Feeds

EU Data retention directive 'flawed, unlawful'

Lib Dem and digital rights group have privacy gripes

3 Big data security analytics techniques

European state powers to retain data about customers’ telecommunications are set to come in for a kicking with the release of an offical report from the European Commission.

The report, due out this afternoon, is expected to evaluate and gently prod the Commission towards taking further steps to harmonising existing legislation (pdf) in this area and ensuring that it does not clash with the basic human right to privacy.

Others, including digital civil rights organisation EDRI and the Lib Dems Home Affairs spokeswoman in the European Parliament Baroness Ludford, are more critical.

According to the official report, which The Register has seen in leaked form only, privacy rights may be subject to limitation where such limitation is "proportionate to the general interest". It is right, the report says, that European states should retain data on telecommunications between their citizens, both as a means to break down barriers to trade and as a proportionate response to international terrorism and serious crime.

The directive as currently agreed applies to the fields of fixed network telephony, mobile telephony, internet access, email and internet telephony. Categories of data that may be retained include the source, destination, date and time of communication, as well as details on the type of equipment used.

The volume of data access requests has been steadily rising, with around two million data access requests made by the 19 European member states in 2008/9. The report notes significant variance between states, with just 100 requests made in Cyprus, against one million – or approximately half of all requests – originating in Poland.

The report concludes that the measures are working fairly well, but that there needs to be further harmonisation, particularly in terms of what is defined as serious crime. It also calls for greater transparency, a reduction in the number of authorities allowed to access data as well as fewer categories retained, and the reimbursement of costs for ISPs and telecoms operators.

EDRI is less sympathetic to the current situation. It has published a shadow report to the Commission evaluation, which takes the view that "over the past five years, the Data Retention Directive has proved to be an unnecessary and unprecedented violation of the fundamental rights of 500 million Europeans".

It adds: "According to the European Data Protection Supervisor, the Directive constitutes "the most privacy invasive instrument ever adopted by the EU."

EDRI, too, recognises the need for greater harmonisation and a broader agreement of what categories of activity might need to be under review. However, they are otherwise unimpressed by the report, accusing the Commission of never having investigated seriously the issues that this directive raises in respect of personal privacy – and of having further ignored key rulings in this area. In particular, it cites the Schecke ruling by the European Court of Justice, which held that "derogations and limitations in relation to the protection of personal data must apply only in so far as is 'strictly necessary'".

Data retention, it concludes, is an "unprecedented violation" of the fundamental rights of European citizens and is "unnecessary" to the fight against crime. It has been imposed on a flawed legal basis – and insufficient safeguards have been instituted in several states.

Closer to home, Liberal Democrat European justice and human rights spokeswoman and London MEP Sarah Ludford told us: "I opposed this directive from the very start, when the then Labour Home Secretary Charles Clarke managed to push it through, ostensibly in the name of counterterrorism. It gave the green light for mass surveillance and possible profiling of the general public.

"The constitutional courts of Germany, the Czech Republic and Romania have all ruled that the national laws implementing the directive were unconstitutional as they breached privacy protection."

"The law needs to be tightened up so that searches can only be conducted for the purpose of combating terrorism and other really serious criminality, and the current maximum data storage period of two years must be significantly reduced." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
EU: Let's cost financial traders $400m a day, because EVIL BANKERS. Right?
Wait 'til this one hits your pension fund where it hurts
Systems meltdown plunges US immigration courts into pen-and-paper stone age
Massive outage could last four weeks, sources claim
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
prev story

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.