Section: Justice & law | Technology & AI Author: V Reading time: ~27 min Sources and further reading: 22 items Topics: operator, data retention, traffic data, location data, privacy, criminal proceedings SEO / working title: How long does an operator retain data about your phone?
How long does an operator retain data about your phone? The question sounds simple only until we notice that we are not comparing one thing. Six months may apply to traffic data and the content of a call may still be missing. Two months of billing at one operator in 2019 are not a statutory period. The Constitutional Court could bear the rules in 2019 and the Supreme Court in December 2025 could find the same blanket character incompatible with Union law. And a judgment about an apology need not erase a paragraph from the Collection of Laws. The text that follows therefore does not ask what the operator records. It asks which bucket who is requesting, and under which frame lawfulness is measured.
1. In T-Mobile’s testimony two months were heard. In the statute there stand six. In the call there stands nothing.
A subscriber asks the operator how long it keeps data about a phone. The operator points to § 97(3) of the Electronic Communications Act: six months of traffic and location data, without the content of messages [1]. A witness for T-Mobile Czech Republic, a.s., in proceedings before the Constitutional Court in 2019 says something narrower: for its own billing and complaint needs it retains data in a narrower scope for two months [4]. A police authority is not asking about an invoice, but about access under § 88a of the Code of Criminal Procedure [10]. And the Court of Justice of the EU is not asking about the convenience of a national rule, but about the blanket character of the interference under Union law [7][8].
At first glance this is a dispute about half a year, or two months. In fact each person is describing a different bucket. One bucket is statutory data retention. The second is billing and complaints. The third is marketing with consent. The fourth is judicial access to data. The fifth is the constitutional frame. The sixth is the Union frame. Anyone who mixes them easily arrives at the sentence that the operator records calls for half a year. That sentence is wrong.
The content of a call does not belong here. § 97(3) expressly says that the content of messages is neither retained nor handed over under this duty [1]. That does not mean that metadata are banal. The Constitutional Court has already said of telephone data that even numbers called, time, duration of a call and base stations fall under the protection of Article 13 of the Charter [14]. It means only that content and a traffic datum are not the same thing.
The dossier about a phone in police hands is another text. There the subject is a seized device, stored content and § 113a. Here the subject is network metadata at the operator. Device, network and invoice meet in one user experience. Legally they stand in different columns.
Six months at the operator is not the content of a call. Billing is not data retention.
— Jiný Kontext
2. Data at the operator have at least six layers
The first layer is network metadata. Who called whom, when, for how long, from which cell, with which identification of a device or subscriber. Decree No. 357/2012 Coll. spells out the scope of retained and handed-over traffic and location data, including identification of source and addressee, time, manner and duration of communication [2]. For e-mail protocols it does not aim at the body of a message. It aims at a traffic trail.
The second layer is the operator’s own operations. Billing, complaints, network operation, customer care. That may require some data, but another scope and another period. In the sources we have a firmly documented figure of two months only as T-Mobile’s testimony in Pl. ÚS 45/17, for its own needs and in a narrower scope [4]. It is not the statute. It is not the whole market. It is not 2026.
The third layer is statutory holding for the state. § 97(3) requires persons who provide a public communications network or a publicly available electronic-communications service to retain data for six months [1]. This figure measures the legal data-retention duty, not the existence of call content and not every firm’s billing practice.
The fourth layer is the judicial lock on access. In criminal proceedings that lock is § 88a. It does not regulate retention itself at the operator. It regulates when and how data on telecommunications traffic may be requested [10]. An older form of § 88a was itself the subject of Constitutional Court intervention in Pl. ÚS 24/11 [11].
The fifth layer is the European ceiling. From Digital Rights Ireland through Tele2 to La Quadrature du Net the Court of Justice of the EU rejects general and indiscriminate retention of traffic and location data for the fight against crime, with narrow exceptions [6][7][8]. That is a different plane of review from the question of what currently stands in the Czech statute.
The sixth layer is the Czech pendulum. The Constitutional Court in 2011 annulled the old rules [3]. After adjustments the legislature rebuilt them on six-month retention. The Constitutional Court in 2019 dismissed an application to annul [5][13]. The Supreme Court in December 2025 found a conflict with Union law and ordered the state to apologise [9]. As of the September 2026 research cut, however, the paragraph still stands in the text of the statute.
