Discussion: https://old.reddit.com/r/privacy/comments/1kvf69x/eu_is_proposing_a_new_mass_surveillance_law_and/

Feedback submit URL: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14680-Impact-assessment-on-retention-of-data-by-service-providers-for-criminal-proceedings-_en

A text ready to be submitted:

At first glance, the proposed regulation might appear to be just another flawed attempt to balance security and privacy. But a closer look, especially at the High-Level Group (HLG) advice the EU cites as a foundational source, reveals something far more dangerous.

Start with this: when German MEP Patrick Breyer requested the names of the individuals behind the so-called High-Level Group that drafted this sweeping proposal, the EU responded with a list where every single name was blacked out. A law that would introduce unprecedented surveillance powers across Europe is being built on recommendations from an anonymous and unaccountable group. In any democracy, this would be a scandal. In the European Union, it is an outright betrayal of public trust.

According to digital rights organization EDRi, “The HLG has kept its work sessions closed, by strictly controlling which stakeholders got invited and effectively shutting down civil society participation.” In short, the process was deliberately closed off to public scrutiny, democratic debate, and expert dissent. Civil society was excluded while powerful lobbyists shaped one of the most consequential digital laws of our time behind closed doors.

A blunt overreach of state power:

Universal identification and data retention, every click, message, and connection must be logged under your legal name, turning the entire population into perpetual suspects.

Encryption smashed: providers must supply data “in an intelligible way” (Rec 27.iii), forcing them to weaken or bypass end-to-end encryption whenever asked.

Backdoors by design: hardware and software makers are ordered to bake permanent law-enforcement access points into phones, laptops, cars, and IoT devices (Rec 22, 25, 26).

Privacy shields outlawed: VPNs and other anonymity tools must start logging users or shut down.

Criminalized resistance: services or developers who refuse to spy on their users face fines, market bans, or prison (Rec 34).

No one exempt: the rules cover every “electronic communication service”, from open-source chat servers to encrypted messengers to vehicle comms systems (Rec 17, 18, 27.ii).

A mass surveillance law, drafted in secrecy by unknown actors, with provisions that go beyond what we see in many authoritarian regimes. And yet, the European Commission is advancing it as if it’s routine policy work.

The European Commission must halt this process immediately. No law that enables this scale of surveillance, especially one built in the shadows, should ever be allowed to pass. Europe must not become a place where privacy dies quietly behind closed doors.

This threatens the fundamental rights of every citizen in the Union.