Stuart Millar 

EU snooping plans dwarfed by UK laws

August 20: As the EU votes on allowing government access to personal data, the civil liberties battle is far from over, writes Stuart Millar.
  
  


Next month the EU council will vote to implement a widespread electronic surveillance regime, requiring service providers - phone, internet and postal - to retain the records of every customer in all 15 member states for up to two years.

The reason? In case law enforcement or intelligence agencies in any one of these countries decides, at some point in the future, that some or all of us is involved in some form of wrongdoing.

Civil liberties campaigners have denounced the move as the biggest threat to data privacy in a generation.

But in Britain, we are well ahead of the rest of Europe in the data snooping race.

Already legislation is in place for the police and intelligence agencies to access enough data to build up a complete map of an individual's private life.

Under the Regulation of Investigatory Powers Act 2000 (Ripa), authorities in the UK are already able to access customers' personal details, including: an individual's name, address, source and destination of emails, websites visited and at what time, phone calls made and received and mobile phone location data, which, by logging the base station used by the handset to connect to the network, can pinpoint the whereabouts of its owner whenever the phone is switched on.

The data is currently accurate to within a few hundred metres in cities, but GPS technology in 3G phones will be accurate to within a few metres.

Communications companies retain all this information - known as traffic data - for their own billing and marketing purposes. However, data protection law requires them to destroy it as soon as they no longer need it.

The period of retention ranges from a few days for web caches, to up to 20 months for mobile phone records.

After September 11, ministers decided these powers did not go far enough so they included provisions in anti-terror legislation rushed through parliament last autumn that would require service providers to retain traffic data for much longer than required - only for purposes of national security.

Unlike the EU proposals, which will require judicial authority for access to data, no court or executive warrant will be required in this country - authorisation will come internally from officers of superintendent rank or above.

Even calls made from office switchboards, emails, or web browsing on internal computer systems will not be immune.

Companies are regarded by the law as communications service providers and will therefore have to hand over any records required by the authorities.

The communications industry has reservations over the logistics of stockpiling such vast amounts of data.

While new storage technology makes it entirely feasible for the information to be stored - probably for a year online, then archived for the second year - internet and phone companies say the costs will be prohibitive.

But they are far more concerned about being deluged by thousands of demands from various agencies for customer records.

One internet service provider, Claranet, which has around 50,000 subscribers in the UK, told the Guardian that it was already receiving requests from the police for records.

The company fears that once law enforcement agencies have the power to demand, rather than request traffic data, the floodgates will open.

Ministers' response to this has been contradictory - on one hand they insist there will be very few orders issued for data, and on the other they argue that judges would be unable to handle all the applications they received quickly enough.

Human rights campaigners say that allowing the authorities to authorise themselves to access the records of any number of customers will inevitably lead to them conducting "fishing expeditions" against innocent citizens.

They also say the system will do little to fight crime - determined terrorists or criminals will be able to sidestep the authorities simply by using pay-as-you-go mobiles and anonymous email accounts on public terminals.

It is unlikely that logistics will bring the data snooping framework crashing down. Instead, it could be the law.

Last month the information commissioner, the official privacy watchdog, warned the Home Office that legal advice from an eminent QC suggested a serious risk that the system is illegal under human rights law.

A fundamental contradiction between the two laws governing data retention exists.

While the Anti-Terrorism Act 2001 allows traffic data to be retained strictly for national security purposes, Ripa will allow authorities to access this data even for minor investigations such as public health and tax collection.

So whatever happens at EU level next month, the battle over communications data is far from over.

 

Leave a Comment

Required fields are marked *

*

*