Impact assessment on the mandatory retention of metadata by service providers for the purpose of criminal proceedings

CALL FOR EVIDENCE FOR AN IMPACT ASSESSMENT Ref. Ares(2025)4081079 - 21/05/2025 TITLE OF THE INITIATIVE Impact assessment on retention of data by service providers for criminal proceedings LEAD DG (RESPONSIBLE UNIT) HOME.D4 LIKELY TYPE OF INITIATIVE INDICATIVE TIMETABLE Q1 2026 ADDITIONAL INFORMATION Cybercrime - European Commission; High-Level Group (HLG) on access to data for effective law enforcement - European Commission A. Political context, problem definition and subsidiarity check Political context To effectively fight and prosecute crimes, police and judicial authorities may need access to certain non-content data processed by electronic communication service providers. In the absence of specific obligations requiring those providers to retain data for a reasonable and limited period of time, data may be deleted by the time authorities request them for the purpose of criminal proceedings . At present, no EU-wide legal framework exists in this area. While most EU Member States rely on national laws that diverge across the EU, other Member States do not have rules in place. The lack of harmonised data retention rules for key categories of data was identified by the police, prosecution services and judicial authorities as a substantial challenge for national criminal proceedings in crimes happening both online and offline and hampers cross-border cooperation across the EU. The topic was of focal importance in the High-Level Group on Access to...