3. The best diagnosis is the one that first names the bucket
A bad diagnosis does not begin with ill will. It begins with the word data. Invoice data, traffic data, marketing data, interception data, data in the phone, data at a chat service. In ordinary speech they fit into one sentence. In law they do not.
| Type of failure | What it looks like | How to test it | What limits the harm |
|---|---|---|---|
| Content as retention | An expectation that the operator holds a recording of the call | Read the sentence in § 97(3) on the ban on content | Content is § 88, not retention |
| Billing as statute | “Two months” is cited as a ZEK period | Point 34 of Pl. ÚS 45/17: one operator, year 2019 | At another operator, check its own rules |
| Constitutional Court 2019 as EU 2025 | “It is constitutional, therefore also Union-law compliant” | Separate Pl. ÚS 45/17 from Tele2 and the Supreme Court 2025 | Two frames, two results |
| Apology as annulment | A civil judgment is read as a derogating finding | Compare Pl. ÚS 24/10 with Supreme Court 30 Cdo 2556/2025 | A paragraph in the Collection of Laws may still stand |
| § 88a as everything | A request without a threshold and a purpose | Read the threshold and conditions of the Code of Criminal Procedure | An individual order is not a blanket sieve |
Interpretive scheme: One telephone trail may be an invoice for the user, a traffic record for the operator, data retention for the state and an interference with fundamental rights for a court. The dispute will not be solved by the word “data”. It will be solved by naming purpose and regime.
That is the practical value of precision. We do not ask whether the operator has something. We ask why it has it, in what scope, for how long, who wants to get to it and under which law lawfulness is tested. Only then does an answer make sense.
One more distinction is often hidden. The existence of a datum is not the same as an authorisation to hand it over. A datum may arise for network operation, remain for billing, be retained from a legal duty, or be processed with consent. Each path has a different title and a different addressee of review. When the state requests an extract, it is not enough to know that a datum is somewhere. It must be clear why it exists and under which provision it is opened.
4. The content of a message is neither traffic nor location data
§ 97(3) of the Electronic Communications Act is hard precisely where the public picture often errs. It requires retention of traffic and location data for six months, but at the same time provides that the content of messages must be neither retained nor handed over [1]. A call, the text of an SMS or the body of an e-mail are not data retention under this provision.
That does not mean that metadata are an innocent trifle. From times, numbers, cells and IP addresses one can sometimes read movement, the rhythm of a life, a circle of contacts and moments of crisis. The Constitutional Court in II. ÚS 502/2000 extended the protection of Article 13 of the Charter also to numbers called, time, duration and base stations [14]. Protection is therefore not reserved only for the words inside a call.
The difference is still decisive. If someone requests the content of future communication, we look at interception under § 88. If someone requests traffic and location data at the operator, we look at § 88a and at § 97 ZEK. If someone reads a stored chat in a seized phone, we look elsewhere. Precision is not academic. It determines the threshold, the judicial filter and the consequences of error.
That is why the sentence “the operator has half a year of my calls” is imprecise in two directions. It may have, for the statutory period, data about a call. It is not supposed to have the content of a call from data retention. And it may have other data for other purposes, for example billing, but that is not the same bucket.
5. Data retention is not billing. Billing is not marketing.
In testimony in Pl. ÚS 45/17 a figure was heard that tempts a shortcut. A T-Mobile witness stated that for its own needs, that is billing and complaints, it retains traffic and location data in a narrower scope for two months [4]. That is documented. But its precise meaning is narrower than the public slogan.
Two months are not statutory data retention. The statutory duty in § 97(3) speaks of six months and of persons who provide public networks or publicly available electronic-communications services [1]. Two months were one operator’s testimony in 2019 about its own need in a narrower scope. This is billing and complaints, not the whole of state retention.
Billing is also not marketing. The same point of the judgment states that marketing purposes occurred only with consent and that retention for six months concerned approximately 70 percent of the customers of this one company in 2019 [4]. This figure measures a state described in testimony at one operator. It does not measure the Czech market in 2026 and it does not measure the legal duty of all operators.
The practical conclusion is simple. If you read two months, ask: two months of what, at whom and when? If you read six months, ask: six months under which provision and without the content of what? Without those riders the numbers are precise only in appearance.
6. Retention at the operator is not interception. Nor examination of a phone.
Interception under § 88 of the Code of Criminal Procedure aims at the content of future telecommunications traffic. That is a different interference from data retention. The operator does not, under § 97(3), stockpile the content of calls. If the content of future communication is to be captured, the path of interception and its conditions must be taken.
Examination of a phone is another different world. A seized device in police hands, its stored content and, from 1 January 2026, § 113a of the Code of Criminal Procedure are not the operator’s network. A phone may contain messages, photographs and a history of communication. An operator may retain traffic and location data. These layers may concern the same person and the same day, but legally they are not identical.
