Sven Anderson writes:
> Hi,
>
> Karsten N. just sent to the German exitnodes list a link to an article,
> which is very convincing and legally well-founded (see below). It
> explains that any service that is being donated to the public, that is,
> without taking money or any other return service (like advertisements)
> for it, is _not_ obliged to retain any connection data! Furthermore,
> since there is no gray area, who isn't obliged to retain data is not
> _allowed_ to retain data, and can be charged with a fee up to 10.000 EUR
> for doing so!
I'm not a lawyer in Germany or any jurisdiction and I don't have any
knowledge or opinion of the convincingness or legal well-foundedness
of this article. I encourage anyone who might want to rely on it to
seek the expert opinion of a German lawyer. But I do read German, so
I've translated Karsten's note and (most of) the text of the article
below for the benefit of anyone interested in this material who doesn't
read German.
>> [translated]
>> From: "Karsten N." <tor-admin@xxxxxxxxxxxxxxxxxxxx>
>> Date: 24. November 2008 10:26:02 CET
>> To: exitnodes@xxxxxxxxxxxx
>> Subject: no data retention for free of charge services
>>
>> Hello Tor admins,
>>
>> there's an interesting commentary on datenspeicherung.de concerning the
>> retention obligations in §113a of the TKG law.
>>
>> http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fuer-unentgeltliche-dienste/
>>
>> According to this, Tor nodes (specifically mentioned!) may not retain *any*
>> data.
>>
>> Karsten N.
NO DATA RETENTION FOR FREE-OF-CHARGE SERVICES
Original German text of this article "Keine Vorratsdatenspeicherung für
unentgeltliche Dienste" is available at
http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fuer-unentgeltliche-dienste/
Copyright 2008 Patrick Breyer; licensed under Creative Commons BY-2.0
(Germany) license.
http://creativecommons.org/licenses/by/2.0/de/
Translation by Seth Schoen. This text version omits hyperlinks to the
German text of laws, treaties, and court decisions which appear in-line
in the original German version.
Beginning on January 1, 2009 at the latest, those offering certain
publicly-accessible telecommunications services must store their users'
traffic data (§ 113a TKG). This applies to providers of land line
telephone services, mobile telephone services, Internet telephone
services, e-mail, Internet access, and anonymizing services. However,
it has thus far remained unnoticed that the obligation to store this
data applies only to compensated or commercial services. Free-of-charge
services do not have to store data. Indeed, data retention is forbidden
to them under penalty of a fine.
* Legal situation
The obligation to retain data in Germany arises from § 113a TKG.
This rule is only applicable to "telecommunications services"
[Telekommunikationsdienste]. According to § 3 no. 24 TKG,
"telecommunications services" are only "services normally provided
for remuneration" [in der Regel gegen Entgelt erbrachte Dienste].
For clarification of this distinguishing criterion, we find in the
explanatory statement of the corresponding bill: "This definition is
in accordance with art. 2 letter c sec. 1 RRL".
This refers to the EU Directive 2002/21/EC on on a common regulatory
framework for electronic communications networks and services.
This Directive defines as an "electronic communications service"
[quotation from official English version] only "a service normally
provided for remuneration" [quotation from official English version;
German 'gewöhnlich gegen Entgelt erbrachte Dienste']. The Commission
had originally even wanted to include only "a service provided for
remuneration" [gegen Entgelt erbrachte Dienste]. This was in accordance
with the then-effective German telecommunications law of 1996,
which was largely applicable only to "the commercial provision of
telecommunication" [das gewerbliche Angebot von Telekommunikation].
The European Parliament asked, however, for a broadening of the
framework directive to all services that are rendered "on a commercial
basis" [quotation from official English version; German 'auf
kommerzieller Basis']. For explanation it argued that "electronic
communications services may be offered on an unremunerated, yet
commercial basis" [quotation from official English version]. The
Council finally decided on the current formulation, according to which
all "services normally provided for remuneration" [gewöhnlich gegen
Entgelt erbrachte[n] Dienste] are included. The Council did not offer
an explanation for this formulation.
