Sven Anderson writes:

Hi,

Karsten N. just sent to the German exitnodes list a link to an article, which is very convincing and legally well-founded (see below). It explains that any service that is being donated to the public, that is, without taking money or any other return service (like advertisements) for it, is _not_ obliged to retain any connection data! Furthermore, since there is no gray area, who isn't obliged to retain data is not _allowed_ to retain data, and can be charged with a fee up to 10.000 EUR for doing so!

I'm not a lawyer in Germany or any jurisdiction and I don't have any knowledge or opinion of the convincingness or legal well-foundedness of this article. I encourage anyone who might want to rely on it to seek the expert opinion of a German lawyer. But I do read German, so I've translated Karsten's note and (most of) the text of the article below for the benefit of anyone interested in this material who doesn't read German.

...

[translated] From: "Karsten N." <tor-admin@privacyfoundation.de> Date: 24. November 2008 10:26:02 CET To: exitnodes@lists.ccc.de Subject: no data retention for free of charge services

Hello Tor admins,

there's an interesting commentary on datenspeicherung.de concerning the retention obligations in B'113a of the TKG law.

http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fuer...

According to this, Tor nodes (specifically mentioned!) may not retain *any* data.

Karsten N.

NO DATA RETENTION FOR FREE-OF-CHARGE SERVICES Original German text of this article "Keine Vorratsdatenspeicherung fC<r unentgeltliche Dienste" is available at http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fuer... Copyright 2008 Patrick Breyer; licensed under Creative Commons BY-2.0 (Germany) license. http://creativecommons.org/licenses/by/2.0/de/ Translation by Seth Schoen. This text version omits hyperlinks to the German text of laws, treaties, and court decisions which appear in-line in the original German version. Beginning on January 1, 2009 at the latest, those offering certain publicly-accessible telecommunications services must store their users' traffic data (B' 113a TKG). This applies to providers of land line telephone services, mobile telephone services, Internet telephone services, e-mail, Internet access, and anonymizing services. However, it has thus far remained unnoticed that the obligation to store this data applies only to compensated or commercial services. Free-of-charge services do not have to store data. Indeed, data retention is forbidden to them under penalty of a fine. * Legal situation The obligation to retain data in Germany arises from B' 113a TKG. This rule is only applicable to "telecommunications services" [Telekommunikationsdienste]. According to B' 3 no. 24 TKG, "telecommunications services" are only "services normally provided for remuneration" [in der Regel gegen Entgelt erbrachte Dienste]. For clarification of this distinguishing criterion, we find in the explanatory statement of the corresponding bill: "This definition is in accordance with art. 2 letter c sec. 1 RRL". This refers to the EU Directive 2002/21/EC on on a common regulatory framework for electronic communications networks and services. This Directive defines as an "electronic communications service" [quotation from official English version] only "a service normally provided for remuneration" [quotation from official English version; German 'gewC6hnlich gegen Entgelt erbrachte Dienste']. The Commission had originally even wanted to include only "a service provided for remuneration" [gegen Entgelt erbrachte Dienste]. This was in accordance with the then-effective German telecommunications law of 1996, which was largely applicable only to "the commercial provision of telecommunication" [das gewerbliche Angebot von Telekommunikation]. The European Parliament asked, however, for a broadening of the framework directive to all services that are rendered "on a commercial basis" [quotation from official English version; German 'auf kommerzieller Basis']. For explanation it argued that "electronic communications services may be offered on an unremunerated, yet commercial basis" [quotation from official English version]. The Council finally decided on the current formulation, according to which all "services normally provided for remuneration" [gewC6hnlich gegen Entgelt erbrachte[n] Dienste] are included. The Council did not offer an explanation for this formulation. However, it is clear that as a compromise the definition of service provision fom the EC Treaty was adopted in full (EC Treaty article 50). The EC Treaty defines service provision in article 50 as follows: "Services shall be considered to be 'services' within the meaning of this Treaty where they are normally provided for remuneration, in so far as they are not governed by the provisions relating to freedom of movement for goods, capital and persons. 'Services' shall in particular include: (a) activities of an industrial character; (b) activities of a commercial character; (c) activities of craftsmen; (d) activities of the professions." [quotation from official English version] The distinguishing criterion "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] was thus adopted word-for-word in the telecommunications Framework Directive, which is also evident from the other translations of the Directive. This imitation of the EC Treaty was meaningful because the Framework Directive is founded upon the basis of the European Single Market powers of the EC. The EC may not regulate the provision of services other than those that are the subject of the Single Market. The definition of electronic communications services in the Framework Directive applies to data retention as well according to article 2, paragraph 1 of Directive 2006/24/EC. The data retention directive applies according to its article 3 only to "electronic communications services" [elektronische Kommunikationsdienste] in this sense. The Directive on data retention could not include other services because in any case it is founded on the basis of the Single Market powers (EC Treaty article 95) and may thereby only regulate the Single Market. The scope of B' 113a TKG is, in the end, consequently identical to the scope of EC Treaty article 50. The German legislature did not merely intend to take the definition of "telecommunications service" [Telekommunikationsdienst] in B' 3 TKG from EC law (see explanation). In this regard it also