Confusion arises when one practical story is told with one verb. “The police watched the phone.” That may mean interception, an extract of traffic data, a location datum, examination of the device, or a combination of several acts. Each has a different threshold. Each has a different document. Each has a different possibility of defence.
It does not follow that one act never follows on another. An investigation may work with more than one source. It does follow that one act must not retroactively legalise another. An extract from the operator is not permission to read a phone. A seized phone is not statutory data retention. And interception is not billing.
7. The decree spells out IMSI, IMEI and cells. It does not spell out the body of a message.
The statute names a category. Decree No. 357/2012 Coll. spells out the scope. It works with data needed to trace and identify the source and addressee of communication, with date, time, manner and duration, with identification of a device and with location data [2][19]. On a mobile network that means, among other things, IMSI, IMEI and data about cells.
These are words that sound technical. Their legal meaning is, however, intelligible. They do not say what you said. They say when and from where communication passed through the network, who was identified as a subscriber or a device and what the technical context of the connection was. That is precisely why they can be sensitive even though they are not content.
For e-mail protocols the difference is still clearer. A traffic datum may show an address, a time or technical parameters. The body of a message is something else. If ordinary debate says that e-mails are retained, it is necessary to stop. A traffic trail is retained, not, as a matter of law, the whole text of an e-mail inside data retention.
The decree therefore does not extend § 97 to content. It specifies which traffic and location data are retained, handed over and destroyed. It is a map of the bucket’s scope, not a secret list of recordings.
8. Constitutional conformity in 2019 is not the same as Union conformity in 2014-2025
The Constitutional Court in 2011 annulled the old Czech data-retention rules. Judgment Pl. ÚS 24/10 of 22 March 2011, promulgated as No. 94/2011 Coll., annulled the then § 97(3) and (4) and Decree No. 485/2005 Coll. for a lack of safeguards [3]. That was a derogating finding. The paragraph disappeared.
The legislature then recast the rules, shortened the period and tightened the conditions. When the new rules came before the Constitutional Court again, the result was different. Judgment Pl. ÚS 45/17 of 14 May 2019 dismissed the application to annul and described six months as a period that is not manifestly disproportionate [5][13].
That, however, is not the end. The Court of Justice of the EU was meanwhile deciding under the Union frame: Directive 2002/58, the Charter of Fundamental Rights of the EU and its articles on privacy, protection of personal data, freedom of expression and the limits of restrictions of rights [12][17]. That is a different reference frame from the domestic constitutional test.
That is why the results can diverge. The Constitutional Court in 2019 could say that the Czech rules stand in the test it applied. The Supreme Court in 2025 could say that blanket and preventive retention of practically all users will not stand against Union law [9]. That is not a logical error. It is a clash of two planes of review.
9. The CJEU annulled a directive. Then it barred blanket holding for criminal cases. Then it left narrow exceptions.
The first large cut came on 8 April 2014. The Court of Justice of the EU in joined cases C-293/12 and C-594/12, Digital Rights Ireland, declared Directive 2006/24/EC on data retention invalid [6]. This was not about a Czech statute. It was about a Union directive that imposed a duty of blanket retention on Member States.
The second cut came on 21 December 2016. In cases C-203/15 and C-698/15, Tele2 Sverige and Watson, the CJEU interpreted Article 15(1) of Directive 2002/58 as precluding a national rule that, for the fight against crime, provides for general and indiscriminate retention of traffic and location data of all subscribers and registered users [7].
The third step came on 6 October 2020 in cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net [8]. The CJEU confirmed the ban on general and indiscriminate retention for the fight against crime, but admitted narrow possibilities, in particular in a serious threat to national security, and targeted or time-limited regimes. That is not a return to a blanket preventive store. It is a map of exceptions.
The following line on national security, for example Privacy International or Commissioner of An Garda Síochána, belongs in the same context [16]. It shows that the European ceiling is not a simple “never”. It is “not this blanket way for this purpose”. The difference matters. It allows targeted regimes to be built, but not a general sieve to be hidden behind the word security.
10. The Supreme Court found a conflict. The paragraph in the Collection of Laws as of September 2026 still stands.
The Supreme Court, by judgment of 30 December 2025, file No. 30 Cdo 2556/2025, according to a press release of 8 January 2026, dismissed the state’s appeal on a point of law and confirmed the unlawfulness of blanket retention of electronic-communications data [9]. The reason was a conflict of § 97(3) ZEK with Union law, because it aims at preventive indiscriminate retention of the data of practically all users.
The decision was not, however, a derogating finding of the Constitutional Court. The Supreme Court decided a civil dispute about an apology. It ordered the state to apologise. It did not erase the paragraph from the Collection of Laws. That is an uncomfortable, but fundamental, distinction.
