Belgian Chamber adopts amended data retention law

The Belgian Chamber of Representatives has adopted the amended data retention law. With this law, providers can again preventively keep metadata of telecom customers. A previous law on this was overturned in April last year.

Under the old data retention law, which was annulled by the Belgian Constitutional Court in April 2021, traffic and location data of all Belgian telephone numbers were preventively kept for a year. For example, the police and intelligence services could request it if this turned out to be necessary for an investigation.

However, the Court found that this law was not proportionate and that a ‘generalized and undifferentiated retention’ of the metadata was not allowed. Collecting the metadata was the norm and not the exception as it should be according to the Court. With the new ‘Collection Bill and the retention of identification data and metadata in the electronic communications sector and their provision to the authorities’, the Belgian government wants to meet the objections of the Court.

Under the new law, providers will only be required to store the metadata if there is “an actual and current or foreseeable serious threat to national security,” or to prevent serious crime. In addition, the metadata may only be stored in a targeted manner, for example in certain zones ‘or for certain categories of persons who have been determined in advance to pose a special risk’. IP addresses that had contact with a source may be kept ‘generally and undifferentiated’, the Court said, as long as police forces want to use them to combat serious crime or prevent serious threats to security.

Earlier there was talk of part of the data retention law that would require chat apps such as WhatsApp, Facebook Messenger and Telegram to share metadata. For this, a backdoor in the end-to-end encryption of the services would have to be used. According to press service Belga this back door is not part of the adopted bill, because it would still require consultation with the European Union. Before the new data retention law can be passed, the Belgian Senate still has to vote for it.