Last week, the German Constitutional Court issued a much-anticipated decision, striking down its data retention law as violating human rights. It was an important victory for Europe’s Freedom Not Fear movement, which was formed to oppose the EU Data Retention Directive. But it was also a reminder of the political work which remains to be done to defeat it.

When the European Union first passed the Data Retention Directive in 2006, despite a hard-fought campaign by European activists, it seemed like the beginning of the end for Internet privacy. The directive sought to require telecommunications service providers operating in Europe to retain a detailed history of each of their customers' activity for up to 2 years for possible use by law enforcement; including phone calls made and emails sent and received.

The response from European citizens was swift and outraged. Under the banner of Freedom Not Fear, mass protests were held in cities all across Europe and beyond. The charge was led by the German Working Group on Data Retention (AK Vorrat), which in 2007 filed a class-action lawsuit of nearly 35,000 people challenging the German law.

The suit's complaints were mostly upheld by last week's German Constitutional Court decision. The court held that the blanket data retention mandated by the EU directive violated Article 10 of the German Constitution, which guarantees the basic right to private life and correspondence. The Court said that an infrastructure of exploratory surveillance results in an exceptional intensity of interference with human rights, which must be proportionately protected with appropriate safeguards. It also significantly narrowed the options for similar EU retention laws on other types of data. The court ordered the immediate deletion of all the data stored since the law went into effect in 2008 and ordered the suspension of data collection until a revised national law is proposed.

However, the court did choose to leave many important questions about the EU directive unanswered. In highlighting the need for increased safeguards, the court failed to recognize that the storage of data itself is what violates human rights. For instance, a survey of German citizens in 2008 found that 1 in 2 people would not have conversations with counselors or therapists by phone or email because of their concern about data retention.

A bolder stance was taken in October 2009 by the Romanian Constitutional Court, which ruled that the EU directive fundamentally violated Article 8 of the European Convention on Human Rights, which guarantees the right to respect for private life and correspondence. Data retention itself, the court wrote, is "likely to overturn the presumption of innocence and to transform a priori all users of electronic communication services or public communication networks into people suspected of committing terrorism crimes or other serious crimes." As a result, all citizens would become "permanent subjects to this intrusion into their exercise of their private rights to correspondence and freedom of expression."

The rulings in Romania and now Germany set the stage for an imminent series of decisions on the status of national data retention laws across Europe. The recent Bulgarian vote on data retention legislation met with sharp criticism and protests. Petitions against the Belgian data retention law are available in both French and Flemish. The constitutional challenge against the Retention of Data Bill brought by Digital Rights Ireland may be referred to the European Court of Human Rights. In the meantime, despite the fact that the European Commission won its lawsuit against the government of Sweden for failing to implement the directive, the minimal penalty turns out to be worth the political risk.

In order to overturn a directive, the European Commission, Parliament, and Council have to agree. Viviane Reding, the incoming European Commissioner for Justice, Fundamental Rights, and Citizenship, declared at her confirmation hearings her dedication to defending the right to privacy. The members of the European Parliament, inaugurating their new term, flexed their political muscle when they recently rejected assenting to the SWIFT agreement that would have enabled the wholesale transfer of Europeans' financial data to the US. The European Council, representing the ministries of the individual Member States, will respond to the political climate in their home countries.

All in all, the threats to privacy and free speech posed by the Data Retention Directive are on their way to being nullified. In Germany, AK Vorrat launched its campaign against the new law being devised and set its sights on ending data retention on the European level. They will need the help of citizens across Europe to raise awareness and speak out for their rights on national levels.

Freedom Not Fear is planning another series of protests later this year – stay tuned to Deeplinks or sign up for FNF's mailing list to find out what is being planned near you.