As of the September 2026 research cut, therefore, two sentences stand side by side. The text of § 97(3) in the statute still stands [1]. The Supreme Court at the same time found its conflict with Union law [9]. Operators and the state thus stand in a vice: on one side a domestic duty, on the other directly effective Union limits and case-law that rejects the blanket character.
That is not a stable state. But it is a state that cannot be simplified either to “everything is in order” or to “the paragraph no longer exists”. The precise sentence reads: the paragraph still stands in the text of the statute; its blanket duty is, according to the Supreme Court, in conflict with Union law.
11. A judgment about an apology is not a derogating finding
The difference between annulment and an apology is practical. In 2011 the Constitutional Court annulled the then § 97(3) and (4) and the implementing decree [3]. That created a gap that the legislature had to address with new rules. That is a derogating operative part.
In 2025 the Supreme Court dealt with the state’s liability for an incorrect official procedure or an unlawful interference in civil proceedings about an apology. It found a conflict of blanket retention with Union law and confirmed a duty to apologise [9]. That is a strong legal signal. But it does not have the same technical effect as annulment of a statute by the Constitutional Court.
Caution is therefore in place even in a media sentence. “The Supreme Court annulled data retention” is imprecise. “The Supreme Court confirmed the unlawfulness of blanket retention and the state is to apologise” is closer. And “§ 97(3) as of the research cut still stands in the statute” completes the picture.
A judgment about an apology is not a derogating finding. A paragraph may still stand.
— Jiný Kontext
12. A request under § 88a is not a request for everything the operator has
§ 88a of the Code of Criminal Procedure governs an order to establish data on telecommunications traffic [10]. It is not a universal demand “give us everything”. It has a threshold, a purpose and a procedural regime. As worded toward 2026 it aims at an intentional offence with an upper prison term of at least three years and at further listed cases [10]. This figure measures the threshold of access to data, not a duty of the operator to create data.
Access to data is not the same as their retention. ZEK provides what is retained on a blanket basis and for how long [1]. § 88a provides when an authority in criminal proceedings may request data. These two provisions meet, but they do not have the same function.
User consent may, under § 88a(3), replace the order [10]. Even that does not make it a boundless authorisation. Consent has its scope and its subject. If someone consents to the provision of a particular extract, that does not mean consent to interception, to the content of a phone or to an indefinite hunt through all data.
Older history shows that even the access paragraph had to pass constitutional review. The Constitutional Court in Pl. ÚS 24/11 of 20 December 2011 annulled the then § 88a [11]. That is a reminder that it is not enough to have data stored. There must also be reviewable and proportionate access.
13. Two months at one operator in 2019 are not a 2026 market standard
Two months are a useful figure precisely when the reservation stays with them. In point 34 of Pl. ÚS 45/17 a T-Mobile witness stated that the operator, for its own billing and complaint needs, retains traffic and location data in a narrower scope for two months [4]. That is a precise claim. Its limits are part of the claim.
It is not a statutory period. It is not a claim about all operators. It is not a figure about 2026. It is not even the whole data-retention bucket. If someone rewrites this sentence as “operators keep data for two months”, they discard the source, the period, the population and the purpose.
At another operator its terms, information duties under the GDPR, records of processing activities and answers to a concrete request have to be read. The GDPR matters here not as a further figure, but as a language of purposes: legal obligation, legitimate interest, consent [22]. Each title may mean other data and another period.
The public record in the sources does not allow the sentence that all operators in 2026 bill from the same two-month window. The precise sentence is longer. But that is exactly why it is precise.
14. The first three months as the most frequent window are testimony. Not a statutory maximum.
The same point of Pl. ÚS 45/17 states that authorised authorities most often request data for the first three months from the origin of the datum [4]. That is interesting. It says something about operational practice described by a witness in 2019 toward one operator. It does not say that the statutory maximum is three months.
The statutory maximum of data retention under § 97(3) is six months [1]. After that period the data are to be destroyed, unless the statute provides otherwise. Six months measure the retention duty. Three months measure a most frequent request window described in testimony. Two months measure a narrower billing need. Three figures. Three buckets.
The Constitutional Court in Pl. ÚS 45/17 cited partial operational estimates and testimony. That is not an open complete dataset of all police requests or all authorised authorities. The sources contain no public state statistic that could be passed off as a total number and a success rate of extracts.
That is why it is good to treat the figure three with the same care as the figure two. It helps describe practice. It must not replace the statute. And it must not at all create the impression that after three months no datum under retention can exist.