However, it is clear that as a compromise the definition of service
provision fom the EC Treaty was adopted in full (EC Treaty article
50). The EC Treaty defines service provision in article 50 as follows:
"Services shall be considered to be 'services' within the meaning of
this Treaty where they are normally provided for remuneration, in so
far as they are not governed by the provisions relating to freedom of
movement for goods, capital and persons. 'Services' shall in particular
include: (a) activities of an industrial character; (b) activities of
a commercial character; (c) activities of craftsmen; (d) activities
of the professions." [quotation from official English version] The
distinguishing criterion "normally provided for remuneration" [in der
Regel gegen Entgelt erbracht] was thus adopted word-for-word in the
telecommunications Framework Directive, which is also evident from the
other translations of the Directive. This imitation of the EC Treaty was
meaningful because the Framework Directive is founded upon the basis of
the European Single Market powers of the EC. The EC may not regulate
the provision of services other than those that are the subject of the
Single Market.
The definition of electronic communications services in the Framework
Directive applies to data retention as well according to article 2,
paragraph 1 of Directive 2006/24/EC. The data retention directive
applies according to its article 3 only to "electronic communications
services" [elektronische Kommunikationsdienste] in this sense. The
Directive on data retention could not include other services because
in any case it is founded on the basis of the Single Market powers (EC
Treaty article 95) and may thereby only regulate the Single Market.
The scope of § 113a TKG is, in the end, consequently identical to
the scope of EC Treaty article 50. The German legislature did not
merely intend to take the definition of "telecommunications service"
[Telekommunikationsdienst] in § 3 TKG from EC law (see explanation).
In this regard it also intended to implement data retention itself only
in accordance with European legal requirements. This is clear from the
title of the implementing legislation, but also from the rationale
for the law (pages 30 and 69). The Bundestag wanted to require only
those services (with the exception of anonymizing services) to retain
data which it had to require to do so according to the EC Directive on
data retention. The German Constitutional Court has ruled with regard
to European arrest warrants that European legal requirements must be
implemented as narrowly and compatibly with basic rights as possible.
In the application of implementing laws, a construction compatible
with basic rights should also be taken. A constitutionally compatible
construction of § 113a TKG requires that data retention – to avoid
breaching German basic rights and the rule of proportionality – not be
expanded beyond what is necessary as a matter of European law.
* Precedent on the defining criterion "normally [provided] for
remuneration" [in der Regel gegen Entgelt]
Many decisions of the German court have been issued on the question of
when a service is "normally provided for remuneration" [in der Regel
gegen Entgelt erbracht]. In the leading decision "Humbel" from 1988,
the Court decided: "According to article 60, para. 1 of the EEC Treaty,
only 'services that are normally provided for remuneration' [quotation
from official English version; German 'Leistungen, die in der Regel
gegen Entgelt erbracht werden'] fall under the chapter on services. Even
if the term 'remuneration' [Entgelt] has not been expressly defined in
articles 59 and following of the EEC Treaty, its meaning can be inferred
from article 60, para. 2 of the EEC Treaty, according to which, in
particular, industrial, commercial, craft and professional activities
count as services. The essential feature of remuneration [Entgelt]
is thus that it shows the service provided in return for the service
concerned, in which the service provided in return is normally agreed
between the service provider and the recipient of the service."
In subsequent decisions, the court has clarified that such a service in
return can also be deemed to occur if it is paid for by a person other
than the recipient. Thus private television broadcasting is regarded as
a service provided for remuneration [gegen Entgelt erbrachte Leistung],
because it is paid for through advertising. Indeed, one can regard
private television broadcasting as a commercial service [entgeltliche
Leistung] for the advertising purchasers, which serves to draw viewers
for the commercials. The court has also considered the services of
hospitals as furnished for remuneration [gegen Entgelt erbracht], since
the hospitals are financed by health insurance companies – although in
the form of standard flat rates.
