Estonia's Justice and Digital Affairs Minister Liisa-Ly Pakosta has sent a draft law to the government that would end telecommunications companies' blanket obligation to retain a full year of every citizen's call and location metadata—who called whom, from where, and for how long. The bill replaces mass retention with a narrower regime built around targeted 'quick freeze' orders and access to data telecoms already hold for billing purposes. It went out for inter-ministerial coordination in late May 2026, and Pakosta briefed the cabinet on its progress at the government's May 28 sitting.
A Legal Deadline, Not a Volunteer Reform
This is not a discretionary liberalization. Estonia's mass-retention regime has been legally dead for years and the state has simply been slow to bury it. The Court of Justice of the European Union's Prokuratuur ruling (Case C-746/18, 2 March 2021) held that Estonian prosecutors could not authorize their own access to retained traffic and location data, and that such access—regardless of retention duration—could only be justified for serious crime or serious threats to public security, never for routine offenses (eucrim.eu). Estonia's own Supreme Court aligned with that reasoning in 2021, then went further in March 2026: in a criminal case involving Narva municipal officials, the court held that only communications data telecoms collect for genuine business purposes—not data retained solely because the state mandates it—can be used as evidence at all, since the underlying statute remains unamended and unlawful (news.err.ee). Prosecutors have effectively been operating a legal fiction for five years, and the fiction just collapsed.
What the Bill Actually Does
The draft removes the requirement that telecoms retain call records and location data for every subscriber for twelve months. It keeps two narrower obligations: a year of subscriber identification data (whose name and contact details attach to a given number) and internet-service data needed to trace an IP address in cybercrime cases. In place of blanket retention, the ministry is building an electronic 'quick freeze' verification system that lets investigators confirm which provider holds a number's records without a standing mandate to hoard everyone's metadata by default (news.err.ee). The bill also carves out a temporary, stricter retention regime for genuine national-security emergencies—a mechanism the CJEU has explicitly said member states may use, unlike routine bulk collection.
The Case for Keeping the Old System, Fairly Stated
Before dismissing the objections, it's worth taking them seriously. Investigators genuinely lose something here. Communications metadata isn't a hypothetical tool: it corroborates alibis, maps criminal networks, and resolves cold cases where a suspect surfaces only years after a crime, by which point voluntarily-retained billing data has long since been deleted. A prosecutor can't quick-freeze data that no longer exists. That is the real argument behind Interior Minister Igor Taro's refusal to co-sign his own coalition colleague's bill: he wants continued retention around borders, critical infrastructure, and remote islands, plus a national-security window of up to three years by government order (news.err.ee). KAPO, the security police, has separately pushed for a two-year emergency-retention ceiling. These aren't bad-faith positions—serious crime investigation is genuinely harder without a retention baseline, and Taro and Pakosta are from the same party, which tells you this is a substantive disagreement, not partisan theater.
Why Proportionality Should Still Win
The counter-case is stronger. Estonia's own justice ministry data undercuts the emergency-scale framing: Pakosta's own account puts communications-data use at around 1% of criminal cases that go to trial, with prosecutors elsewhere citing roughly 200 investigations a year relying on it (news.err.ee). A regime that retains the private movements and contacts of every Estonian, indefinitely, to serve a few hundred cases a year is precisely the disproportionality the CJEU flagged. The Estonian Human Rights Centre, which has campaigned against blanket retention since the EU's original Data Retention Directive was struck down in 2014, frames the tradeoff correctly: nobody wins when human rights and internal security are treated as opposites, because a surveillance regime that citizens don't trust degrades the state's legitimacy along with their privacy (liberties.eu). Quick freeze is not a weaker tool—it's the targeted alternative the CJEU has repeatedly endorsed as compliant, used successfully by several EU states without gutting investigative capacity.
The real fight left in Tallinn is duration, not principle: KAPO's two years versus the Bar Association's two months for the national-security carve-out. That gap should worry regulators more than the headline repeal does—a loosely bounded 'emergency' exception can become the new blanket regime by another name. Estonia's parliament should resolve that number narrowly and with sunset review, not let the security services relitigate the CJEU's serious-crime threshold through the back door of a national-security clause.