15. The Czech pendulum 2011-2026 did not erase the vice between a duty and the Union ceiling
The Czech data-retention story is not a straight line. In 2011 the Constitutional Court annulled the old rules [3]. In 2012 the legislature adopted a new construction, including a six-month retention period. In 2019 the Constitutional Court dismissed an application to annul [5][13]. In 2025 the Supreme Court said that blanket preventive retention of practically all users conflicts with Union law [9].
Meanwhile European case-law moved and tightened the ceiling. Digital Rights Ireland annulled a directive [6]. Tele2 rejected national general and indiscriminate retention for the fight against crime [7]. La Quadrature du Net described narrow exceptions and targeted regimes [8]. The Czech text of the statute has not, as of the research cut, changed into a form that would remove this tension.
That is legal uncertainty, not only an academic dispute. An operator has to read the Czech statute. A court has to read Union law as well. An individual has a right to protection of privacy and personal data. Authorities active in criminal proceedings want a tool for investigation. All have a piece of the truth if they describe their own layer. A shared decision is, however, wrong if it ignores the blanket character.
The thesis of this article would be weakened by an amendment that replaced blanket six months with a targeted, geographically and temporally limited regime within Union limits. It would also be weakened by a new Constitutional Court judgment that, after the Supreme Court judgment, annulled § 97(3). As of the September 2026 research cut that is not in the sources.
16. Diagnosing the bucket will say more than the sentence “the operator keeps it for half a year”
A practical test does not begin with how to get rid of data. It begins with what data are at issue at all. That is the difference between a legal diagnosis and advice on evasion.
What needs to be tested
The first question reads: are you requesting content, statutory retention, billing, marketing with consent, or access under § 88a? The content of a call or an SMS is not § 97(3). Either it is interception of future communication, or the operator is not supposed to have it from statutory data retention [1]. An extract of connections and cells for the last half-year is another bucket. Items from an invoice are another again.
The second question reads: is the request individual, or blanket? An individual order under § 88a and general retention of the data of practically all users are not the same interference. Precisely the blanket and indiscriminate character is the core of the European reservation [7][8][9].
Three tests — content, retention, billing
First test: are you requesting the words inside a call, the text of an SMS or the body of an e-mail? Then we are not in § 97(3). Second test: are you requesting traffic and location data that the statute requires to be retained for six months? Then we are talking about data retention and about access under the relevant legal title. Third test: are you requesting only data needed for an invoice or a complaint? Then you are looking at the contractual and accounting layer, not at state retention.
Before a request for an extract of connections
After six months statutory retention is destroyed, unless the statute provides otherwise [1]. Billing may have ended earlier. Marketing may have rested on consent and another scope. A backup in the phone, a cloud service or a chat application lives outside ZEK. A GDPR title at the operator may be a legal obligation, a legitimate interest or consent [22]. Three different reasons are not one bucket.
The test therefore does not say how to delete data. It says how to ask, so that the answer is not deceptively short.
17. The hidden cost is the blanket character that the text of the statute still names
Six months is at first glance an answer. In fact it is only an answer to one layer. The statute provides six-month retention of traffic and location data without content [1]. T-Mobile’s testimony in 2019 speaks of two months of billing in a narrower scope [4]. The CJEU speaks of the inadmissibility of general and indiscriminate retention for criminal cases [7][8]. The Supreme Court speaks of a conflict of the Czech blanket duty with Union law and of an apology by the state [9].
All of that can be true at the same time, if we do not pretend that it is the same thing. The content of a call is not metadata. Billing is not retention. Marketing is not a legal duty. Access under § 88a is not retention itself. The Constitutional Court 2019 is not the CJEU 2016. And a civil judgment about an apology is not the annulment of a paragraph.
The most hidden cost of the Czech rules is not only the period of six months. It is the blanket character. The duty applies to the traffic and location data of practically all subscribers of the obliged services, in advance and without suspicion. Precisely this property turns a technical archive into an interference with privacy. And precisely this property ran into Union case-law and then into the Supreme Court.
The question is therefore not how long an operator retains data about your phone. It is: which bucket who is requesting — content, billing, marketing, or six months of blanket retention — and under which frame it is to be measured whether that will still stand, when the text of the statute remains and the Union ceiling has already said no?
Related texts in this series
- May the police search your mobile phone? — a thing and memory, not six months at the operator.
- How does police location of a mobile phone work? — who may request data retention and what follows from a cell.
- Supreme Court judgment 30 Cdo 2556/2025 (30. 12. 2025) finds a Union conflict; the paragraph in ZEK as of September 2026 still stands.