Minutes from EU Court of Justice on #DataRetention

On 19th July 2016, Advocate General Øe Saugmandsgaard will present the Court of Justice of the European Union (CJEU) his opinion in the joined cases C-203/15 and C-698/15,Tele2 Sverige and Davis and Others. They concern the validity of national laws in Sweden and the UK for the retention of telecommunications data under EU law and the EU Charter of Fundamental Rights. This is a very relevant question, since the Court invalidated the EU Data retention directive in 2014.

To see what is to be expected, it is helpful to know what happened at the oral hearing on 5th April 2016. Our legal trainee Antonia Latsch attended the hearing (which is public, but not streamed or recorded). She live-tweeted from there, and has allowed me to re-publish her tweets in chronological order here. I have done minor editing to clean up the language, correct typos, etc. So here we go:

Court is in session #dataretention #dripa

Judgement first, hearing about to start #dataretention #CJEU

Hearing started. Johansson addressing question of what constitutes electronic processing of personal data #dataretention

Tele2 Lawyer Johansson: Law needs to be proportional to what is strictly necessary for the concrete objectives #tele2 #CJEU

Tele2: legislation needs to limit access of data, only to fight serious crimes & subject to ex ante court control #dataretention

Tele2: Swedish data collection law is not limited to serious crimes, nor does it grant ex ante court control #tele2 #dataretention

Watson/Davis Lawyer: The United Kingdom does not provide sufficient safeguards for personal data collection #DRIPA #dataretention

Davis/Watson: Minimum safeguards need to be in place to protect personal data to prevent abuse #dataretention #DRIPA

Davis: Court should give guidance to what necessary safeguards are, UK does not meet the safeguards #dataretention

Davis: UK allows collection of data for purposes that are not in regards to suspected crimes, constitutes breach of Art. 51 #dataretention

Brice: authorization and purpose for what it is granted for are connected; intrusiveness needs to meet seriousness of crime #dataretention

Brice: Authorization to access to data must me be granted by structural independent body #dataretention

Brice: purpose of law is only in case of serious crimes. Domestic legislation goes way beyond, including tax purposes #dataretention

Open Rights Group: Case is of global significance, challenging the courts position on personal data protection #dataretention

ORG/Privacy International: states need to be able to prevent passing of data to states that don't comply with EU privacy law #dataretention

PI: Art. 15 e-privacy directive is lex specialis, it does not allow for the individual to be completely stripped of their privacy rights #dataretention

Law Society: Limitation by independent authorization for the kind of data that can be stored is missing #dataretention

Sweden: general obligation to keep data can be proportional for very important measures #dataretention

Sweden: not all access to general data needs to be directly related to a serious crime, but be strictly necessary #dataretention

Sweden: investigations have shown that it is impossible to limit retention of data prior for measurements to be effective #dataretention

Sweden: possibility of rapid decisions is necessary for effectiveness, therefore outside review is unpractical #dataretention

UK: Law requires commercial service providers to keep the data, not authorities #dataretention

UK: We cannot know in advance what data is necessary and valuable #dataretention

UK: in matters concerning national security, member states must make assessments of what is necessary and proportionate #dataretention

UK: objective requirements for necessity of the taken measurements are different from specific rules laid out by the court #dataretention

UK: it should be up to national courts to check that specific requirements and set standards are met #dataretention

Czech: important how domestic law allows access and safety of data, if safeguards are in place, it is not disproportionate #dataretention

Czech: "We live in troubled times, do we really want to constrain the member states in this way?"#dataretention

Denmark: data retention must be general to be effective as a crime fighting tool #dataretention

Denmark: Rules on access to and retention of date go hand in hand and can not be separated #dataretention

Denmark: proportionality test strikes the right balance, provided it gives clear and precise rules/guarantees of protection #dataretention

Denmark: approach to data retention should be all or nothing #dataretention

Denmark: no reason to assess these national measures more stringent than other national measures #dataretention

Germany: active passing of data by private sector allows government access, this must be compatible with fundamental rights #dataretention

Germany: objective safeguard criteria can be sufficient, therefore concrete implementation determines if law is proportionate #dataretention

Antonia Latsch re-tweeted ‏@TetsuwanAstro:
Germany: Data protection guarantees should be assessed as a whole, access AND retention rules together #dataprotection

Estonia: We consider it necessary in the fight against terrorism to collect data of all people #dataretention

Estonia: Saving someone's life and effectively fighting crime is worth allowing government's intervention #dataretention

