ePrivacy: Traffic Data
Traffic Data [Art 6]
Rule: Traffic data must be erased or anonymized when no longer needed for transmission, unless retained for specific permitted purposes with appropriate safeguards.
What is Traffic Data?
Traffic data is any data processed for the purpose of:
- Conveying a communication on a network
- Billing for that communication
Examples:
- IP addresses
- Call records (who called whom, when, duration)
- Data volumes transferred
- Routing information
- Session timestamps
The Basic Rule [Art 6(1)]
Traffic data relating to subscribers and users processed and stored by the provider of a public communications network or publicly available electronic communications service must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication.
Permitted Retention Purposes
Traffic data MAY be retained for:
| Purpose | Conditions | Citation |
|---|---|---|
| Billing | Until end of period for legal challenge to bill | Art 6(2) |
| Marketing own services | With subscriber consent, limited data only | Art 6(3) |
| Value-added services | With subscriber consent | Art 6(3) |
| Legal obligations | As required by national law | Art 15(1) |
Requirements for Processing
When traffic data is retained:
- Purpose limitation — Only for the specific permitted purpose
- Staff access restricted — Only authorized personnel
- Subscriber information — Inform subscribers of data types, duration, purposes
- Consent withdrawable — Subscriber can withdraw consent anytime
Data Retention Directive (Historical Note)
The Data Retention Directive (2006/24/EC) previously required retention of traffic data for 6-24 months. This was invalidated by the CJEU in Digital Rights Ireland (2014) as disproportionate.
Current position: Blanket retention is unlawful. Targeted retention may be permitted under strict conditions.
Anonymization
When traffic data is anonymized:
- Must be truly irreversible
- Cannot be re-identified using additional information
- Once anonymized, no longer subject to ePrivacy rules