Electronic Privacy Information Center

Data Retention

Hot Topics | News | Conferences/Workshops | NGO Advocacy | Telecom/ISP Industry Comments | Other Critiques | Resources: Government/Public Institutions | Implementation of EU Dir. 2002/58 | U.S. Government Statements

For several years, law enforcement agencies in various countries have urged the adoption of "data retention" requirements, which would compel communications service providers to routinely capture and archive information detailing the telephone calls, e-mail messages and other communications of their users. While many providers currently retain certain traffic data for billing and other business-related purposes for short periods of time, there are no government-imposed retention requirements in the major industrialized countries.

However, in March 2006, the European Union enacted a Directive on Mandatory Retention of Communications Traffic Data, which requires Member States to require communications providers to retain communications data for a period of between 6 months and 2 years. Member States have until September 16, 2007 to transpose the requirements of the Directive into national laws; however, a delay of 18 additional months, until March of 2009, is available. 16 of the 25 member states of the EU have declared that they will delay the implementation of data retention of Internet traffic data for the additional period.

Hot Topics

News

Great Britain:

Ireland:

Spain:

Switzerland:

US:

General:

Also, check for updates on the Statewatch website and on "S.O.S. Europe - Statewatch Observatory on Surveillance in Europe" for a summary of the developments in the field of surveillance of telecommunications in Europe.

Conferences/Workshops

Advocacy Against Data Retention by Non-Governmental Organizations (NGOs)

Human Rights Concerns Regarding Data Retention

Many among the civil society and human rights organizations, as well as the EU Working Party on the Protection of Individuals with regard to the processing of personal data, have consistently urged the European Commission, the European Parliament and EU governments to refrain from taking measures that would establish generalized and preventive regimes of surveillance of electronic communications. Although the data retention provision of the new Directive on Privacy and Electronic Communications is supposed to constitute an exception to the general regime of data protection established by the directive, the ability of governments to compel ISPs and telecommunications companies to store all data about all of their subscribers can hardly be construed as an exception to be narrowly interpreted. The practical result is that all users of new communications technologies (the Internet, e-mail, mobile phone, etc.) are now considered worthy of scrutiny and surveillance in a generalized and preventive fashion for periods of time that States' legislatures or governments have the discretion to determine. Furthermore, because of the cross-border nature of Internet communications, this Directive is likely to have negative repercussions for citizens of other countries. There is a significant risk that non-European Union law enforcement agencies will seek data held in Europe that it can not obtain at home, either because it was not retained or because their national law would not permit this kind of access.

During the debates on the Directive, many members of the European Parliament and European Union privacy commissioners consistently opposed data retention, arguing that these policies are in contravention of the acceptable data protection practice of deleting data once it is no longer required for the purpose for which it was collected, and also in contravention of proportionality principles in accordance with constitutional laws and case law. Similarly, the Global Internet Liberty Campaign (GILC), a coalition of 60 civil liberties groups, organized a campaign against data retention. A letter was sent in May 2002 to all European Parliament members and heads of European Union institutions after more than 16,000 individuals from 73 countries endorsed it in a matter of days. The letter asserted that data retention (for reasons other than billing purposes) is contrary to well-established international human rights conventions and case law. (More information: Le droit au respect de la vie privée risque de perdre de sa substance (interview), Le Monde, May 29, 2002. [in Spanish)

Global Internet Liberty Campaign (GILC):

Transnational Radical Party:

Stop1984:

Kriptopolis

Enduring Freedoms:

International Federation of Journalists:

Foundation for Information Policy Research:

Telecommunications and ISP Industry Comments on Data Retention

The telecommunications and ISP industries have expressed strong concerns in regards to potential violations of fundamental rights, but more specifically regarding the high cost and management problems that long-term retention of communications data would entail. They have particularly pinpointed the lack of current evidence on the effectiveness of data retention for law enforcement investigative work.

Other Critiques of Data Retention

Resources: Government/Public Institutions

Origins of the EU Directive 2002/58/EC

In 1997, the European Union supplemented the EU Data Protection Directive of 1995 (Dir. 1995/46/EC) by introducing the Telecommunications Privacy Directive (Dir. 97/66/EC). This directive established specific protections covering telephone, digital television, mobile networks and other telecommunications systems. It imposed wide-ranging obligations on carriers and service providers to ensure the privacy of users' communications, including Internet-related activities. It covered areas that, until then, had fallen between the cracks of data protection laws. Access to billing data was severely restricted, as was marketing activity; information collected in the delivery of a particular communication was required to be purged upon completion of that call.

In July 2000, the European Commission issued a proposal for a new directive on privacy in the electronic communications sector (PDF). The proposal was introduced as a part of a larger package of telecommunications directives aimed at strengthening competition within the European electronic communications markets. As originally proposed, the new directive would have strengthened privacy rights for individuals by extending the protections that were already in place for telecommunications to a broader, more technology-neutral category of "electronic communications." During the process, however, the Council of Ministers began to push for the inclusion of data retention provisions, requiring Internet service providers and telecommunications operators to store logs of all telephone calls, e-mails, faxes, and Internet activity for law enforcement purposes. These proposals were strongly opposed by most members of Parliament. In July 2001, the European Parliament's Civil Liberties Committee approved the draft directive without data retention, stating:

The Civil Liberties Committee expressed itself in favour of a strict regulation of law enforcement authorities' access to personal data of citizens, such as communication traffic and location data. This decision is fundamental because in this way the EP blocks European Union States' efforts underway in the Council to put their citizens under generalised and pervasive surveillance, following the Echelon model.

Following the events of September 11, 2001, however, the political climate changed and the Parliament came under increasing pressure from member states to adopt the Council's proposal for data retention. The United Kingdom and the Netherlands, in particular, questioned whether the proposed privacy rules still struck "the right balance between privacy and the needs of the law enforcement agencies in the light of the battle against terrorism." The Parliament stood firm and up to a few weeks before the final vote on May 30, 2002, the majority of the Members of Parliament opposed any form of data retention. Finally, after much pressure by the European Council and European Union governments, and well-organized lobbying by two Spanish MEPs – respectively, MEPs Ana Palacio Vallelersundi and Elena Paciotti, members of the PPE (European Peoples' Party/Christian Democrats) and PSE (Social Democrats) political parties – the two main political parties (PPE and PSE, the center-left and center-right parties) reached a deal to vote in favor of the Council's position.

European Union:

G8:

International Conventions on Fundamental Rights:

Framework of data protection rules in the EU:

Implementation of Dir. 2002/58 in EU Member States

While a few countries have already established data retention schemes (e.g., Belgium, France, Spain and the United Kingdom), the implementation phase of the Directive's data retention provision may become bumpy in other Member States as the Directive could be considered as being in conflict with the constitutions of some EU countries, with respect to fundamental rights such as the presumption of innocence, the right to privacy, the confidentiality of communications, and freedom of expression. EU countries have until October 31, 2003 to implement the Directive.

Bulgaria

Czech Republic:
Denmark:

France:

Germany:

Hungary:

Ireland:

Lithuania:
The Netherlands:

Romania:

Slovakia:
Slovenia:

Spain:

Sweden:
United Kingdom:

U.S. Government Statements on Data Preservation and Retention

EPIC Privacy Page | EPIC Home Page

Last Updated: July 6, 2007
Page URL: http://www.epic.org/privacy/intl/data_retention.html