Ireland: access of data is not directly governed by EU law #dataretention

Ireland: court is providing guidance for interpretation of EU law to national courts #dataretention

Ireland: member states must be given discretion on how to provide proportional measures #dataretention

Ireland: access of data is not directly governed by EU law #dataretention

Antonia Latsch re-tweeted @JanAlbrecht

Jan Philipp Albrecht quoted Antonia Latsch:
Rubbish. The ePrivacy Directive regulates use of personal telecom data, therefore governed by EU law. #dataretention

Ireland: access of data is not directly governed by EU law #dataretention

Ireland: Diversity of different member states needs to be respected by the court #dataretention

Spain: The burden that data retention puts on the internal market and private actors should not be underestimate #dataretention

Spain: The upholding of fundamental rights must be the upper limit to granted discretion #dataretention

Spain: General data retention cannot be seen as an indispensable measure taken by all means #dataretention

France: Data can be used for prosecution as well for proof of innocence. It is impossible to know in advance what is needed. #dataretention

France: French government finds the retention period of 1 year for data absolutely necessary to combat crime and terrorism #dataretention

European Commission: Interference must be proportional as well as respect the essence of the interfered right #dataretention

Finland: Connection between retention and use means that retention can only be justified if the later use is also justified #dataretention

Finland: Practical reasons necessitate a system of universal retention of data that can be compensated by limitation #dataretention

European Commission: procedural safeguards in their entirety need to be assessed to their efficiency #dataretention

after questioned by Judge Rapporteur von Danwitz, Tele2: about 10.000 data request have been made to tele2. No overall statistic available #dataretention

von Danwitz to UK: Does DRIPA enable public authority to collect data from persons outside of the UK? #dataretention

UK: Scope of data retention of DRIPA applies to all data generated and processed in the UK #dataretention

v. Danwitz:"how far are we taking this logic that we don't know who will be a criminal tomorrow and therefore need all data?" #dataretention

v. Danwitz: "Isn't there always something more effective and also more intrusive? Where do we stop?" #dataretention

Advoc. General Saugmandsgaard to UK: can you be more precise to when general retention is indispensable? #dataretention

UK: retention of general data is vital to prevent terrorism and preventing crime but also for protecting people in general #dataretention

Advoc. General to Tele2: Are Swedish authority demanding you to secure data you would otherwise not acquire? #dataretention

Tele2: No, its data that is there, but would not be kept and deleted at once. #dataretention

Advoc. General to Sweden: Is there information about the misuse of this data retention? #dataretention

Germany: data retention is not useful if limited to specific geographical locations #dataretention

Sweden: The chancellor of the data protection agency must be informed of mistakes; here ex-post control is more efficient #dataretention

Tele2: All retention of data carries a risk of misuse, member states should look closely at what is stored and for how long #dataretention

Davis: Case regards the lack of safeguards. Access to data takes place in secret; high demands cannot be monitored adequately #dataretention

Davis: Although individuals can, it's unlikely they will bring a complaint if they don't know their information was accessed #dataretention

Sweden: if data retention is to be an effective measure in fighting crime it needs to be general by nature #dataretention

Session is closed. Advocate General opinion will be delivered on the 19th of July 2016. #dataretention

Minutes from EU Court of Justice on #CanadaPNR

On 5th April, I attended the oral hearing of the Court of Justice of the European Union (CJEU) on the draft agreement between the EU and Canada on the transfer, use, and retention of air passenger data (EU-Canada PNR agreement). The European Parliament has submitted this agreement to the Court in November 2014.

It was my first time at the Court, and the Grand Chamber is really impressive. However, I watched the hearing from the press room next door in order to be able to use the laptop and wifi.

Colleague Thomas van der Valk was also tweeting.

Here are my tweets in chronological order and with some typos corrected:

EU Court of Justice hearing on EU-Canada PNR agreement about to start. I'll tweet from there.

"The Court is in session". Two short judgements are announced first, then #CanadaPNR hearing in a few minutes. #CJEU
#CanadaPNR hearing started. First: legal service of @Europarl_EN, which submitted the agreement to the Court.
.@Europarl_EN: 2 questions: lack of data protection rights, wrong legal basis of the agreement. Candadian law only allows Canadians remedy.
 .@Europarl_EN questions compatibility with Art. 8 of the Charter of Fundamental Rights (data protection): independent oversight? #CanadaPNR

.@ThmsvdVlk is also live-tweeting from the #CanadaPNR hearing at the #CJEU. 

