Experts agreed that retained data is to be considered sensitive, as it can be used to compose detailed personal profiles including data on location, as well as largely unrestricted insight into people's social networks. It became clear during the hearing that many providers have not yet implemented appropriate security systems to prevent data breaches. This is potentially due to the fact that there is currently no reimbursement of the costs to providers for complying, as the court's president Prof Hans-Jürgen Papier hinted.

eco made it clear that some 5,500 to 6,000 providers are legally required to gather data, although many of them are in no way equipped to meet the related technical or legal standards. When law enforcement authorities do file queries, they are often excessively broad and extensive, and sometimes even faulty.