Made in accordance with Article 3(6) of the Statute of the European Ombudsman[1]

The background

1. On 19 February 2010, the complainant, a German national, complained to the European Commission that Germany had not properly implemented the ePrivacy Directive[2] (the 'Directive'). He identified three infringements. Firstly, he argued that the relevant German legislation - the Telekommunikationsgesetz (TKG) and the Telemediengesetz (TMG) - does not provide for as comprehensive a duty to inform users of the data stored in relation to them as the Directive does. More specifically, the storage of data or access to information saved on a device (known as 'cookies') is not conditional on having informed the user of the possibility of such storage or access. Secondly, the complainant contended that Article 100 of the TKG allows data to be stored generally, not only exceptionally, and thus breaches Article 15(1) of the Directive. Article 15(1) provides that any legislative measure restricting the scope of the rights and obligations provided for in the Directive must constitute "a necessary, appropriate and proportionate measure within a democratic society". Thirdly, according to the complainant, the German rules on e-mail marketing are more permissive than those contained in the Directive.

2. On 31 January 2011, the Commission sent a 'pre-closure letter' to inform the complainant that it intended to close the case. Firstly, it considered that Germany had properly implemented the Directive: the TMG states that users have to be informed about the manner and purpose of any collection and processing of personal data, and the definition of personal data under German law is sufficiently broad to ensure adequate protection. Secondly, as regards the storage of user data, the relevant German law allows the processing of data only in order to combat abuse, based on the principle of necessity. This is in line with Article 4 and recital 29 of the Directive, which call for measures to ensure the security of the service, and allow the processing of billing data to combat any abusive use of the services. Thirdly, the German law against unfair competition (Gesetz gegen unlauteren Wettbewerb - UWG) provides that e-mail marketing must be limited to e-mail addresses obtained in the context of the sale of a product or service and to clients expressly informed that they may object to the use of their e-mail addresses.

3. The complainant objected to the Commission's analysis. Firstly, under the Directive, if a user is not fully informed, the storage of connection data is invalid, but there is no such provision in the TMG. Secondly, Article 6 of the Directive is the only legal basis for the processing of traffic data. Therefore, Article 4 and recital 29 are irrelevant. Thirdly, the TKG is more specific than the UWG and therefore overrides the latter.

4. On 18 April 2011, the Commission informed the complainant that since he had not provided any new facts which could have led the Commission to reconsider its position, it had closed the case on 7 April 2011.

5. Shortly thereafter, the complainant turned to the European Ombudsman, alleging that the Commission had not dealt with his infringement complaint properly, and claiming that it should do so. The Ombudsman opened an inquiry[3].

Alleged failure to handle the infringement complaint properly and related claim

6. In its opinion, the Commission referred to the analysis in its pre-closure letter, in which it had concluded that Germany had adequately transposed the Directive. It had therefore decided not to commence infringement proceedings. The pre-closure letter had in fact already addressed most of the arguments the complainant raised in his replies. It had rejected the complainant's argument on the 'cookie' provision, and had already dealt with the complainant's criticism of its reliance on Article 4 and recital 29 in the pre-closure letter. The Commission added that the complainant's view on the relationship between the TKG and the UWG was based on his personal interpretation of the law, an interpretation it had also already rejected in its initial assessment.

7. The Commission underlined that, in accordance with established case-law[4], it enjoys a large discretion as to whether to commence infringement proceedings and bring an action before the Court, which does not "leav[e] any room for third party interference"[5].

