Feeds

EU Data retention directive 'flawed, unlawful'

Lib Dem and digital rights group have privacy gripes

Security for virtualized datacentres

European state powers to retain data about customers’ telecommunications are set to come in for a kicking with the release of an offical report from the European Commission.

The report, due out this afternoon, is expected to evaluate and gently prod the Commission towards taking further steps to harmonising existing legislation (pdf) in this area and ensuring that it does not clash with the basic human right to privacy.

Others, including digital civil rights organisation EDRI and the Lib Dems Home Affairs spokeswoman in the European Parliament Baroness Ludford, are more critical.

According to the official report, which The Register has seen in leaked form only, privacy rights may be subject to limitation where such limitation is "proportionate to the general interest". It is right, the report says, that European states should retain data on telecommunications between their citizens, both as a means to break down barriers to trade and as a proportionate response to international terrorism and serious crime.

The directive as currently agreed applies to the fields of fixed network telephony, mobile telephony, internet access, email and internet telephony. Categories of data that may be retained include the source, destination, date and time of communication, as well as details on the type of equipment used.

The volume of data access requests has been steadily rising, with around two million data access requests made by the 19 European member states in 2008/9. The report notes significant variance between states, with just 100 requests made in Cyprus, against one million – or approximately half of all requests – originating in Poland.

The report concludes that the measures are working fairly well, but that there needs to be further harmonisation, particularly in terms of what is defined as serious crime. It also calls for greater transparency, a reduction in the number of authorities allowed to access data as well as fewer categories retained, and the reimbursement of costs for ISPs and telecoms operators.

EDRI is less sympathetic to the current situation. It has published a shadow report to the Commission evaluation, which takes the view that "over the past five years, the Data Retention Directive has proved to be an unnecessary and unprecedented violation of the fundamental rights of 500 million Europeans".

It adds: "According to the European Data Protection Supervisor, the Directive constitutes "the most privacy invasive instrument ever adopted by the EU."

EDRI, too, recognises the need for greater harmonisation and a broader agreement of what categories of activity might need to be under review. However, they are otherwise unimpressed by the report, accusing the Commission of never having investigated seriously the issues that this directive raises in respect of personal privacy – and of having further ignored key rulings in this area. In particular, it cites the Schecke ruling by the European Court of Justice, which held that "derogations and limitations in relation to the protection of personal data must apply only in so far as is 'strictly necessary'".

Data retention, it concludes, is an "unprecedented violation" of the fundamental rights of European citizens and is "unnecessary" to the fight against crime. It has been imposed on a flawed legal basis – and insufficient safeguards have been instituted in several states.

Closer to home, Liberal Democrat European justice and human rights spokeswoman and London MEP Sarah Ludford told us: "I opposed this directive from the very start, when the then Labour Home Secretary Charles Clarke managed to push it through, ostensibly in the name of counterterrorism. It gave the green light for mass surveillance and possible profiling of the general public.

"The constitutional courts of Germany, the Czech Republic and Romania have all ruled that the national laws implementing the directive were unconstitutional as they breached privacy protection."

"The law needs to be tightened up so that searches can only be conducted for the purpose of combating terrorism and other really serious criminality, and the current maximum data storage period of two years must be significantly reduced." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Apple's iPhone 6 first-day sales are MEANINGLESS, mutters analyst
Big weekend queues only represent fruity firm's supply
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Bill Gates, drugs and the internet: Top 10 Larry Ellison quotes
'I certainly never expected to become rich ... this is surreal'
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
EMC, HP blockbuster 'merger' shocker comes a cropper
Stand down, FTC... you can put your feet up for a bit
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.