader debate on mass data retention, online surveillance, and anonymity.

Kein Verfassungsschutz im Wahlkampf?

Im Oktober hatte der damalige Verfassungsschutzpräsident Thomas Haldenwang angekündigt, dass in 2024 mit einer verfassungsschutzrechtlichen Neubewertung der AfD und der Veröffentlichung der entsprechenden Einstufung zu rechnen sei. Jetzt ist jedoch zu vernehmen, dass das Bundesamt zwar zu einer Neubewertung gekommen sei, die Öffentlichkeit aber nun erst nach der Bundestagswahl über das Ergebnis informieren wolle. Dies überzeugt nicht.