8. In his observations, the complainant maintained that the Commission had not sufficiently reasoned its decision to reject his infringement complaint. In particular, the Commission had not addressed his argument that the TMG, contrary to the requirement of the Directive, failed to provide that storage of connection data is invalid except where the user is fully informed. Nor had it addressed his argument that a recital could not be relied upon to justify limitations of fundamental rights, that Article 6 had conclusively determined the question of the processing of connection data, and that the limitations laid down in recital 29 were not found in the German legislation. He added that he had raised some new issues in an e-mail he sent the Commission on 25 May 2011, and had asked it to re-open the case. The Commission failed to mention this in its opinion. The complainant pointed out that Article 5(3) of the Directive had in the meantime been modified. In his e-mail, he had drawn the Commission's attention to the fact that, as regards the first aspect of his complaint, the deadline for the implementation of the new version of Article 5(3) of the Directive had already expired, without Germany having adopted any implementing measures[6]. As regards the second aspect, the complainant had referred to a judgment of the German Bundesgerichtshof [7] which, according to him, confirmed his views. Similarly, on the third aspect of his complaint, he had pointed out that the relevant national regulatory authority shared and endorsed his interpretation of the relationship between the TKG and the UWG.

The Ombudsman's friendly solution proposal

9. The Commission enjoys wide discretion when deciding whether to commence infringement proceedings against a Member State. However, like any public authority, it must always have good reasons for choosing one course of action rather than another, and it must explain those reasons[8].

10. In its pre-closure letter, the Commission explained why it found no grounds for further action. However, when the complainant submitted further arguments, the Commission confined itself to stating that the complainant had not submitted any "new facts" which would lead it to reconsider its analysis. The Commission did not provide any explanation or reasoning to justify this position.

11. As regards the first aspect, the Commission did not sufficiently address the complainant's argument that Germany had not implemented the revised version of Article 5(3) of the Directive. As regards the second aspect, Article 4 and recital 29 of the Directive had been mentioned by the Commission itself. The Ombudsman therefore could not follow the Commission's view that it had already dealt with the complainant's arguments concerning these points. Similarly, as regards the third aspect, the question whether the UWG applies in relation to e-mail marketing rules was first raised by the Commission and the complainant only subsequently set out his views (and that of the Bundesnetzagentur). Thus, the Ombudsman could not comprehend the Commission's view that the complainant had not raised new facts.

12. The Ombudsman considered that the Commission's actions were not in line with its Communication on relations with complainants[9] according to which the Commission first writes a "letter setting out the grounds on which it is proposing that the case be closed" (the pre-closure letter) and gives the complainant four weeks to comment upon it. The Communication goes on to state that if these observations do not "persuade the Commission to reconsider its position", it can then decide to close the case. The Commission should thus at least have addressed the complainant's arguments and explained why they were insufficient to induce it to change its views. Otherwise, the request for observations would not serve any useful purpose. The Ombudsman therefore made the preliminary finding that this failure could constitute an instance of maladministration and proposed that the Commission consider addressing in more detail the arguments which the complainant submitted in response to its pre-closure letter, in particular, the further arguments and evidence put forward in the complainant's e-mail of 25 May 2011.

13. In its reply, the Commission stated that it accepted the Ombudsman's proposal for a friendly solution and that it had therefore decided to address the complainant's additional observations of 25 May 2011.

14. In relation to the first aspect (the requirement to inform users that data are being stored) and in particular the complainant's argument that the transposition deadline for the revised Article 5(3) of the Directive had expired without Germany having adopted sufficient implementing measures, the Commission stated that, on 10 May 2012, Germany notified it that it had transposed Directive 2009/136,[10] which revised Article 5(3) of the Directive. As regards the second aspect of the complaint (the storage of collected data), the Commission explained that it disagreed with the complainant's view that Article 6 of the Directive "conclusively determine[d]" how connection data could be processed and maintained its assessment that Article 4 allowed for the retention of traffic data. Moreover, it disputed the complainant's view that fundamental rights were being limited. The Commission agreed that the recital was not legally binding as such, but noted that it did provide an insight into the legislator's intention, in a way which supported the Commission's position and the objectives pursued by the relevant German law. Finally, the Commission did not consider that the judgment of the Bundesgerichtshof which the complainant referred to had any "substantive effect on the present case". As concerns the third aspect (the rules on e-mail marketing), the Commission maintained its view that Article 13(2) of the Directive had been correctly transposed into German law. It added that the complainant's e-mail exchange with the Bundesnetzagentur did not change this assessment.

