Austria

[AT] Telecommunications Act Draft Amendment on Data Retention

IRIS 2010-9:1/11

Sebastian Schweda

Institute of European Media Law (EMR), Saarbrücken/Brussels

On 26 July 2010, the Austrian Ministry of Transport, Innovation and Technology tabled a new draft amendment to the 2003 Telekommunikationsgesetz (Telecommunications Act - TKG), under which the data retention obligations set out in Data Retention Directive 2006/24/EC would be transposed into Austrian law.

The 16-page document takes into account almost 190 comments received by the ministry after the bill was published in autumn 2009 (see IRIS 2010-2: 1/4). The most significant changes are a provision on data protection for persons required to keep professional secrets and the extension of access for security services for the purposes of warding off danger.

The newly added Article 93(5) is designed to ensure that press secrets, protected under Article 31 of the Mediengesetz (Media Act), remain protected, and that other secrecy obligations, such as those of lawyers or doctors, which justify the refusal to give evidence in criminal proceedings under Article 157 of the Strafprozessordnung (Code of Criminal Procedure - StPO), cannot be circumvented by means of data retrieval. The bill authorises the creation of an independent body which, using an automated system, can render such information anonymous. The provision prohibits access to the data of persons required to keep professional information confidential secret, unless they themselves are the subject of the investigations.

In the new draft, the possibilities for accessing data have been extended in two respects. Firstly, criminal prosecution authorities will be able to access data relating to an Internet connection - for a maximum of three months after the communication concerned - for the purposes of investigating and prosecuting non-serious crimes. As a result, such data could particularly be used in a legal action against copyright infringements on the Internet. Secondly, the access granted to security services will no longer, as originally planned, remain limited to cases in which it is required to avert a concrete danger to life and limb. Rather, such services will now be allowed to access traffic, master and location data without a court order when there is a concrete danger to freedom and in order to ward off danger caused by a dangerous attack in accordance with Article 16 of the Sicherheitspolizeigesetz (Police Act - SPG). This represents a significant increase in access compared to the current rules.

In several places, it is noticeable that the draft closely follows parallel developments in Germany. At various points, footnotes refer to the decision of the German Bundesverfassungsgericht (Federal Constitutional Court), such as in relation to the practical implications of the provisions on guaranteeing data security (see IRIS 2010-4: 1/12).

Even after the publication of this new draft, the transposition process in Austria remains in its early stages: for some provisions, a two-thirds majority is required, since they would require the Constitution to be amended. Amendments to the StPO and SPG are also necessary, partly in order to define what constitutes a "serious criminal offence" in the sense of the amended TKG. In addition, the provisions cannot enter into force until nine months after they are adopted, in order to allow enough time for operators to make technical adjustments and for amended decrees on the reimbursement of costs to be adopted.

During the Austrian legislature's efforts to bring the data retention obligations into line with the Directive at the second attempt - after the 2007 draft had hit obstacles - the EU member state was found guilty by the ECJ after the Commission brought an action for an infringement of the Treaty. The Court ruled that the deadline for transposing the Directive had been missed. Even so, the Minister for Transport, Innovation and Technology does not want to present the bill to Parliament until 15 September 2010, the day on which the Commission has announced that it will publish its report on the evaluation of the Directive.