intended to implement data retention itself only in accordance with European legal requirements. This is clear from the title of the implementing legislation, but also from the rationale for the law (pages 30 and 69). The Bundestag wanted to require only those services (with the exception of anonymizing services) to retain data which it had to require to do so according to the EC Directive on data retention. The German Constitutional Court has ruled with regard to European arrest warrants that European legal requirements must be implemented as narrowly and compatibly with basic rights as possible. In the application of implementing laws, a construction compatible with basic rights should also be taken. A constitutionally compatible construction of B' 113a TKG requires that data retention b to avoid breaching German basic rights and the rule of proportionality b not be expanded beyond what is necessary as a matter of European law. * Precedent on the defining criterion "normally [provided] for remuneration" [in der Regel gegen Entgelt] Many decisions of the German court have been issued on the question of when a service is "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. In the leading decision "Humbel" from 1988, the Court decided: "According to article 60, para. 1 of the EEC Treaty, only 'services that are normally provided for remuneration' [quotation from official English version; German 'Leistungen, die in der Regel gegen Entgelt erbracht werden'] fall under the chapter on services. Even if the term 'remuneration' [Entgelt] has not been expressly defined in articles 59 and following of the EEC Treaty, its meaning can be inferred from article 60, para. 2 of the EEC Treaty, according to which, in particular, industrial, commercial, craft and professional activities count as services. The essential feature of remuneration [Entgelt] is thus that it shows the service provided in return for the service concerned, in which the service provided in return is normally agreed between the service provider and the recipient of the service." In subsequent decisions, the court has clarified that such a service in return can also be deemed to occur if it is paid for by a person other than the recipient. Thus private television broadcasting is regarded as a service provided for remuneration [gegen Entgelt erbrachte Leistung], because it is paid for through advertising. Indeed, one can regard private television broadcasting as a commercial service [entgeltliche Leistung] for the advertising purchasers, which serves to draw viewers for the commercials. The court has also considered the services of hospitals as furnished for remuneration [gegen Entgelt erbracht], since the hospitals are financed by health insurance companies b although in the form of standard flat rates. Now it is important that the court takes particular services into account. The criterion "normally" [in der Regel] thus does not go so far as to make a single category dispositive of all services. Rather, the court determined with regard to universities, for instance, that the freedom of services had no application to public, tax-supported universities, but that it did apply to private colleges. It is thus critical whether the particular provider offers his service "normally for remuneration" [in der Regel gegen Entgelt] or not. The service must be assigned according to EC Treaty article 2 to "economic activities" [quotation from original English version; German 'Wirtschaftsleben']. In the case of public schools, the court established that their public funding still did not establish a remunerated service [entgeltliche Leistung]. The public financing did not constitute a service directly provided in return for a service rendered. Even a mandatory levied tuition fee does not constitute a remunerated service [entgeltliche Leistung], so long as the institution is funded substantially by public means. That a service (necessarily) must be funded in one way or another, then, still does not make it a remunerated service [entgeltliche Leistung]. The funding must rather be able to be regarded as provided directly in return for the service [gerade als Gegenleistung fC<r den Dienst]. * Application to data retention obligations For telecommunication services and the obligation to retain data the following thus apply: Services that are financed essentially by something provided in exchange [Gegenleistungen] by the user are in any event normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Such services must thus retain data. Those services that are financed essentially by accepting advertising b such as banner ads b and that are run for profit are also normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Thus, for example, the commercial free e-mail services must store data, even if their users don't have to pay a subscription fee [Entgelt]. On the other hand, services that are provided for nothing substantial in exchange [keine wesentliche Gegenleistung], either by their users or by their parties, are normally provided for no remuneration [in der Regel unentgeltlich erbracht]. For instance, a private party may provide a free e-mail service, an open wireless network providing Internet access, or a Tor server for no compensation [unentgeltlich] and financed with his own means, and then no telecommunications service normally provided for remuneration [in der Regel gegen Entgelt erbrachter Telekommunikationsdienst] exists and the data retention obligation according to B' 113a TKG does not apply. Government services are also normally not provided for compensation [in der Regel unentgeltlich erbracht]. Many local authorities, for example, provide free Internet access or e-mail accounts. These essential tax-financed services are exempt from data retention. This is even true if a service charge is levied on the user, but the charge only defrays a small part of the costs. This situation should not be considered as different from the imposition of tuition fees or charges, concerning which the European court has already ruled. Correspondingly, even a private noncommercial service [unentgeltlicher Dienst] does not always lose its noncommercial character [unentgeltlichen Charakter] by collecting a service charge or showing commercial advertising, as long as accepting these makes up only a trivial share of the cost of the service. Whoever wants to be confident in being exempt from the obligation to retain data should, however, forego such sources