I. Introduction

The term data retention can generally be defined as “the collection and storage of personal data for an undetermined purpose in the event that it should ever be needed for not yet specified future use.”¹ Its notoriety stems from a – more than decade-long – legal dispute between EU Member States and the European Court of Justice (ECJ). The story really began in 2006, when the EU obligated its Member States to set up or align laws on retention of telecommunication traffic data via a directive.² Providers of electronic communication, including internet access and internet telephony, were thereby forced to retain traffic data (who called who, when, and from where?) of their customers for six months and to make them accessible to state security authorities.

As is known, the ECJ was not happy with this directive. In the Digital Rights Ireland judgment of 2014, the Court found that the massive retention of data without specific cause would constitute a disproportionate interference with the rights of private life and data privacy, Arts. 7 and 8 of the Charter of Fundamental Rights of the EU, and thus revoked the directive.³ Subsequently, some Member States argued that the judgment would not affect respective norms in domestic law and kept their retention obligations.⁴ Inevitably, the ECJ had to decide on these national data retention laws as well. It took the opportunity to affirm its case law, in principle, but specified it in two consecutive judgements, Tele2 Sverige⁵ and La Quadrature du Net.⁶

The findings of the Court regarding the conditions for data retention can be briefly summarized as follows:⁷ Principally, data retention must be viewed as a two-stage process. First, there is a legal obligation, mainly for private actors, to store a bulk of data for a specific period of time. The second stage comprises the legal provisions that enable state authorities to access these data. Both elements independently interfere with fundamental rights to privacy.⁸ Therefore, there must be safeguards for each stage.⁹ As of now, a general retention of data is only permissible if a Member State is threatened by a real and present danger to national security.¹⁰ If this is not the case, only data from specific persons may be retained, based on objective, non-discriminating, or geographical criteria.¹¹ In any case, state access to these data may only be permissible if it is necessary to combat serious crime, if it is subject to prior review by a court or an independent administrative authority, and if the retained data is based within the EU.¹²

In the following section, I will briefly describe, where data retention rules are included in the European AML framework (II). It shall then be shown that retention of transaction data is nothing new as it has been included in various legal provisions already (III). Hence, I will argue that maybe instead one should shift away from focussing on retention clauses and rather critically review the clauses, which grant the FIUs access to retained transaction data (IV).

II. Data Retention in the New AML Regulation

The European Union’s anti-money laundering (AML) framework obliges entities to retain personal financial data. As of now, the central norm can be found in Art. 40 of the anti-money laundering Directive,¹³ which was amended for the fifth time in 2018 (AMLD5).¹⁴ Art. 40(1)(a) AMLD5 obliges entities to retain a copy of the documents and information which are necessary to comply with the customer due diligence requirements (…) for a period of five years after the end of their business relationship (…) or after the date of an occasional transaction. Furthermore, Art. 40(1)(b) AMLD5 obliges entities to keep records of transactions, consisting of the original documents or copies admissible in judicial proceedings under the applicable national law, which are necessary to identify transactions, for a period of five years after the end of a business relationship with their customer or after the date of an occasional transaction.

The recent proposal for an AML regulation (hereinafter: AMLR-p)¹⁵ does not make substantial changes to these obligations. Art. 56(1) AMLR-p reads almost identically with Art. 40(1) AMLD5. Just like its predecessor, it differentiates between information that was necessary for the execution of customer due diligence (CDD) measures in para 1(a) and transaction records in para 1(b). The declaration of para. 1(b) is unambiguous. It provides an obligation to retain records of any transaction, independently from the scope of the applied CDD measures.

This issue has been acknowledged not only by legal scholars¹⁶ but also by Article 29 (Data Protection) Working Party as early as 2011.¹⁷ Although the Working Party did not directly compare the AML framework to the data retention rules regarding telecommunication meta data, it was deeply concerned by the long and rigid retention periods.¹⁸ The Union legislator has yet to react to this criticism. The retention periods have not been altered since 2011 and still amount to five years according to Art. 56(3) AMLR-p.