.@Europarl_EN: Article 47 of the Charter (judicial redress / legal remedies) not met with the PNR agreement?

.@Europarl_EN: Article 52 of the Charter (proportionality and necessity) not met either, see #dataretention judgement?
.@Europarl_EN lists the several typed of processing of PNR data: transfer, access, analysis, retention, onward transfer. #CanadaPNR
 .@Europarl_EN: systematic analysis of all passenger data (profiling) not yet covered by #CJEU case law such as #dataretention or #Schrems.
.@Europarl_EN: Canadian privacy Commissioner has been critical about large-scale PNR data analysis. "mega-data" not "meta-data" #CanadaPNR
.@Europarl_EN: PNR data will be transferred to US authorities under the "beyond the border" agreement, https://www.dhs.gov/beyond-border  #CanadaPNR
Now: Council legal service, defending the #CanadaPNR agreement. "@Europarl_EN also accepted PNR agreements with USA and Australia."
(Reason for @Europarl_EN to submit #CanadaPNR agreement was CJEU #dataretention judgement. It came after USA and Australia PNR agreements.)

Council now on legal arguments about opt-out options for Denmark, Ireland and UK, Court had asked about this as well. #CanadaPNR

Council: Canadian general law allows for legal remedies for anyone, not just people in Canada. #CanadaPNR 

Funny to see the @Europarl_EN agents sitting behind the Council agent who is speaking now. They shake their heads quite often. #CanadaPNR 

Council: Legal basis for #CanadaPNR agreement (Art. 82 TFEU, judicial cooperation) is correct, we maintain our position.

Council: @Europarl_EN did not contest same legal basis for EU-Australia PNR agreement. #CanadaPNR 

.@EUCouncil conclusion: All is fine with the #CanadaPNR agreement.

 .@EU_Commission quotes EU anti-terror coordinator: number of convictions based on PNR "irrelevant". Court had asked about those! #CanadaPNR

.@EU_Commission: The #PNR data is "anonymised" after 30 days. #dataretention judgement is not applicable here. #CanadaPNR

.@EU_Commission: #CanadaPNR agreement provides for legal remedies and independent oversight: Passengers can complain with EU DPAs.
.@EU_Commission: Dispute settlement mechanism in Art. 25 of #CanadaPNR agreement is sufficient. If no solution, EU DPAs can act, cf #Schrems
.@EU_Commission on legal basis: Art. 16 TFEU (#dataprotection) cannot ovver-rule all provisions on police / judicial cooperation. #CanadaPNR
.@EU_Commission: Existing data exchange agreements (Europol etc.) Can't out-rule this agreement, because we need data exchange #CanadaPNR
.@EU_Commission: Critical report by Canadian privacy commissioner shows that independent oversight works. #CanadaPNR

Some laughter in the press room on the last argument by @EU_Commission. (I am here, so I can use the laptop.) #CanadaPNR

Estonia starts their argument with an analogy of two piles of hay. Seems to boil down to "We can eat the cake and still have it". #CanadaPNR 

Estonia: #CanadaPNR data is limited. Helps police to determine criminal intent of travellers. #Schrems not comparable, based on 1995/46/EC.

Estonia: PRISM programme was covert, allowed unlimited data sharing. Completely different for #CanadaPNR: Protects against covert processing

Estonia: We can't limit (target) the amount of passengers, but the profiling limits the group of suspicious passengers anyway. #CanadaPNR 

Estonia: PNR data is broader than API (passport) data. But any border agent could ask you about your credit card number as well. #CanadaPNR 

Estonia: No reason to believe that Canada would process data without good faith. #CanadaPNR will pass #Schrems "eye of the needle" test.

Estonia: We cannot allow the risk of having potentially dangerous people board airplanes. #CanadaPNR is "unavoidably necessary".

Now Ireland on #CanadaPNR: International problems demand international responsed. Agreement is necessary.

Ireland: @Europarl_EN has agreed to PNR agreements with USA and Australia!

Ireland: Choice of legal basis important for us because of our opt-in choice for judicial cooperation. (We'll participate anyway) #CanadaPNR 

 Ireland: Data and number of people affected is much more limited than data in DRI and Schrems cases. #CanadaPNR 

Ireland: @Europarl_EN is endangering international cooperation by its challenge of #CanadaPNR.

Next in #CanadaPNR hearing is Spain: We must regard the specific circumstances of the #CanadaPNR case.