of funding entirely. Services that are offered by noncommercial providers (for example, by individuals or organizations) without a profit motive, but that recoup their costs essentially by payments from users or advertising customers, will be regarded as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. After all, the requirement "for remuneration" [gegen Entgelt] does not require any profit motive. Accordingly, the European court has regarded private schools or hospitals as commercial providers [entgeltliche Anbieter], even though they have no profit motive. Thus even noncommercial services fall under the data retention requirement if they are provided for remuneration [gegen Entgelt erbracht]. The treatment of services whose costs are actually essentially borne by private individual means, but which are offered as "additional" services by commercial providers, is unclear. For example, some firms offer, in addition to their paid services, a free public webmail service. The question is whether the self-promotion, that is to say the publicity for a commercial offering of the same firm, should be seen as a form of compensation for the ostensibly free service [ein Entgelt fC<r den an sich kostenlosen Dienst]. EC Treaty article 50 particularly includes industrial services, and a commercial firm always has a profit movie. In this connection, the court has decided with regard to tobacco advertising that commercial advertising falls within the scope of the Single Market. Uncompensated services [unentgeltliche Dienste] of a commercial firm are thus to be viewed as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] if they serve as advertising for compensated products [entgeltliche Angebote] of the firm. With regard to commercial firms, a certain appearance argues that their services in the end promote their own profit motive. Nonetheless an individual service of a commercial firm need not serve as advertising for the firm's own compensated products [entgeltlichen Angebote]. For instance a noncommercial offering [unentgeltliche Angbot] may be clearly separate from the commercial operation [gewerblichen TC$tigkeit] of its provider, in that it for example is delivered through a separate portal without any self-promotional materials; then a product normally provided without remuneration [in der Regel ein unentgeltliches Angebot] will exist, which does not fall under data retention requirements. If, on the other hand, the uncompensated service is embedded in the commercial appearance of the firm, normally a publicity interest and thereby a compensated product will be presumed. In summary, we should note that those services that are essentially funded by private means and that also do not serve as advertising for paid services are exempted from the obligation to retain data. For instance, when an individual person offers an e-mail service, a public wireless LAN with Internet access, or a Tor server without being paid for it, and he essentially funds from his own resources and not by receipts from its users or advertising customers, the data retention obligation according to B' 113a TKG does not apply. * Prohibition on data retention by non-commercial services Uncompensated services are not only excepted from the obligation to retain data. Their providers may also not "voluntarily" retain data. This results from B' 96 para. 2 TKG, according to which traffic data must be erased immediately after the end of the connection, if they are not "necessary for the purposes established through [...] legal requirements" [fC<r die durch [...] gesetzliche Vorschriften begrC<ndeten Zwecke erforderlich]. This obligation to erase data applies to all businesslike providers of telecommunications services [geschC$ftsmC$Cigen Anbieter von Telekommunikationsdiensten]. According to B' 3 TKG, these are all providers of telecommunications, even if their offering is uncompensated [unentgeltlich]. That "voluntary" data retention, as some Internet service providers currently practice it, may also not be done on "security grounds" according to B' 100 TKG has already been explained in more detail elsewhere. Whoever violates the prohibition on data retention in B' 96 TKG is acting illegally and can be punished with a fine up to ten thousand Euro by the Federal Network Agency (B' 149 para. 1 no. 17 TKG). Anyone may file a complaint. However, someone who is required to retain data and does not do so is also acting illegally. Each provider of telephone service, e-mail, Internet access, or anonymizing service should thus make sure that he acts correctly. In case of doubt, he should ask the Federal Network Agency. * Non-public services Data retention applies only to services that are publicly available (B' 113a TKG). This is an independent restriction in addition to the commercialness discussed above. The data retention obligation thus applies only if a service is both normally provided for remuneration and also publicly accessible. If either of these two criteria is not met, data retention is not applicable and is forbidden. A service is publicly available if anyone b and not just specified groups of users b can use it. The availability of a service only to members of an organization doesn't affect the public availability of that service if anyone can become a member of the organization. Non-publicly-accessible services, by contrast, are those offered, for instance, by employers or universities, since these can be accessed only by a limited group of people. These providers are neither required nor authorized to retain data. [Final section ("AusweichmC6glichkeiten fC<r entgeltliche Dienste") omitted from this translation; it describes a procedure for commercial services to try to obtain a financial indemnity or exemption from the government while the constitutional challenge to the data retention law is pending, by writing a letter to the Federal Network Agency. This letter would demand that that agency temporarily exempt commercial service providers from implementing data retention or else promise to reimburse the service providers for their implementation costs in case the German constitutional court rules data retention unconstitutional or in case it rules that the government must pay implementation costs.] -- Seth Schoen Staff Technologist schoen@eff.org Electronic Frontier Foundation http://www.eff.org/ 454 Shotwell Street, San Francisco, CA 94110 1 415 436 9333 x107 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE