Skip to main content

Why Metadata Matters: The Dangers and Revealing Nature of Data Retention

What: 

German politician and privacy advocate, Malte Spitz, exposed just how much metadata reveals about a person by creating an interactive map of his user data that was collected by his telecommunications provider under the German Data Retention law. The data retention mandate compels all ISPs and telecommunications service providers in Germany to collect and retain a subscriber's incoming and outgoing phone numbers, IP addresses, location data, and other key telecom and Internet traffic data for a certain period of time. This data depicted a disturbingly-accurate portrayal of his movements and actions over a period of six months.

Who: 

Malte Spitz, German Green Party politician and media and privacy advocate

Where: 

Berlin, Germany

The Surveillance Practice: 

In 2006, the European Union (EU) issued a directive, called the Data Retention Directive, which required communications service providers in Europe to retain a wide-range of data on its users—including location and calling information—for at least six months and up to two years. This law affected all; with the retained information, governments could paint a technical picture of each and every EU citizen’s daily life, movements, and habits. Each EU country was required to implement the directive on a national level.  

In Germany, the law became valid in 2008 and its implementation required communications service providers to retain data for six months.  The law prompted national outrage from individuals who didn’t want their phone and Internet companies to be required to store their private information. People protested the directive in the streets of Berlin, and eventually in 2010, the German Constitutional Court ruled the law unconstitutional.  However, the fight against data retention in Europe continued.

The Campaign: 

Malte Spitz, a German Green Party politician, wanted to show the relevance of data retention to the ordinary citizen, who thought he or she had nothing to hide. Under German data protection law, Malte had the right to access to his own personal data stored by the telecom provider. This right applies to both government and companies. So in 2009, he asked his cellphone operator, Deutsche Telekom, for all of the data the telecommunications operator had collected about him.  After several failed attempts to get access to his mobile phone metadata, Malte sued Deutsche Telekom.  The case was settled, and Deutsche Telekom was required to hand over six months worth of Malte’s data. What he received astonished him; the company had collected his geographical location and what he had been doing with his phone over 35,000 different times.
 
Malte worked together with Zeit Online, a German online newsite, and OpenDataCity.  In 2011, they created and published an interactive map that illustrated Malte’s movements and activities for six months of his life according to the metadata collected by Deustche Telekom. The visualization included a timeline, geolocation data, and other publicly available information such as his blog posts and Twitter feeds, which, combined together, painted an eerily accurate picture of Malte’s life.

The Strategy: 

The project garnered a lot of international media attention since it truly depicted how data retention affected the average citizen. The interactive map led many people to understand, for the first time, what the directive meant for them and their privacy. It was important for Malte to convey how society can be controlled through this type of mass surveillance and monitoring. He described data retention as a “blueprint” of how a society functions—you can pinpoint who is communicating with whom, who are the leaders, and who may be protesting against the government. Malte points out the fact that if all the protesters in Berlin in 1989 had cellphones on their persons, the Berlin wall may have never fallen. With the visualization and publication of his personal data in 2011, a new dimension in the protest and in public awareness had been reached. People have realized how far-reaching this legislation is, since everybody is affected. Malte’s fight against mandatory data retention has been a long and ongoing protest and is depicted in his new book, “What are You Doing with My Data?."

Lessons Learned: 
  • Under many data protection laws, any individual is entitled to access his or her own personal data an organization holds about them.  Use that right to request your own metadata so you can see how revealing the data is.
  • Develop a visualization tool of your own metadata. It’s a campaign tool that raises awareness by showing the amount of sensitive information held by private (airlines and banks) and public entities.
  • Positive change will only happen if you explain laws and policies in such a way that the general public can understand them.
  • Don't get frustrated.  Fighting these types of policies takes time, but is well worth it.
  • Privacy is not an outdated value.  Living in the digital age simply means that you have to fight even harder for your self-determination.
Resources: 
JavaScript license information