Section: Justice & right | Technology & AI Author: IN Reading Length: ~27 min Sources and further reading: 22 items Topics: operator, data retention, operational data, location data, privacy, criminal proceedings SEO / Working Title: How long does the carrier store your phone data?
How long does the carrier store your phone data? The question sounds simple until we notice that we are not comparing one thing. Six months can be valid for traffic data and still lack call content. Two months of billing with one operator in 2019 is not a legal deadline. The Constitutional Court could uphold the amendment in 2019, and the Supreme Court in December 2025 could not reconcile the same generality with EU law. And the judgment on apology does not need a paragraph in the Collection to delete. The following text therefore does not ask what the operator is recording. It asks which bucket is claimed by whom and by which framework is legality measured.
1. Two months were mentioned in T-Mobile's interrogation. There are six in the law. There's nothing worth talking about.
The subscriber asks the operator how long they keep the phone data. Operator shows § 97 odst. 3 of the Electronic Communications Act: six months of traffic and location data, excluding message content [1]. The witness for T-Mobile Czech Republic, a.s., in the proceedings before the Constitutional Court in 2019, says something more specific: for its own needs of billing and complaints, it keeps data in a narrower range for two months [4]. The police authority does not ask for the invoice, but for access according to § 88a of the Criminal Code [10]. And the Court of Justice of the EU does not ask about the convenience of national regulation, but about the generality of the intervention under EU law [7][8].
At first glance, it is a dispute of half a year or two months. In fact, each describes a different bucket. One bucket is legal data retention. The second is billing and complaints. The third is consent marketing. The fourth is judicial access to data. The fifth is the constitutional framework. The sixth is the Union framework. Whoever mixes them up can easily come to the conclusion that the operator records calls for half a year. That sentence is wrong.
The content of the call does not belong here. § 97 odst. 3 explicitly states that the content of messages is not stored or transmitted under this obligation [1]. This is not to say that metadata is banal. The Constitutional Court has already said with regard to telephone data that even the numbers called, time, duration of the call and base stations fall under the protection of Article 13 of the Charter [14]. It just means that content and traffic data are not the same.
The file about the phone in the hands of the police is a different text. There it is a secured device, stored content and § 113a. This is the operator's network metadata. Device, network and invoice meet in one user experience. Legally, however, it stands in different columns.
There is no content of the call with the operator for six months. Billing is not data retention.
— Jiný Kontext
2. Operator data has at least six layers
The first layer is network metadata. Who called whom, when, for how long, from which cell, with which device or subscriber identification. Decree No. 357/2012 Coll. details the range of operational and location data stored and transmitted, including source and addressee identification, time, method and duration of communication [2]. For e-mail protocols, it does not target the message body. Aiming for a trail of traffic.
The second layer is the operator's own operation. Invoicing, complaints, network operation, customer care. This may require some data, but a different scope and a different time. In the documents, we have a firmly documented number of two months only as a testimony of T-Mobile in the proceedings Pl. ÚS 45/17, for own needs and in a narrower scope [4]. It's not the law. It's not the whole market. It's not 2026.
The third layer is legal detention for the state. § 97 odst. 3 requires persons providing a public communications network or providing a publicly available electronic communications service to store data for a period of six months [1]. This number measures the legal obligation of data retention, not the existence of call content and not the billing practices of each company.
The fourth layer is a judicial access lock. In criminal proceedings, it is § 88a. It does not regulate the actual storage with the operator. Regulates when and how data on telecommunications traffic can be requested [10]. The older version of § 88a was itself the subject of intervention by the Constitutional Court in the decision Pl. ÚS 24/11 [11].
The fifth layer is the European ceiling. From Digital Rights Ireland to Tele2 to La Quadrature du Net, the CJEU rejects blanket and indiscriminate retention of traffic and location data to fight crime, with narrow exceptions [6][7][8]. This is a different level of control than the question of what is currently stated in the Czech law.
The sixth layer is the Czech pendulum. The Constitutional Court abolished the old regulation in 2011 [3]. The legislator, after making adjustments, put it back on six-month storage. In 2019, the Constitutional Court rejected the proposal for cancellation [5][13]. In December 2025, the Supreme Court found a contradiction with EU law and imposed an apology on the state [9]. However, the paragraph in the text of the law persists regarding the status of the search in September 2026.
3. The best diagnosis is the one that names the bucket first
Misdiagnosis does not begin with ill will. It starts with the word data. Invoice data, traffic data, marketing data, wiretapping data, phone data, chat service data. In ordinary speech, they fit into one sentence. Not in law.
| A kind of failure | What does he look like? | How to test it | What is damage limitation |
|---|---|---|---|
| Content as retention | Expectation that the operator has a recording of the call | Read § 97 odst. 3, sentence on content prohibition | The content is § 88, not retention |
| Billing as law | "Two months" is cited as the ZEK deadline | Point 34 Pl. ÚS 45/17: one operator, year 2019 | Check with another operator for their rules |
| ÚS 2019 as EU 2025 | "It is constitutional, therefore also Union" | Separate Pl. ÚS 45/17 from Tele2 and NS 2025 | Two frames, two results |
| Apology as cancellation | The civil judgment is read as a derogation award | Compare Pl. ÚS 24/10 with NS 30 Cdo 2556/2025 | A paragraph in the Collection can last |
| § 88a like everything | A request without threshold and purpose | Read the threshold and conditions of the criminal code | An individual order is not a blanket sieve |
Interpretation scheme: One telephone trace can be an invoice for the user, an operational record for the operator, data retention for the state and an interference with fundamental rights for the court. The dispute is not resolved by the word "data". It is resolved by naming the purpose and mode.
This is the practical value of accuracy. We don't ask if the operator has anything. We ask why it has it, to what extent, for how long, who wants to get to it and under which law the legality is tested. Only then does the answer make sense.
Another distinction is often hidden. The existence of data is not the same as authorization to transfer it. Data may be created for network operation, remain for invoicing, be retained due to legal obligation, or be processed with consent. Each route has a different title and a different control addressee. When the state requests a statement, it is not enough to know that the data is somewhere. It must be clear why it exists and under which provision it opens.
4. The content of the message is not operational or location data
§ 97 odst. 3 of the Electronic Communications Act is harsh precisely where public perception is often mistaken. It imposes the retention of traffic and location data for six months, but also stipulates that the content of the messages may not be stored or transmitted [1]. The call, the text of the SMS or the body of the e-mail are not data retention under this provision.
This is not to say that metadata is an innocent trifle. Movement, the rhythm of life, the circle of contacts and moments of crisis can sometimes be read from data on times, numbers, cells and IP. The Constitutional Court in the decision II. ÚS 502/2000 extended the protection of Article 13 of the Charter to called numbers, time, duration and base stations [14]. So the protection is not only reserved for the words inside the conversation.
Nevertheless, the difference is decisive. If someone requests the content of future communications, we look at interception according to § 88. If someone requests operational and location data from the operator, we look at § 88a and § 97 of the ZEK. If someone is reading a saved chat on a secured phone, we look the other way. Accuracy is not academic. It determines the threshold, the judicial filter and the consequences of the error.
Therefore, the sentence "the operator has my calls for half a year" is inaccurate in two ways. It may have call data for a legal period. It should not have call content from data retention. And it may have other data for other purposes, like billing, but that's not the same bucket.
5. Data retention is not billing. Billing is not marketing.
In the hearing in the proceedings Pl. ÚS 45/17, a number was sounded that leads to an abbreviation. The witness for T-Mobile stated that for its own needs, i.e. invoicing and complaints, it keeps operational and location data in a narrower range for a period of two months [4]. This is documented. But its precise meaning is narrower than a public slogan.
Two months is not a legal data retention period. The legal obligation in § 97 odst. 3 speaks of six months and of persons providing public networks or providing publicly available electronic communications services [1]. Two months were the testimony of one operator in 2019 about his own need in a narrower scope. It's about billing and claims, not full state retention.
Billing is also not marketing. The same finding point states that marketing purposes only occurred with consent and that it was retained for six months for approximately 70 percent of this one company's customers in 2019 [4]. This number measures the witnessed condition of one operator. It does not measure the Czech market in 2026 and does not measure the legal obligation of all operators.
The practical conclusion is simple. If you read two months, ask: two months of what, with whom and when? If you read six months, ask: six months according to which provision and without the content of what? Without these postscripts, the numbers are only apparently accurate.
6. Keeping with the operator is not wiretapping. Not even looking at the phone.
Wiretapping according to § 88 of the Criminal Code aims at the content of future telecommunications traffic. This is a different intervention than data retention. According to § 97 odst. 3, the operator does not keep the content of calls in stock. If the content of future communication is to be captured, the path of wiretapping and its conditions must be followed.
Finding a phone is another world. The seized device in the hands of the police, its stored content and from January 1, 2026 § 113a of the Criminal Code are not an operator's network. The phone can contain messages, photos and communication history. The operator may store operational and location data. These layers may relate to the same person and the same day, but they are not legally identical.
Confusion arises when one practical story is told with one verb. "The police were monitoring the phone." This can mean wiretapping, extracting operating data, location data, inspecting the device, or a combination of several actions. Everyone has a different threshold. Everyone has a different document. Everyone has a different defense option.
It does not follow that one action never follows another. Investigations can work with multiple resources. It follows that one act may not retroactively legalize another. A statement from the operator is not permission to read the phone. Secured phone is not legal data retention. And wiretapping is not billing.
7. The decree details IMSI, IMEI and cells. It does not write the body of the message.
The law says the category. Decree No. 357/2012 Coll. breaks down the scope. It works with the data needed to trace and identify the source and addressee of the communication, with date, time, method and duration, with device identification and with location data [2][19]. In the mobile network, this means IMSI, IMEI and cell data, among others.
Those are technical sounding words. However, their legal meaning is understandable. They don't say what you said. They tell when and from where the communication passed through the network, who was identified as the participant or device, and what the technical context of the connection was. That is why they can be sensitive, even if they are not content.
For e-mail protocols, the difference is even more obvious. The operational data can show the address, time or technical parameters. The message body is something else. If it is said in a normal debate that emails are being kept, it needs to be stopped. The traffic trace is kept, not legally the entire text of the e-mail under data retention.
The decree therefore does not extend § 97 to the content. It specifies what operational and location data is stored, transferred and disposed of. It's a bucket range map, not a secret playlist.
8. Constitutional conformity 2019 is not the same as Union conformity 2014-2025
In 2011, the Constitutional Court abolished the old Czech regulation of data retention. Finding Pl. ÚS 24/10 of 22 March 2011, promulgated under No. 94/2011 Coll., canceled the then § 97 odst. 3 a 4 and Decree No. 485/2005 Coll. for lack of guarantees [3]. That was a derogation finding. The paragraph disappeared.
The legislator then revised the regulation, shortened the time and clarified the conditions. When the new regulation came before the Constitutional Court again, the result was different. Finding Pl. ÚS 45/17 of May 14, 2019 rejected the proposal for cancellation and called six months a period that is not clearly unreasonable [5][13].
However, this is not the end. Meanwhile, the EU Court of Justice ruled according to the EU framework: Directive 2002/58, the Charter of Fundamental Rights of the EU and its articles on privacy, personal data protection, freedom of expression and the limits of restrictions on rights [12][17]. This is a different frame of reference than the domestic constitutional test.
Therefore, results may vary. In 2019, the Constitutional Court could say that the Czech regulation passes the test it used. The Supreme Court in 2025 could say that blanket and preventive retention of virtually all users does not stand up to EU law [9]. It's not a logical fallacy. It is a clash of two control planes.
9. The CJEU annulled the directive. Then he banned blanket detention for criminal matters. Then he left narrow exceptions.
The first major cut came on April 8, 2014. The EU Court of Justice, in joined cases C-293/12 and C-594/12, Digital Rights Ireland, declared the Data Retention Directive 2006/24/EC invalid [6]. It was not a Czech law. It was an EU directive that imposed the obligation of general storage on member states.
The second cut came on 21 December 2016. In cases C-203/15 and C-698/15, Tele2 Sverige and Watson, the CJEU interpreted Article 15(1) of Directive 2002/58 as precluding national legislation which provides for the blanket and indiscriminate retention of traffic and location data of all subscribers and registered users for the purpose of combating criminal activity [7].
The third step came on 6 October 2020 in Cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net [8]. The CJEU upheld the prohibition of general and indiscriminate retention for the fight against criminal activity, but admitted narrow options, especially in the case of a serious threat to national security, and targeted or time-limited regimes. This is not a return to a blanket preventive stockpile. It's an exception map.
National security related ranks, such as Privacy International or the Commissioner of An Garda Síochána, belong in the same context [16]. It shows that the European ceiling is not a simple "never". It is "not so broadly for this purpose". The difference is important. It allows you to build targeted modes, but not hide a general sieve behind the word security.
10. The Supreme Court found a contradiction. The paragraph in the Collection continues until September 2026.
Supreme Court by judgment of 30 December 2025, file no. 30 Cdo 2556/2025, according to the press release of 8 January 2026, rejected the appeal of the state and confirmed the illegality of the general storage of electronic communication data [9]. The reason was the contradiction of § 97 odst. 3 ZEK with EU law, as it aims at the preventive, indiscriminate storage of the data of practically all users.
However, the decision was not a derogatory ruling of the Constitutional Court. The Supreme Court decided a civil dispute about an apology. He imposed an obligation on the state to apologise. He did not delete the paragraph from the Collection. This is an inconvenient but crucial distinction.
Therefore, two sentences apply side by side to the state of research in September 2026. The text of § 97 odst. 3 remains in the law [1]. At the same time, the Supreme Court noted its contradiction with EU law [9]. Operators and the state are thus caught in a bind: on the one hand, the national obligation, on the other hand, directly effective EU limits and jurisprudence that rejects generality.
This is not a steady state. But it is a state that cannot be simplified either to "everything is fine" or to "the paragraph no longer exists." The exact sentence reads: the paragraph in the text of the law continues, its general obligation is contrary to EU law according to the Supreme Court.
11. A judgment of apology is not a derogatory judgment
The difference between cancellation and apology is a practical one. In 2011, the Constitutional Court annulled the then § 97 odst. 3 a 4 and the implementing decree [3]. This created a loophole that the legislator had to address with a new regulation. That is a derogatory statement.
In 2025, the Supreme Court dealt with the state's responsibility for improper official procedure or illegal intervention in civil proceedings for an apology. He established the contradiction of blanket storage with EU law and confirmed the obligation of an apology [9]. This is a strong legal signal. But it does not have the same technical effect as the annulment of the law by the Constitutional Court.
That is why caution is in order even in the media sentence. "Supreme Court overturns data retention" is inaccurate. "The Supreme Court confirmed the illegality of widespread storage and the state should apologize" is closer. And "§ 97 odst. 3 on the status of the search continues to be in the law" completes the picture.
A judgment of apology is not a derogatory finding. The paragraph can go on.
— Jiný Kontext
12. A request under § 88a is not a request for everything the operator has
§ 88a of the Criminal Code governs the order to ascertain data on telecommunications traffic [10]. It's not a one-size-fits-all "give it all" requirement. It has a threshold, a purpose and a procedural mode. According to the wording for 2026, it aims for an intentional crime with an upper limit of the penalty rate of at least three years and for other enumerated cases [10]. This number measures the data access threshold, not the operator's obligation to create the data.
Accessing data is not the same as keeping it. ZEK determines what and how long is stored across the board [1]. § 88a determines when the authority in criminal proceedings can request data. These two provisions meet but do not have the same function.
According to § 88a odst. 3, the user's consent can replace the order [10]. Nor does it make him a limitless authority. Consent has its scope and subject matter. If someone agrees to provide a certain statement, it does not mean consent to wiretapping, to the contents of the phone or to an indefinite hunt in all data.
Older history shows that even the Access Clause had to undergo constitutional review. The Constitutional Court in the ruling Pl. ÚS 24/11 of 20 December 2011 repealed the then § 88a [11]. This reminds us that it is not enough to have the data stored. It is also necessary to have a reviewable and reasonable approach.
13. Two months with one operator in 2019 is not the 2026 market standard
Two months is a useful number only if a caveat remains with him. In point 34 of the finding Pl. ÚS 45/17, a witness for T-Mobile stated that the operator keeps operating and location data in a narrower range for two months for its own needs for billing and complaints [4]. That is an accurate statement. Its boundaries are part of the assertion.
It is not a legal deadline. It is not a statement about all operators. It's not a 2026 figure. It's not a whole bucket of data retention either. If someone rewrites this sentence to "operators keep data for two months", they throw out the source, the period, the population and the purpose.
With another operator, you need to read its conditions, information obligations according to the GDPR, records of activities and responses to a specific request. GDPR is important here not as another number, but as a language of purposes: legal obligation, legitimate interest, consent [22]. Each title can mean different data and different time.
Public records in the documents do not allow us to say that all operators in 2026 are invoicing from the same two-month window. The exact sentence is longer. But that's exactly why it's accurate.
14. The first three months as the most common window are testimonies. Not the legal maximum.
The same point of discovery Pl. ÚS 45/17 states that the most frequently authorized authorities request data for the first three months from the creation of the data [4]. That's interesting. It says something about the operational practice described by the witness in 2019 towards one operator. It does not say that the legal maximum is three months.
The legal maximum data retention according to § 97 odst. 3 is six months [1]. After this period, the data must be disposed of, unless the law provides otherwise. Six months measures the retention obligation. Three months measures the most frequent application window described by witnesses. Two months measures a narrower billing need. Three numbers. Three buckets.
The Constitutional Court in Pl. ÚS 45/17 cited partial operating estimates and testimony. It is not an open complete data set of all requests from the police or all authorized authorities. There are no public state statistics in the documents that could be used for the total number and success rate of statements.
Therefore, it is good to treat the number three with the same care as the number two. It helps to describe the practice. It cannot replace the law. And it must not at all create the impression that after three months no retention data can exist.
15. The Czech pendulum 2011–2026 did not erase the tongs between the obligation and the EU ceiling
The Czech story of data retention is not a straight line. In 2011, the Constitutional Court abolished the old regulation [3]. In 2012, the legislature adopted a new construction, including a six-month retention period. In 2019, the Constitutional Court rejected the proposal for cancellation [5][13]. In 2025, the Supreme Court said that blanket preventive retention of virtually all users contravened EU law [9].
In the meantime, European jurisprudence moved and refined the ceiling. Digital Rights Ireland struck down the directive [6]. Tele2 rejected national blanket and indiscriminate retention to fight crime [7]. La Quadrature du Net described narrow exceptions and targeted regimes [8]. However, the Czech text of the law has not changed to a form that would eliminate this tension.
This is a legal uncertainty, not just an academic dispute. The operator should read the Czech law. The court must also read EU law. An individual has the right to the protection of privacy and personal data. Law enforcement agencies want an investigative tool. Everyone has a piece of truth if they describe their own layer. But joint decision is bad if it ignores flatness.
The thesis of this article would be weakened by an amendment that replaces the general six months with a targeted, geographically and time-limited regime according to the Union's borders. It would also be weakened by a new finding of the Constitutional Court, which would annul § 97 odst. 3 after the judgment of the Supreme Court. There is no information on the status of the search in September 2026 in the documents.
16. Bucket diagnostics will say more than the phrase "the operator keeps it for half a year"
The practice test doesn't start with how to get rid of the data. It starts with what kind of data it is. That's the difference between legal diagnosis and bypass advice.
What needs to be tested
The first question is: are you requesting content, legal retention, billing, marketing with consent, or § 88a access? The content of the call or SMS is not § 97 odst. 3. Either it is an interception of future communications, or the operator is not supposed to have it due to legal data retention [1]. The list of connections and cells for the last six months is another bucket. The invoice items are different.
The second question is: is the request individual or general? An individual order under § 88a and the general retention of data of practically all users are not the same intervention. It is the flatness and indiscriminate nature that are at the heart of the European reservation [7][8][9].
Three tests — content, retention, billing
First test: are you asking for the words inside the call, the text of the SMS or the body of the email? Then we are not in § 97 odst. 3. Second test: are you requesting operational and location data, which the law requires to be kept for a period of six months? Then we talk about data retention and access according to the relevant legal title. Third test: are you only asking for the data needed for the invoice or complaint? Then you are looking at the contractual and accounting layer, not the state retention.
Before requesting a connection statement
After six months, the statutory retention is liquidated, unless the law provides otherwise [1]. Billing could have ended earlier. Marketing could stand on consent and a different scale. A phone backup, a cloud service or a chat application lives outside of ZEK. The GDPR title for the operator can be a legal obligation, legitimate interest or consent [22]. three different reasons are not one bucket.
So the test doesn't tell you how to delete the data. It tells how to ask so that the answer is not deceptively short.
17. The hidden cost is the flatness, which the text of the law keeps naming
Six months is the answer at first glance. Actually, it's just a one-layer answer. The law provides for a six-month retention of content-free traffic and location data [1]. The testimony of T-Mobile in 2019 speaks of two months of billing in a narrower range [4]. The CJEU speaks of the inadmissibility of blanket and indiscriminate storage for criminal matters [7][8]. The Supreme Court speaks about the contradiction of the Czech blanket obligation with EU law and about the state's apology [9].
All of these can be true at the same time, as long as we don't pretend they are the same thing. Call content is not metadata. Billing is not retention. Marketing is not a legal obligation. Access under § 88a is not retention itself. The Constitutional Court 2019 is not the CJEU 2016. And the civil judgment on apology is not the repeal of the section.
The most hidden cost of the Czech adjustment is not just the six-month period. It is flatness. The obligation applies to the operational and location data of practically all participants of mandatory services, in advance and without suspicion. It is this feature that makes the technical archive an invasion of privacy. And it was this feature that came across in the EU jurisprudence and subsequently at the Supreme Court.
So the question is not how long the operator keeps your phone data. It reads: which bucket is requested, content, billing, marketing, or six months of general retention, and according to which framework is it to be measured whether it will still stand when the text of the law continues and the EU ceiling has already said no?
Related texts in this series
- Can the police search your cell phone? — thing and memory, not six months with the operator.
- How does police mobile phone tracking work? — who can request data retention and what flows from the cell.
- Judgment NS 30 Cdo 2556/2025 (30. 12. 2025) states the EU contradiction; the section in the ZEK continues until September 2026.