15. The complainant disagreed with this analysis.

16. He pointed out that the Commission had merely stated that Germany had informed it that it had transposed the amended Directive. However, the fact that the Member State concerned had notified implementing measures was not sufficient. If the Commission had properly analysed the matter, it would have realised that the relevant German law did not deal with the question of cookies at all and thus that, clearly, Germany had not yet fulfilled its obligations. In fact, according to the German data protection supervisor, the European rules on cookies had to be given direct effect because Germany had not properly transposed them into German law. The complainant concluded that the Commission had not been able to identify a provision which could be considered to have transposed Article 5(3). Moreover, it had taken several other Member States to Court on this matter, but not Germany.

17. The complainant also disagreed with the Commission's view that Article 4 of the Directive allows traffic data to be retained for up to six months. He stated that Article 6 of the Directive sets out the principle that traffic data should be deleted. It allows for certain exceptions, but the aims mentioned in Article 4 were not among them. In any event, it was clear to the complainant that the German rule which allows the retention of data for technical reasons (rather than for serious reasons such as the prevention of serious crime) is too general to be considered proportionate. Finally, recital 29 envisages the retention of data only "in individual cases" whereas the German law permits the retention of traffic data across the board. The complainant suggested that the Commission consult the EDPS and the Article 29 Working Group[11], before adopting as "sweeping and legally questionable" an interpretation of Article 4 as it had done.

18. Finally, in relation to the third aspect, the complainant noted that the Commission had relied exclusively on the opinion of the German government and had ignored the view of the authority competent to monitor the law that transposed the Directive into German law. He invited the Ombudsman to make another proposal for a friendly solution, given that the first one had prompted the Commission to at least consider his arguments.

The Ombudsman's assessment after the proposal for a friendly solution

19. It is clear that, following the Ombudsman's proposal for a friendly solution, the Commission provided a much more detailed explanation of the reasons why it considers that no further action on the complainant's infringement complaint is needed. It is also clear that the complainant still disagrees with the Commission's view that Germany has properly implemented the Directive.

20. Good administration requires that complainants be informed of the reasons that led the Commission to close an infringement procedure. Those reasons must not only be correct, but they must also be clear and unequivocal. By providing an adequate explanation for its discretionary decisions, the Commission can improve relations with citizens, increase its legitimacy and strengthen its effectiveness as guardian of the Treaties. The Ombudsman will thus examine whether the Commission has provided a sufficiently detailed and reasonable explanation for its decision not to pursue the complainant's infringement complaint.

21. In relation to the first aspect, the Ombudsman notes that the Commission simply relied on the fact that Germany had informed it that it had transposed the revised version of Article 5(3) of the Directive into national law. However, and as the complainant rightly pointed out, the fact that a Member State has notified measures transposing a Directive does not mean that it has properly implemented it. It would be reasonable to expect that the Commission would have pointed to a specific provision, in a specific law, which in its view transposed the amended provision of the Directive into German law. The Commission has therefore not adequately explained why it is of the view that Germany has properly implemented the Directive.

22. As regards the second aspect of the complaint, the complainant alleged that Article 100 of the TKG breaches the Directive by being too general. Article 100 of the TKG gives data providers the right, where there is sufficient evidence of abuse or fraud, to refer to saved connection data that are less than six months old in order to pursue such matters. The Commission, on the contrary, argued that this provision was "based on the principle of necessity" and implemented aims mentioned in Article 4 and recital 29 of the Directive, namely, to safeguard the security of services and to detect and stop fraud consisting of unpaid use of the electronic communications service, respectively.