Spain: #dataretention period of 5 years is absolutely necessary for criminal investigations. #CanadaPNR 

Spain: Charter requirement of "independent" DPAs is different than "total independence" under 1995/46/EC. #CanadaPNR guarantees independence

(re last argument: #CanadaPNR is overseen in Canada by an ombudsperson, not by the Canadian DPA.)

After short break, now France on #CanadaPNR: Canada provides essentially equivalent data protection rights. PNR data not intrusive anyway.

France: Judicial approval of transfer of #CanadaPNR data would make the whole approach meaningless. Agreement necessary and proportionate.

Impression so far: Everybody refers to "necessary and proportionate", but hardly anyone except @Europarl_EN is giving criteria. #CanadaPNR 

France: Investigations into crimial networks take 4 to 5 years, therefore we need 5 years #dataretention. Useful. #CanadaPNR 

France: Terrorist groups exist some years before they actually become active. #CanadaPNR 

France insisting that recent CJEU and ECtHR case-law on mass surveillance was about communications, not PNR. #CanadaPNR 

Now UK, their agent in full "Queen's Counsel" style with a wig: We must check purpose, nature of data, safeguards. #CanadaPNR 

UK: There are things we know, and there are things we don't know. We need PNR data to find unknown terrorists and trafficers. #CanadaPNR 

RT @ThmsvdVlk:#CanadaPNR UK says it provided examples to Parliament. Anekdotal yes, not evidence. UK now again providing an example

UK: Use of term "profiling" by @Europarl_EN is wrong. PNR relates to travel pattern, not person's character. [well: "terrorist"?] #CanadaPNR 

UK: Vast majority of #CanadaPNR data will never be subject to human review, only sifted through by computers.

UK attacks @Europarl_EN legal service agent: "His assertions about Canadian law are just wrong".

UK repeats @EU_Commission: Critical report by Canadian DPA shows that independent oversight works. #CanadaPNR.

Last statement by @EU_EDPS, agent is @buchtan. Refers to PNR data demands by other countries, incl. Saudi-Arabia, Russia. #CanadaPNR 

.@EU_EDPS Art. 5 of #CanadaPNR agreement presumes adequacy for Canada without additional safgeguards. No judicial remedy for Europeans.

.@EU_EDPS argues that PNR data can as well be very intrusive, including revealing religious beliefs by means of food preferences. #CanadaPNR 

.@EU_EDPS: Use of #CanadaPNR data is about predictive policing, based on abstract definitions of what is "suspicious" & big data. Like US.

.@EU_EDPS Profiling of #CanadaPNR similar to "Rasterfahndung" (pattern searches) in DE after 9/11. Ruled out by consitutional court in 2006.

.@EU_EDPS dissects claims by Member States & Comission about oversight in #CanadaPNR. Not equivalent to independent authority, EU DPAs out.

Statements in #CJEU #CanadaPNR hearing are over. Thomas von Danwitz, judge rapporteur, now summarising for Q&A.

Danwitz: Passengers are not informed about collection & consequences when they book a flight. Therefore, #CanadaPNR implies purpose change.

.@EU_Commission: "As Article 11 of #CanadaPNR provides..." Danwitz: "We're still at the travel agency now, not in the agreement!"

.@EU_Commission: Well, that is far-fetched. Countries can demand anything from people entering their territory. #CanadaPNR 

Danwitz: DRI judgement requires clear guarantees for data subjects. Should #CanadaPNR data categories be clarified by law, not in annex?

Danwitz: What exactly does "frequent flyer information" mean? All my previous flights under a given loyalty programme? #CanadaPNR 

Danwitz: What does "etc." stand for in point 5 of #CanadaPNR agreement? Is that sufficiently precise?

.@Europarl_EN lawyers are cracking up in the background.

Danwitz now really grilling @EU_Commission on the #CanadaPNR annex. They already have two agents at the bar in order to deal with it.

.@EU_Commission: We were told that all the data can be used for finding terrorists or criminals. #CanadaPNR 

Danwitz: That's not my question. My question is about precision of the annex of #CanadaPNR, and "mandatory" vs "optional" data. Inequality?

Danwitz: Nothing in the #CanadaPNR agreement limits databases for cross-checking to Canadian databases. Is that correct?

.@EU_Commission: Data is used for profiling first, only suspicious data compared with other databases. Danwitz: It's not in the agreement!

Danwitz: The @EU_EDPS asked you to exclude sensitive data. No explicit exclusion in #CanadaPNR agreement, however. Reason (except "useful")?

