EU passes Data Retention act SEC(2005) 1131

international | rights, freedoms and repression | other press Thursday December 15, 2005 19:00 by R. Isible

Start proxying and "purporting"!

The Commission has passed a directive which allows the retention of "traffic data" for the purposes of national security and safety.

This is explicitly /not/ supposed to apply to the contents of electronic communications (which includes voice calls) but instead to the origins, times and endpoints of communications and probably to any further location information (such as is obtainable with cellphone calls).

Specifically (Article 4 pg. 13):

• (a) data necessary to trace and identify the source of a communication;
• (b) data necessary to trace and identify the destination of a communication;
• (c) data necessary to trace and identify the date, time and duration of a communication;
• (d) data necessary to identify the type of a communication;
• (e) data necessary to identify the communication device, or what purports to be the communication device;
• (f) data necessary to identify the location of mobile communication equipment.

The above private information about you will be archived officially for up to a year without you being accused or suspected of a crime (I can't see what the length of retention limits are for data that law enforcement claims /is/ needed as evidence).

One of the sections of the directive discusses the need to retain data for analysis in "complex crimes" for years and presents the relevant counter arguments as being: 1)cost to carriers/ISPs and 2)privacy. The "compromise" worked out is retention for 1 year for telephonic communications and 6 months for "Internet usage".

The cited legal basis is Article 95 of the EC Treaty and the fact that it is worded as a directive rather than a regulation allows the prinicple of subsidiarity to provide an amount of variation in implementation within each state. Specifically the member states can determine for themselves which authorities have access to the data.

They argue that they've reached a balance between privacy and "security needs" but present no information about what metrics were used (how could they be?) in this determination: in other words they pulled this supposed balance out of their ass.

I wonder what they'll start arguing that VOIP is telephonic not Internet?