The fact that the retention rules have not changed substantially might be explained by the low public awareness of the topic, both in academic and in political discussions. Although data retention, especially that of telecommunication data and of passenger flight records, is heavily discussed in Germany,¹⁹ the AML framework is noted merely as a side issue.²⁰ The European literature looks somewhat better, with about a handful of authors commenting on the issue.²¹ Yet, the amount of literature regarding the topic falls significantly short to the prominence of data retention concerning telecommunication data.

III. Retention of Transaction Data in other Legal Provisions

The reason for this lack of attention is surely not to be found in the characteristics of the retained data. As all the scholars involved in researching this topic²² have noticed, financial data are as sensitive as it can get according to the standards of the ECJ. The judges in Luxembourg rightfully considers the quality of personal data and therefore the intensity of its retention according to the way the data can be used to develop personality profiles.²³ There are few documents imaginable that are as suitable for creating such personality profiles as transaction records. They contain information on personal preferences, income, location, personal relations, and much more. Especially in a consumer age of cashless payments, bank account statements can be read as a summary of one’s personal life.²⁴ Thus, unsurprisingly, security and intelligence agencies are quite keen on obtaining financial records.²⁵ The general German acceptance of the disclosure of financial data relates to this trend coherently. In an empirical study, however, 66% of the respondents answered that the duty of banks to hand out information to state authorities is “not a good thing”.²⁶

A better explanation for the absence of the topic in legal discussions might be the universality of retention obligations regarding financial data in various legal provisions. Other than telecommunication traffic data, transaction records are not stored for security purposes only. This will be exemplified in the following by taking a look at German and European Union law.

1. Germany

According to German law, banks and other financial services that provide accounts for their customers have a civil law accountability to report the balances to their customers in detail. This duty stems directly from the banking contract itself, e.g. giro accounts, in accordance with §§ 666, 675 of the German Civil Code (Bürgerliches Gesetzbuch– BGB).²⁷ Financial companies usually fulfil this duty by providing account statements.²⁸

Furthermore, banks and payment services are merchants according to § 1 paras. 1, 2 of the German Commercial Code (Handelsgesetzbuch – HGB). As such, they are required to adhere to commercial accounting rules (§ 238 para. 1 HGB). These include an obligation to retain accounting receipts for ten years (§ 257 para. 1 (4) HGB). Such receipts include all documents referencing business events and transactions.²⁹ Now, every transaction and deposit that is carried out via a banking or payment account is considered a business event from the bank’s point of view, since they directly affect the contractual relationship with their customer. Thus, the account statement, where all accounting events are listed, fall under the scope of application of § 257 para. 1 (4) HGB.³⁰ To handle this vast amount of data, banks have made a transition to storing their customers’ statements digitally.³¹

Overlapping with the trade law’s obligation is the accounting obligation in German tax law. § 147 para. 1 (4) of the Fiscal Code (Abgabenordnung –AO). It reads similar to § 257 HGB regarding accounting receipts and contains the same retention period. The rules are coordinated.³² The German banking law also contains an accountability clause in § 25a para. 1 sentence 6 (2) of the Banking Act (Gesetz über das Kreditwesen – KWG).

2. European Union

At the EU level, various provisions regulate which specific information must be contained in account statements. Arts. 57, 58 of the second Payment Services Directive (PSD2)³³ regulate information that must be provided by the payment service providers to both payer and payee. This involves transactions conducted via giro accounts.³⁴ The banks of both payer and payee which act as payment service providers,in turn fulfil their respective duties by providing account statements.³⁵ Art. 21 PSD2 includes a five-year record-keeping clause, affecting all appropriate records for the purpose of title 3 of the PSD2, but it does not affect domestic retention clauses, since it only sets a minimum retention period. It also explicitly does not affect the retention rules of the AML framework.

