German court narrows data retention rules.

Germany's highest court has revised the country's recently passed data retention directive targeting Internet service providers (ISPs) and telecom companies. Calling the law "potentially intimidating," the Federal Constitutional Court ruled March 19 that citizens' information still can be stored; however, it can be accessed only with a warrant and only in the case of serious crimes.

Germany's data retention law, which became effective December 2007, requires phone companies to store various kinds of personal phone and Internet data, including customer e-mail addresses, numbers dialed, and time and location of calls, for at least six months and to provide this information to investigators who request it.

The law, which was passed in accordance with a March 2006 European Union guideline, was controversial from the start: 30,000 Germans promptly filed a class action suit when it passed, concerned about the privacy implications. In its ruling, the court called parts of the law unconstitutional. Although it decided to uphold the retention requirement, it instituted much stricter safeguards around who can access the information.

[ILLUSTRATION OMITTED]

Ruling on a related case in late February, the court said judicial oversight is required when police and intelligence agencies use spyware to monitor suspects' computers and remotely glean information from their hard drives. It also ruled that authorities must show evidence that a suspect is dangerous before using domestic security services to monitor his or her computer. The court also defined areas that cannot be examined with spyware and said police cannot include unrelated personal information in their investigations of suspects.

The EU Directive mandating member countries to store phone and Internet details for a minimum of six months also has been challenged. It will be examined by the European Court in Luxembourg, which is expected to issue a ruling on the law later this year, according to European media sources.