UK plans for the retention of data for 12 months
01 November 2001
The UK government is to introduce a "voluntary code" for all telecommunication providers to retain communications data for 12 months. The details of the government's plan is set out in the "Supplemental Regulatory Impact Assessment: Retention of communications data" accompanying the planned legislation in the Anti-Terrorism, crime and security Bill currently before parliament.
The Assessment makes quite explicit that this surveillance is not only to cover "national security" (terrorism) but also "the prevention or detection of crime or the prosecution of offenders". While it is currently proposed that data will have to be retained under a "voluntary code" the Home Secretary will also "have reserve powers to impose a mandatory code of practice by order" - by "order" means secondary legislation passed by parliament "on the nod".
The Assessment argues that retention of data is needed because business is retaining less data and:
"combined with pressure from the privacy lobby, this is leading to a decrease in data retention overall"
Under the heading "Civil liberties" the Assessment says that "Mass retention has obvious civil liberties implications" and that "A balance must therefore be drawn between security and privacy" and thus concludes:
"Data relating to specific individuals under investigation will only be available if data relating to the communications of the entire population is retained"
The Assessment says that the recommended period for data retention will be 12 months (the time-limit discussed in EU working parties) and will be accessed by "the security, intelligence and law enforcement agencies". The power will be "reviewed every two years" and be "discarded if no longer felt to be necessary" - like all so-called "temporary" measures it is hard to see the agencies agreeing to give up access to such intrusive surveillance for the foreseeable future.
"Supplemental Regulatory Impact Assessment: Retention of communications data": Text (pdf)
Proposal dumps EU data protection laws, UK derogates yet again
The government is, at a stroke, dumping the EU Directive on data protection and privacy (1997). This only allows data to be retained for the purpose of billing (ie: for the benefit of the customer). Like the derogation from the ECHR on the indefinite detention of terrorist "suspects" the UK government is reneging on one of the fundamental rights of privacy established by the EU.
It is also pre-empting the ongoing discussion in the European Union on the proposal currently before the European Parliament to update the 1997 directive. The parliament is opposed to the general retention of data, while the Council of the European Union (the 15 governments) want to introduce an EU-wide policy of data retention. The outcome is based on "co-decision", that is, that the European Parliament and the Council have to agree on the proposal.
A report by the Council's own Legal Service, dated 12 October, said that governments have all the power they need to combat terrorism under the existing 1997 Directive and the proposal on the table (which leaves Article 15.1 unchanged). The Legal Service reports also says that any measures adopted under this Article must be: i) be necessary; ii) cater for pressing needs; iii) remain proportionate to the legitimate goal being pursued; iv) include legal guarantees provided to individuals so as to prevent and penalise arbitrary interference. In its opinion a derogation under Article 15.1. could not be extended to cover criminal investigations in general.
The UK government by derogating, yet again, from the obligations under the 1997 EU Directive on privacy in telecommunications is claiming justification to combat terrorism while extending the scope of its powers to cover all criminal investigations however minor. It remains to be seen whether this position will be challenged.
For background and documentation see:
S.O.S