Estonia Proposes Ending Mandatory Bulk Communications Data Retention
Estonia's justice and digital minister has sent the government a draft law that would end telecom operators' obligation to retain communications data en masse at the state's request. The bill aims to align Estonia's data regime with EU court rulings on privacy and introduces a 'quick freeze' mechanism for investigations.
Justice and Digital Minister Liisa Pakosta (Eesti 200) has submitted a draft law to the government that would eliminate the requirement for telecom companies to collect and store people's communications data on a mass scale for the state. The explanatory memorandum states the goal is to change Estonia's communications data regime to protect fundamental rights in line with EU law, meaning the current state-mandated bulk retention will be discontinued.
In criminal proceedings, only communications data collected for commercial purposes and data needed to investigate a specific crime (the so-called 'quick freeze' mechanism) may be used as evidence. In misdemeanor proceedings, such data can only be used for serious or organized offenses. For extreme situations threatening society's security or the state's survival, a narrowly limited possibility for short-term broader data retention is foreseen, but only with a justified government decision and involvement of the Riigikogu.
The bill resolves practical problems with communications data requests and their use in criminal and misdemeanor cases. It concerns only technical communications data retrieval from telecom operators — specifically data needed to identify an end user, and the retention and retrieval of traffic and location data. It does not regulate access to the content of communications (messages, calls, files).
Under current law, Estonia allows the use of communications data in criminal and misdemeanor proceedings based on a general, uniform retention obligation imposed on operators. The ministry points out that the Court of Justice of the European Union and Estonia's Supreme Court have ruled that using universally retained traffic and location data in criminal proceedings is not permitted, as it violates EU personal data and privacy protections. Exceptions are data needed to identify a user and IP address data.
Going forward, only data needed to identify an electronic communications service user and IP address data will be retained generally and uniformly. The general retention obligation for phone and mobile service traffic and location data will be abolished. Communications data includes metadata such as source/destination, location, time, duration, size, route, format, protocol, but not message content.
Law enforcement authorities may request identification data and use data retained by operators for commercial purposes. To ensure data availability for a specific investigation, they can request rapid preservation ('quick freeze'). The bill also provides narrowly defined short-term grounds for data retention to combat very serious crime (e.g., crimes against humanity, war crimes, terrorism, human trafficking, crimes against the state, drug trafficking, corruption, money laundering, organized crime). Such targeted temporary retention is ordered by the government based on specific geographic areas with significantly higher serious crime levels.
For national security purposes, temporary retention may be ordered when the state faces an elevated or immediate threat. These data cannot be used in criminal proceedings, only in administrative procedures related to national security.
Telecom operators face increased administrative burden due to the need to differentiate data categories and implement differentiated access. The ministry notes that if data request processes do not become more complex, the additional burden will be temporary.
