French Employers Who Provide Staff with Internet Access Are Held to the Same Data Retention Obligations as ISPs

The 1997 Telecommunications Privacy Directive¹ provided that EU Member States² had the possibility, but not the obligation, to require telecom operators to retain communication data arising out of the use of the telecommunications system for law enforcement purposes. That Directive was replaced by the 2002 Electronic Communications Directive³ in order to adapt the EU legal regime to technical developments such as the growth of the Internet. The new Directive extended the scope of the 1997 Directive by explicitly allowing EU countries to compel telecom and Internet service providers (ISPs) to record and store traffic data under certain circumstances. National laws must, however, (a) ensure that the data are only retained for a limited period of time; (b) aim to achieve specific, enumerated "public order" purposes; (c) be necessary, appropriate, and proportionate within a democratic society for achieving these purposes; and (d) be consistent with the European Convention on Human Rights.