Now it is important that the court takes particular services into
account. The criterion "normally" [in der Regel] thus does not go so
far as to make a single category dispositive of all services. Rather,
the court determined with regard to universities, for instance, that
the freedom of services had no application to public, tax-supported
universities, but that it did apply to private colleges. It is thus
critical whether the particular provider offers his service "normally
for remuneration" [in der Regel gegen Entgelt] or not. The service must
be assigned according to EC Treaty article 2 to "economic activities"
[quotation from original English version; German 'Wirtschaftsleben'].
In the case of public schools, the court established that their public
funding still did not establish a remunerated service [entgeltliche
Leistung]. The public financing did not constitute a service directly
provided in return for a service rendered. Even a mandatory levied
tuition fee does not constitute a remunerated service [entgeltliche
Leistung], so long as the institution is funded substantially by
public means. That a service (necessarily) must be funded in one
way or another, then, still does not make it a remunerated service
[entgeltliche Leistung]. The funding must rather be able to be regarded
as provided directly in return for the service [gerade als Gegenleistung
für den Dienst].
* Application to data retention obligations
For telecommunication services and the obligation to retain data the
following thus apply:
Services that are financed essentially by something provided in exchange
[Gegenleistungen] by the user are in any event normally provided for
remuneration [in der Regel gegen Entgelt erbracht]. Such services must
thus retain data.
Those services that are financed essentially by accepting advertising
– such as banner ads – and that are run for profit are also normally
provided for remuneration [in der Regel gegen Entgelt erbracht]. Thus,
for example, the commercial free e-mail services must store data, even
if their users don't have to pay a subscription fee [Entgelt].
On the other hand, services that are provided for nothing substantial
in exchange [keine wesentliche Gegenleistung], either by their users
or by their parties, are normally provided for no remuneration [in der
Regel unentgeltlich erbracht]. For instance, a private party may provide
a free e-mail service, an open wireless network providing Internet
access, or a Tor server for no compensation [unentgeltlich] and financed
with his own means, and then no telecommunications service normally
provided for remuneration [in der Regel gegen Entgelt erbrachter
Telekommunikationsdienst] exists and the data retention obligation
according to § 113a TKG does not apply.
Government services are also normally not provided for compensation [in
der Regel unentgeltlich erbracht]. Many local authorities, for example,
provide free Internet access or e-mail accounts. These essential
tax-financed services are exempt from data retention. This is even true
if a service charge is levied on the user, but the charge only defrays
a small part of the costs. This situation should not be considered as
different from the imposition of tuition fees or charges, concerning
which the European court has already ruled.
Correspondingly, even a private noncommercial service [unentgeltlicher
Dienst] does not always lose its noncommercial character
[unentgeltlichen Charakter] by collecting a service charge or showing
commercial advertising, as long as accepting these makes up only a
trivial share of the cost of the service. Whoever wants to be confident
in being exempt from the obligation to retain data should, however,
forego such sources of funding entirely.
Services that are offered by noncommercial providers (for example, by
individuals or organizations) without a profit motive, but that recoup
their costs essentially by payments from users or advertising customers,
will be regarded as "normally provided for remuneration" [in der Regel
gegen Entgelt erbracht]. After all, the requirement "for remuneration"
[gegen Entgelt] does not require any profit motive. Accordingly, the
European court has regarded private schools or hospitals as commercial
providers [entgeltliche Anbieter], even though they have no profit
motive. Thus even noncommercial services fall under the data retention
requirement if they are provided for remuneration [gegen Entgelt
erbracht].
The treatment of services whose costs are actually essentially borne by
private individual means, but which are offered as "additional" services
by commercial providers, is unclear. For example, some firms offer, in
addition to their paid services, a free public webmail service. The
question is whether the self-promotion, that is to say the publicity
for a commercial offering of the same firm, should be seen as a form
of compensation for the ostensibly free service [ein Entgelt für
den an sich kostenlosen Dienst]. EC Treaty article 50 particularly
includes industrial services, and a commercial firm always has a profit
movie. In this connection, the court has decided with regard to tobacco
advertising that commercial advertising falls within the scope of the
Single Market.
Uncompensated services [unentgeltliche Dienste] of a commercial firm
are thus to be viewed as "normally provided for remuneration" [in
der Regel gegen Entgelt erbracht] if they serve as advertising for
compensated products [entgeltliche Angebote] of the firm. With regard
to commercial firms, a certain appearance argues that their services
in the end promote their own profit motive. Nonetheless an individual
service of a commercial firm need not serve as advertising for the
firm's own compensated products [entgeltlichen Angebote]. For instance a
noncommercial offering [unentgeltliche Angbot] may be clearly separate
from the commercial operation [gewerblichen Tätigkeit] of its provider,
in that it for example is delivered through a separate portal without
any self-promotional materials; then a product normally provided without
remuneration [in der Regel ein unentgeltliches Angebot] will exist,
which does not fall under data retention requirements. If, on the other
hand, the uncompensated service is embedded in the commercial appearance
of the firm, normally a publicity interest and thereby a compensated
product will be presumed.
In summary, we should note that those services that are essentially
funded by private means and that also do not serve as advertising for
paid services are exempted from the obligation to retain data. For
instance, when an individual person offers an e-mail service, a public
wireless LAN with Internet access, or a Tor server without being paid
for it, and he essentially funds from his own resources and not by
receipts from its users or advertising customers, the data retention
obligation according to § 113a TKG does not apply.
* Prohibition on data retention by non-commercial services
Uncompensated services are not only excepted from the obligation
to retain data. Their providers may also not "voluntarily" retain
data. This results from § 96 para. 2 TKG, according to which traffic
data must be erased immediately after the end of the connection, if
they are not "necessary for the purposes established through [...]
legal requirements" [für die durch [...] gesetzliche Vorschriften
begründeten Zwecke erforderlich]. This obligation to erase data
applies to all businesslike providers of telecommunications services
[geschäftsmäßigen Anbieter von Telekommunikationsdiensten]. According
to § 3 TKG, these are all providers of telecommunications, even if
their offering is uncompensated [unentgeltlich].
That "voluntary" data retention, as some Internet service providers
currently practice it, may also not be done on "security grounds"
according to § 100 TKG has already been explained in more detail
elsewhere.
Whoever violates the prohibition on data retention in § 96 TKG is
acting illegally and can be punished with a fine up to ten thousand
Euro by the Federal Network Agency (§ 149 para. 1 no. 17 TKG). Anyone
may file a complaint. However, someone who is required to retain data
and does not do so is also acting illegally. Each provider of telephone
service, e-mail, Internet access, or anonymizing service should thus
make sure that he acts correctly. In case of doubt, he should ask the
Federal Network Agency.
* Non-public services
Data retention applies only to services that are publicly available
(§ 113a TKG). This is an independent restriction in addition to the
commercialness discussed above. The data retention obligation thus
applies only if a service is both normally provided for remuneration
and also publicly accessible. If either of these two criteria is not
met, data retention is not applicable and is forbidden.
A service is publicly available if anyone – and not just specified
groups of users – can use it. The availability of a service only
to members of an organization doesn't affect the public availability
of that service if anyone can become a member of the organization.
Non-publicly-accessible services, by contrast, are those offered, for
instance, by employers or universities, since these can be accessed only
by a limited group of people. These providers are neither required nor
authorized to retain data.
[Final section ("Ausweichmöglichkeiten für entgeltliche Dienste") omitted
from this translation; it describes a procedure for commercial services
to try to obtain a financial indemnity or exemption from the government
while the constitutional challenge to the data retention law is pending,
by writing a letter to the Federal Network Agency. This letter would
demand that that agency temporarily exempt commercial service providers
from implementing data retention or else promise to reimburse the service
providers for their implementation costs in case the German constitutional
court rules data retention unconstitutional or in case it rules that the
government must pay implementation costs.]
--
Seth Schoen
Staff Technologist schoen@xxxxxxx
Electronic Frontier Foundation http://www.eff.org/
454 Shotwell Street, San Francisco, CA 94110 1 415 436 9333 x107