Feeds

EU Data retention directive 'flawed, unlawful'

Lib Dem and digital rights group have privacy gripes

Top three mobile application threats

European state powers to retain data about customers’ telecommunications are set to come in for a kicking with the release of an offical report from the European Commission.

The report, due out this afternoon, is expected to evaluate and gently prod the Commission towards taking further steps to harmonising existing legislation (pdf) in this area and ensuring that it does not clash with the basic human right to privacy.

Others, including digital civil rights organisation EDRI and the Lib Dems Home Affairs spokeswoman in the European Parliament Baroness Ludford, are more critical.

According to the official report, which The Register has seen in leaked form only, privacy rights may be subject to limitation where such limitation is "proportionate to the general interest". It is right, the report says, that European states should retain data on telecommunications between their citizens, both as a means to break down barriers to trade and as a proportionate response to international terrorism and serious crime.

The directive as currently agreed applies to the fields of fixed network telephony, mobile telephony, internet access, email and internet telephony. Categories of data that may be retained include the source, destination, date and time of communication, as well as details on the type of equipment used.

The volume of data access requests has been steadily rising, with around two million data access requests made by the 19 European member states in 2008/9. The report notes significant variance between states, with just 100 requests made in Cyprus, against one million – or approximately half of all requests – originating in Poland.

The report concludes that the measures are working fairly well, but that there needs to be further harmonisation, particularly in terms of what is defined as serious crime. It also calls for greater transparency, a reduction in the number of authorities allowed to access data as well as fewer categories retained, and the reimbursement of costs for ISPs and telecoms operators.

EDRI is less sympathetic to the current situation. It has published a shadow report to the Commission evaluation, which takes the view that "over the past five years, the Data Retention Directive has proved to be an unnecessary and unprecedented violation of the fundamental rights of 500 million Europeans".

It adds: "According to the European Data Protection Supervisor, the Directive constitutes "the most privacy invasive instrument ever adopted by the EU."

EDRI, too, recognises the need for greater harmonisation and a broader agreement of what categories of activity might need to be under review. However, they are otherwise unimpressed by the report, accusing the Commission of never having investigated seriously the issues that this directive raises in respect of personal privacy – and of having further ignored key rulings in this area. In particular, it cites the Schecke ruling by the European Court of Justice, which held that "derogations and limitations in relation to the protection of personal data must apply only in so far as is 'strictly necessary'".

Data retention, it concludes, is an "unprecedented violation" of the fundamental rights of European citizens and is "unnecessary" to the fight against crime. It has been imposed on a flawed legal basis – and insufficient safeguards have been instituted in several states.

Closer to home, Liberal Democrat European justice and human rights spokeswoman and London MEP Sarah Ludford told us: "I opposed this directive from the very start, when the then Labour Home Secretary Charles Clarke managed to push it through, ostensibly in the name of counterterrorism. It gave the green light for mass surveillance and possible profiling of the general public.

"The constitutional courts of Germany, the Czech Republic and Romania have all ruled that the national laws implementing the directive were unconstitutional as they breached privacy protection."

"The law needs to be tightened up so that searches can only be conducted for the purpose of combating terrorism and other really serious criminality, and the current maximum data storage period of two years must be significantly reduced." ®

SANS - Survey on application security programs

More from The Register

next story
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.