Telecommunications Services (Internet Access Services and Number-Independent Interpersonal Telecommunication Services)

Law on the Introduction of IP Address Storage and Further Development of Data Collection Powers in Criminal Proceedings

Firstly, an obligation is introduced for Internet access service providers to store IP addresses in order to enable authorised bodies (in particular law enforcement agencies and police authorities) to reliably identify a subscriber using an IP address.
Secondly, the instrument of the data retention order is created. This allows authorised authorities (in particular law enforcement agencies) to order the storage of traffic data from telecommunications services (providers of Internet access services and number-independent interpersonal telecommunications services) if and insofar as the legal or factual prerequisites for data collection are not yet met.
The draft law sets out requirements for the obligated parties regarding the manner of data processing, in particular requirements for the storage, retention, and deletion of data. These requirements directly follow the case law of the European Court of Justice. With regard to the obligation to store IP addresses, these are in particular the requirements set out in the Judgement of 30 April 2024 (Case C-470/21, Quadrature du Net II – Hadopi). With regard to the seizure order, the European Court of Justice formulated requirements, in particular in its Judgement of 6 October 2020 (Joined Cases C-511/18, C-512/18 and C-520/18, Quadrature du Net I). The rules on seizure orders also serve to ensure the enforceability of Regulation (EU) 2023/1543.