.@EU_Commission: See Article 8. Danwitz: Hmh, ok.

Danwitz: Why do you not demand statistics in #CanadaPNR agreement, as in the EU directive? .@EU_Commission: Canadians still do statistics.

Danwitz: So you don't have any data on how many convicted passengers were, let's say, muslims? - No. #CanadaPNR 

Danwitz: Can all data be freely exchanged with other Canadian authorities, subject to Art. 18? - COM: Yes, but case-by-case only #CanadaPNR 

Danwitz: Should adequacy finding better be made by EU institutions (c.f. #Schrems), not negotiated with the third country? #CanadaPNR 

Danwitz: Art. 19 only limits 3rd country transfer for "Canadian Competent Authority". What about other Canadian authorities? #CanadaPNR 

Danwitz: The whole "a posteriori" approach of rights enforcement worries me. #CanadaPNR 

Danwitz: Could I object to the algorithm that sifted through my data? - COM: No. Danwitz: Why not? COM: "Prevention" #CanadaPNR 

Danwitz: Even when I leave Canada again, my data stays with their authorities for five years. Why? I have a difficulty with this. #CanadaPNR 

Danwitz: Are all 28 Mio passengers who go to Canada each year subject to such measures, even if completely unsuspicious? COM: yes #CanadaPNR 

#CanadaPNR hearing now into lunch break until 15:00. #CJEU

#CJEU #CanadaPNR hearing has started again. @EU_Commission to answer question from before lunch - "should we all be subject to surveilance"?

.@EU_Commission also now claims there is no "profiling". And then explains what kind of profiling is done with #CanadaPNR data. m(

.@EU_Commission to answer on lack of statistics on use of data, but merely makes false claims on "anonymous" and "deleted". #CanadaPNR 

Judge von Danwitz lectures COM that data are actually not "anonymised" after 30 days. "It bothers me when you're not precise" #CanadaPNR 

Danwitz: You could really anonymise data after 30 days. Or delete data of non-suspicious persons at after they leave Canada. #CanadaPNR 

Danwitz now lecturing on ECtHR case-law re possible discrimination of persons by data stored about them. #CanadaPNR 

Danwitz: Does the data "stigmatise" everyone or just some? That's the question. #CanadaPNR. Now questions from AG and other judges.

Now Paolo Mengozzi, advocate-general for this case, with questions on the legal basis of #CanadaPNR. "COM can rest, but just for a bit"

Council legal service on special carve-out protocols for UK, Ireland and Denmark on judicial cooperation. Q: Have they voted on #CanadaPNR?

AG Mengozzi with Q for COM: Why limitation on sensitive data only for "competent authority", not Canada as a whole? - COM: "..." #CanadaPNR 

Mengozzi: Why limitations for transfers to 3rd countries also only for "competent authority", and no limitations for recipients? #CanadaPNR 

.@EU_Commission: 3rd country authorities not really a concern for us, as they only receive already "filtered" data case-by-case. #CanadaPNR 

AG Mengozzi: "This seems absurd to me." Chance for survival of #CanadaPNR getting slimmer by the minute.

Mengozzi now with question to @Europarl_EN on #CanadaPNR: Legal basis: data protection or judicial cooperation? Could it be both? #CanadaPNR 

.@Europarl_EN: We think it's data protection (Art. 16 TFEU), but could be both. One reason we submitted #CanadaPNR to you.

Mengozzi: Article 4(1) of #CanadaPNR: "EU shall ensure air carriers are not prevented from transferring PNR data" But there are limits!

Mengozzi: Where does the /obligation/ for transfers come from then?#CanadaPNR 

.@Europarl_EU: Our problem is that we don't know Canada's or even the EU's interpretation of this. Canadian law not referenced. #CanadaPNR 

.@Europarl_EN: We also don't know who will be the supervisory authority / body in Canada either. Should be specified! #CanadaPNR 

.@Europarl_EN: Art. 4(1) would neutralise any EU data protection legislation with regards to data transfers. #CanadaPNR 

Judge Rosas to Council with question on legal basis: Should certain Member States vote on instruments that do not bind them? #CanadaPNR 

Council: Well, on the new #EUdataP directive for law enforcement, Denmark will vote, but still unclear if and how it is bound. #CanadaPNR 

Q: Has a link to the Schengen acquis been considered, including to cover Norway, Switzerland, Iceland? #CanadaPNR 

Council (other lawyer): Schengen link was not considered. Re DK, IE, UK: They are bound to a certain extent, therefore can vote. #CanadaPNR 

Judge Regan to @Europarl_EU: How do you reconcile your dataprotection arguments with your declared comittment to fight terrorism? #CanadaPNR 

.@Europarl_EU: You can have general #EUdataP rules, but you can also have special DP rules for anti-terror instruments. #CanadaPNR 

.@Europarl_EN: Look at Art. 5 #CanadaPNR: Canadian authoriy "is deemed to provide an adequate level of protection" - problematic!

