The European Data Protection Supervisor (EDPS) has said that he is not yet convinced by the arguments put forward in favour of a European directive on data retention, and has set out strict conditions any such law would have to meet if it's to be considered acceptable by his office.

EDPS Peter Hustinx published his commentary on the proposed directive today.

If ratified the directive would demand all Internet data - typically email traffic - be held for six months and telephone call data for one year. It would also see ISPs and telcos compensated for their compliance costs. The directive was inspired by hopes that the information could be used to prevent terrorism or to prosecute those accused of terrorist acts.

However, Hustinx said: "The Directive has a direct impact on the protection of privacy of EU citizens and it is crucial that it respects their fundamental rights, as settled by the case law of the European Court of Human Rights. A legislative measure that would weaken the protection is not only unacceptable but also illegal."

He said that retaining data for longer than the six or 12 months proposed in the Commission's draft version of the directive would not be acceptable. He also said adequate safeguards must be put in place to protect personal data.

"If one considers the proposal solely from the perspective of data protection, traffic and location data should not be retained at all for the purpose of law enforcement," he wrote. "A high data security is even more important since the mere existence of data might lead to demands for access and use."

As well as tighter controls, Hustinx argued that the proposal would need the backing of the European Council and the Parliament, an indirect swipe at the competing Draft Framework Decision put forward by the UK. In theory, the draft framework could be ushered into law without the backing of either the Commission or the Parliament.

Hustinx specifically noted that his remarks were confined to the Commission's proposal, as he has not been consulted on the Draft Framework Decision, the legal footing of which has been challenged (http://www.theregister.co.uk/2005/04/12/data_retention/) by top European lawyers.

The European Parliament has called for the UK's proposal to be scrapped (http://www.theregister.co.uk/2005/06/08/data_retention_quandry/).

Read Hustinx's full opinion here (http://www.edps.eu.int/legislation/Opinions_A/05-09-26_Opinion_data_retention_EN.pdf). ®

Related stories

Email privacy in the workplace (2 August 2006)
http://www.theregister.co.uk/2006/08/02/workplace_email_privacy/
EU privacy experts slam email tracking services (7 March 2006)
http://www.theregister.co.uk/2006/03/07/eu_slams_email_tracking_services/
Morgan Stanley offers $15m to make up for missing emails (22 February 2006)
http://www.theregister.co.uk/2006/02/22/morgan_stanley_settlement/
MEPs urged to reject data retention plan (7 December 2005)
http://www.theregister.co.uk/2005/12/07/meps-data-retention_plan/
US moves forward on data privacy (25 November 2005)
http://www.theregister.co.uk/2005/11/25/us_data_privacy/
Amended data retention plans OK'd in Europe (24 November 2005)
http://www.theregister.co.uk/2005/11/24/data_retention_ok/
Home Office plans for science to tackle terror (23 November 2005)
http://www.theregister.co.uk/2005/11/23/science_vs_terrorism/
Private eye fined for illegal sleuthing (21 October 2005)
http://www.theregister.co.uk/2005/10/21/outlaw_oic_sleuth/
Data retention compromise mooted by EU Ministers (14 October 2005)
http://www.theregister.co.uk/2005/10/14/outlaw_data_retention/
MEPs reject UK's data retention plan (27 September 2005)
http://www.theregister.co.uk/2005/09/27/meps_reject_uk_proposal/
EC adopts net and phone data retention proposal (22 September 2005)
http://www.theregister.co.uk/2005/09/22/comms_data_retention_proposal/
EU stumps Clarke data retention plan (13 September 2005)
http://www.theregister.co.uk/2005/09/13/eu_data_retention/
Phone cos and rights activists round on Clarke (9 September 2005)
http://www.theregister.co.uk/2005/09/09/clarke_under_fire/
Clarke: Europe must trade civil liberties for security (7 September 2005)
http://www.theregister.co.uk/2005/09/07/lib_security_trade/
EU Commission promises alternative data retention plan (1 August 2005)
http://www.theregister.co.uk/2005/08/01/data_retention_commission/
UK ministers push for data retention (14 July 2005)
http://www.theregister.co.uk/2005/07/14/uk_ministers_data_retention/