European Commission looking into EU-wide legal framework for metadata retention

The European Commission is examining the implications of new EU-wide directives on the retention of metadata by providers. Structured retention could help law enforcement authorities fight crime.

Providers currently store data for possible criminal investigations, but which data is stored and its storage method vary per Member State. At present, no EU-wide legal framework exists in this area.

According to the European Commission, this hinders international investigations and cooperation between Member States. With the new initiative, the European body wants to standardize the retention of metadata at the European level.

“While most EU Member States rely on national laws that diverge across the EU, other Member States do not have rules in place. The lack of harmonized data retention rules for key categories of data was identified by the police, prosecution services, and judicial authorities as a substantial challenge for national criminal proceedings in crimes happening both online and offline, and hampers cross-border cooperation across the EU,” the European Commission says in an initiative report.

This cannot be solved by individual Member States, because they will have to update their national laws constantly in response to new and emerging technologies. Therefore, an EU-wide legal framework is required.

The objective of the European Commission’s initiative is to ensure the availability of certain categories of metadata for law enforcement authorities to successfully carry out criminal investigations and prosecutions, while at the same time respecting and safeguarding EU standards for the protection of fundamental rights and preserving cybersecurity and the integrity of the EU market.

Until June 18, European citizens can say what they think of the initiative by providing feedback. As of writing, over 2,500 people have done this so far. Public consultation is planned for the second quarter of 2025. The final version is scheduled for the first quarter of 2026.

There used to be rules for metadata retention in the EU. However, they were annulled by the European Court of Justice in 2014. The court ruled that these guidelines did not guarantee fundamental rights, such as the right to privacy and the protection of personal data.