Judge Rosa to COM: Which PNR data in the annex are sensitive? Art. 2(e) (sensitive data) doesn't refer to specific data types. #CanadaPNR 

.@EU_Commission: Only point 17, Special Service Request Information etc. Judge: How can we be sure none of the others? Unclear. #CanadaPNR 

Judge Rosas grilling COM now: Why is Art. 2(e) then not directly referencing point 17 of annex? #CanadaPNR 

Judge von Danwitz: What about point 18 annex? "API data collected for reservation purposes"? COM: No. Judge: How can we be sure? #CanadaPNR 

Closing statements now. .@EU_Commission, pretty deperate: Data protection must not turn into an area of fear! #CanadaPNR 

UK lawyer by far with strongest and most well-informed arguments in favour of #CanadaPNR. Must be the wig.

UK: WHole purpose of #CanadaPNR is to ensure that Canada has equivalent protections. Not to install EU DPA oversight over Candian DPA.

Advocate-General Paolo Mengozzi will present his opinion on #CanadaPNR on 30th June. Session is closed.

The @Europarl_EN inofficial twitter team says thanks for RTs and favs! #CanadaPNR @ThmsvdVlk

layers of the struggle privacy vs surveillance, in my picture of the year

This is the picture of the year for me, on so many different layers: 
Stewart Baker, ex-NSA general counsel, and Jacob Appelbaum, internet freedom activist/hacker/journalist (left, right).

• They pretty much symbolise the two sides of the global scandal of the year.
• They also symbolise the attitudes of both sides.
• This struggle has defined a large part of my professional life in 2013.
• I was involved in defining much of this struggle (at least on the EU Parliament side) as a large part of my professional life in 2013.
• I was on a panel with both of them yesterday, which was one of the most unlikely things I ever imagined in my life.
• This picture was one of the more unlikely pictures in my life of which I imagined to be there when they were taken. 
• But hey, I was involved in pulling that panel together.
• Most basic question that says it all: With whom of these guys would you prefer to hang out and collaborate and try to change the world? The answers to this one again can be on many layers, but they actually converge to the same answer.
• [fill in your own layer in the comments / shares] 

(picture by Omer Tene, who also moderated the panel) 

Update, 6 April 2014: Jake and Stewart now finally got into the heated discussion they were supposed to have back in December. 

EU Commission will link data retention reform to e-privacy reform in 2013

EU home affairs commissioner Cecila Malmström has announced in an interview with German newspaper Frankfurter Allgemeine Zeitung that she will not propose a revision of the notorious data retention directive this year. Instead, she will work with information society commissioner Neelie Kroes to review the e-privacy directive and the data retention directive together in 2013.

This is big news. Malmström and her services have been struggling with the data retention reform for almost two years. Now she and Kroes want to reform it together with the e-privacy directive in a package, both closing loopholes for further data use in the latter and reducing retention periods and police access in the former.

My reading is this: The liberal Malmström does not know how to get out of this data retention mess in one piece, with activists and "the internet" (c.f. ACTA) on one side, and home affairs ministers in Council on the other side. So she is now siding with Kroes in a hope to get anything agreed under the stewartship of an experienced telco regulator. They will try to ease industry opposition and in return get an okay for a limited version of data retention.

The big question is: How will this interact with the data protection reform package proposed by justice commissioner Viviane Reding in January? It was supposed to also amend and have an impact on the e-privacy directive with the data protection regulation for the internal market, and the proposed directive on data protection in the law enforcement field would need some rules on access of police investigators to corporate databases about their customers.

Time for some interesting coalition-building of institutional players, activists and lobbyists all across the field.

Competing schools in political science would suggest:

1. Whoever gets the major conflict lines and narratives set up first and firmly, will win (constructivism);
2. Whoever controls the institutional agenda, will win (institutionalism);
3. Whoever is in better understanding of economic and political interests, will win (realism).

And this finally reminds me of my academic years and also shows how unpredictable all of this is in theory. Think ACTA, again.