Another source of information provisions on payments can be found in the Regulation Regarding Direct Debit and other Transfers in Euro (SEPA-Regulation).³⁶ Art. 5 (1) and (3) SEPA-Regulation in conjunction with No. 1, 2 of its Annex provide some obligatory information that the acting payment providers must submit to payer and payee. The information mostly overlaps with what is already mandatory according to PSD2. The same can be said for the Transfer of Funds Regulation,³⁷ which also includes a five-year retention clause in Art. 16.

In sum, German law in conjunction with EU law poses a whole package of retention rules regarding account statements.

IV. A New Focus: The FIU’s Access to Retained Financial Data

The fact, that banks and other payment service providers store transaction record and thus retain sensitive financial data is thus, nothing new. The AML-framework does not constitute an obligation, which wouldn’t otherwise exist. Its effect is of mere declarative or repetitive nature.

Yet, the focus of attention has primarily been on monitoring and retention clauses which cannot come as a surprise. From the very beginning, the ECJ has highlighted that not only state access, but also retention (by private actors) itself affects fundamental rights.³⁸ It is questionable whether this approach is persuasive in its generality , if one takes into account that companies’ accounting and compliance rules as well as social and public administration law, in many cases, inevitably lead to the processing and storage of large amounts of personal data. Also, accessing this data is usually not a problem for security authorities – at least not in Germany. Although the correct legal rules for information requests may be debated in criminal procedure³⁹ and police law,⁴⁰ their general permissibility is not disputed. For intelligence services, there are even explicit norms that allow for secret information requests from banks, e.g., § 8a para 1 (2) of the Federal Office for the Protection of the Constitution Act (BVerfSchG).

1. The root of the issue with data retention structures

One can thus conclude that the general idea of data retention for private entities or public administration authorities cannot be the reason for the ECJ’s disfavour. It is in the nature of today’s society that information is documented for various reasons. And it belongs to the very nature of criminal investigation that pre-existing information is gathered. Hence, the broad definition that was presented in the introduction must be narrowed down, if one wishes to get to the core of what makes the famous data retention cases so significant.

One factor that must be highlighted is the purpose of the retention clause.⁴¹ Only if strictly for security issues should the narrow conditions of the ECJ be applied. This is obviously the case for the AML data retention clauses, as they are aimed at fighting money laundering and the financing of terrorism. Yet, they constitute a special case, since the obligation to retain transaction records overlaps with legal rules that have different purposes, for example economical ones. Thus, the question is whether the mere addition of a security purpose to an already existing retention obligation should be viewed as strictly as retention clauses that exist only for security reasons, as was the case with the 2006 Data Retention Directive.

To answer this question, one must shift the focus away from the retention level and look towards access structure. In Germany, the purpose of access rules on telecommunication meta data can be twofold.

First and in any case, they allow for secret access. Traffic data could previously be accessed directly from telecommunication providers according to § 113 of the 2015 Telecommunications Act (Telekommunikationsgesetz – TKG 2015 [not in force anymore]). The providers were legally forced to treat the request confidentially according to §§ 15, 33 Telecommunications Interception Ordinance. Such an obligation to secrecy does not exist if the request were to be based on the general provisions of the criminal procedure code.⁴²

The second purpose, which can be found in the access provisions for contractual data, is simplification. The access privilege for telecommunication contract data (name, number, identification code, device number, etc.) lies with a central authority, the Bundesnetzagentur (Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railway), which has direct access to the providers’ databases, § 173 TKG. The same holds true for contractual data of bank account holders, § 24c KWG, §§ 93b, 93 paras. 7, 8 AO.⁴³ In these “automated processes”, security authorities do not themselves address the (private) providers but must rather ask the respective central authorities to do so. The investigating officer can instead stay in his/her office without having to disclose the investigation to anyone. This ability to investigate via communication alone makes the citizen easily transparent. Especially if the investigation solely takes place between authorities. Perhaps it was this image that led the ECJ to conduct its strict review on retention of telecommunication data, as it deviates from the conventional image of investigation under the rule of law. Traditionally, the state must face the concerned person to ensure equality of arms.⁴⁴ This includes the principle of an openly investigating police.⁴⁵

2. The FIU’s access provisions

Here lies the problem with data retention structures. The more they deviate from our traditional picture of legal investigation, the more they infringe the right to privacy. It has already been recognized that the retention obligation in the AML framework only adds a purpose and does not lead to more factual records. In this context, it is less infringing than the retention of telecommunication traffic data. If one wishes to apply the ECJ’s jurisdiction in La quadrature du net to the AML framework, one must then check whether the access rules of the AML framework deviate from traditional principles of investigation in such a way that it lends itself to a comparison with the retention of telecommunication traffic data.