23. The Commission's view that the rules on the storage of data criticised by the complainant in the second aspect of the complaint do not limit fundamental rights is surprising, given the content of Articles 7 (on the right to privacy) and 8 (on the protection of personal data) of the Charter of Fundamental Rights of the EU, and in particular bearing in mind the recent judgment of the Court of Justice[12] which annulled the Data Retention Directive[13] for entailing a "wide-ranging and particularly serious interference with those fundamental rights [namely, the right to privacy and the protection of personal data] in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary"[14]. Moreover, the Commission has not explained why it considers that the judgment of the Bundesgerichtshof (which deals with the scope of Article 100 TKG in relation to the storage of IP addresses) has "no substantive effect" on the present case. The Commission's explanations on this matter are thus not sufficiently convincing.

24. As regards the third aspect, the Commission had argued that Article 7 of the UWG, which Germany notified as part of the measures taken to transpose the Directive into national law, was applicable to the matter. However, the complainant informed the Commission that the Bundesnetzagentur, which was charged with implementing the transposed rules in practice, did not agree with this view. The Commission dismissed the relevance of this fact. However, it is clear that, where the legislator takes one view and the administrative authority entrusted with executing the relevant legislation takes another, citizens are likely to face legal uncertainty as regards the proper transposition and application of EU law by a Member State. In the absence of any meaningful explanations provided on this issue by the Commission, it is not clear why the latter maintains its view that there is no infringement of EU law and thus no reason for it to intervene.

25. In light of the above, the Ombudsman finds that the Commission has not adequately explained its decision to reject the complainant's infringement complaint. This constitutes an instance of maladministration. She therefore makes a corresponding draft recommendation below, in accordance with Article 3(6) of the Statute of the European Ombudsman.

The draft recommendation

On the basis of the inquiry into this complaint, the Ombudsman makes the following draft recommendation to the Commission:

The Commission should either resume its investigation into the infringement complaint submitted to it by the complainant or provide adequate explanations to justify why it considers that no further action is needed.

The Commission and the complainant will be informed of this draft recommendation. In accordance with Article 3(6) of the Statute of the European Ombudsman, the Commission shall send a detailed opinion by 31 August 2014.

 

Emily O'Reilly

Done in Strasbourg on 21 May 2014

---

[1] Decision of the European Parliament of 9 March 1994 on the regulations and general conditions governing the performance of the Ombudsman's duties (94/262/ECSC, EC, Euratom), OJ 1994 L 113, p. 15.

[2] Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ 2002 L 201, p. 37, last amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, OJ 2009 L 337, p. 11.

[3] For further information on the background to the complaint, the parties' arguments and the Ombudsman's inquiry, please refer to the full text of the Ombudsman's friendly solution proposal available at http://www.ombudsman.europa.eu/en/cases/correspondence.faces/en/54437/html.bookmark

[4] In this regard, the Commission referred to Case C-207/97 Commission v Belgium [1999] ECR I-275, paragraph 24.

[5] The Commission cited Case C-236/99 Commission v Belgium [2000] ECR I-5657, paragraph 28, and referred to Case C-383/00 Commission v Germany [2002] ECR I-4219, paragraph 19.

[6] The new version which the complainant refers to was introduced by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws. The deadline for transposing this amendment was 25 May 2011.

[7] Namely, the decision of 13 January 2011, III ZR 146/10, Speicherung dynamischer IP-Adressen..

[8] See the Ombudsman's decision closing the inquiry into complaint 995/98/OV.

[9] Commission communication to the European Parliament and the European Ombudsman on

relations with the complainant in respect of infringements of Community law (COM(2002) 141 final), OJ 2002 C 166, p.3. Since the opening of the present inquiry, this has been updated by the Communication from the Commission to the Council and the European Parliament updating the handling of relations with the complainant in respect of the application of Union law of 2.4.2012 (COM(2012) 154 final).

[10] See footnote 6 above.

[11] The complainant is referring to the "Article 29 Data Protection Working Party" which is an independent advisory group set up under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). It is composed of representatives of the relevant supervisory authorities of each Members State of the EU, a representative of the EDPS and a representative of the European Commission.

[12] Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others, judgment of 8 April 2014, not yet published in the ECR.

[13] Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ 2006 L 105, p. 54.

[14] Paragraph 65 of the judgment cited in footnote 12 above.