In principle, the AML framework is a compliance system. The private entities – not security authorities – are at the forefront of the fight. Unlike telecommunication providers, banks must actively monitor transactions and report suspicious activities. These “suspicious activity reports” (SARs) can even be seen as the core of the system.⁴⁶ Meanwhile, the ECJ⁴⁷ and the ECtHR⁴⁸ have found that the obligation to submit SARs would, at least, not even infringe the rights of obliged lawyers. The privacy rights of the affected customers were not substantially checked; thus, it seems that the case law does not recognize them as a problem with regard to SARs.

However, the AML framework does allow for the reverse direction as well. According to Art. 32(9) AMLD5, the Financial Intelligence Units (FIUs) are “able to request, obtain and use information from any obliged entity for the purpose set in paragraph 1 of this Article, even if no prior report is filed”. This authorisation of FIU’s to request information is included Art. 18 (4) of the proposal for a sixth AML-directive – AMLD6-p⁴⁹ and reads identically to its predecessor. A similar provision can be found in Art. 33 (1) (b) AMLD4 respectively Art. 50(1)(b) AMLR-p, which reads: “Obliged entities, and, where applicable, their directors and employees, shall cooperate fully by promptly providing the FIU directly, at its request, with all necessary information.” Although the wording suggests that Art. 33 (1) (b) AMLD4 respectively Art. 50(1)(b) AMLR-p are no authorisation rules. In any case, the FIUs are authorised by 32(9) AMLD5 respectively Art. 18 (4) AMLD6-p. These provisions state that a prior report is not needed for the FIUs’ requests which is also clarified by recital 79 AMLR-p.

The FIUs’ competence to request information must be read in conjunction with the other competent security authorities’ permission to request information from the FIU. This authorisation is stated in Art. 32(4) AMLD4/5 and can be found, almost unchanged, in Art. 19(1) AMLD6-p.

In theory, without a SAR having been filed, security authorities can access the financial information of a target indivudal by requesting this information from the FIU. The FIU could then send a request to the respective private entities. Via this route, security authorities could access the retained account statements without themselves having disclosed the investigation towards the obliged entities.

The private entities are not allowed to disclose the FIU’s request to third parties, especially not to their customers (Art. 39 (1) AMLD5/Art. 54(1) AMLR-p). Therefore, the access remains secret. This access route should be focused on in any proportionality test of potential fundamental rights infringements.⁵⁰ As long as the access is not subject to the conditions that were demanded in the ECJ’s case law on data retention, the argument can well be made that the current and proposed AML framework violates privacy rights.

V. Conclusion

It has been shown that applying the ECJ’s pattern regarding retention of (teleocommunication) data to the AML framework is intrusive, but not as easy as some scholars⁵¹ have suggested. The obligation to retain financial data does not factually increase the amount of stored data, since overlapping obligations are already in place. The purpose has merely been expanded to now include security-related issues.

One should thus shift from focusing on the retention obligation as such and instead review the FIUs’ access to the records more strictly. Via information requests, other competent state authorities could indirectly access financial data, without a suspicious activity reports being filed (by a private entity). This leads to secret access to privately stored data through an intermediary authority. Since this structure deviates from the traditional approach to law enforcement, a case can be made for applying the ECJ’s data retention conditions, at least as regards the accessibility of data pursuant to the AML legal framework. The fact that corresponding considerations are missing in the recently proposed AML package raises doubts as to whether or not the Union legislator is really willing to implement the ECJ’s findings.