Submission made to the Criminal Law Reform Section of the Department of Justice in response to the European Union Draft Framework Decision on the Retention of Data which is being co-sponsored by Ireland, and which was submitted on the 30th of July 2004. The IIA Legal Working Group met with the Law Reform Division of the Department of Justice on 13 September 2004.
1.) It is not sufficiently clear how the balance with data privacy is to be maintained and respected.
2.) The measure appears to be focused as a measure for general and terror crimes. When these types of measures were first proposed they were mainly aimed at the terror type scenarios. The boundaries are being extended.
3.) There is no clear recognition of the considered arguments etc. which came out of the APIG in the UK; nor the considerable privacy lobby; the views of data commissioners; or the public who have expressed concerns.
4.) The measure as proposed does not take into account costs and how industry is expected to shoulder the burden. Cost only appears (from our initial reading) in R12 as a factor in determining the retention periods. This does not address, or adequately address, legitimate industry concerns. The measure will impose significant cost burdens on operators and ISPs as a consequence of having to store vast amounts of communications traffic data.
Operators will face significant cost burdens from:-
– Increasing storage costs year on year as the amount of data multiplies;
– Purchasing software and hardware to store traffic data; and
– Configuring software to ensure particularised data can be retrieved if and when requested by law enforcement agencies
5.) It is up to each Member State to draw up it own retention periods for different types of traffic data (subject to the mandatory (but subject to derogation) parameters in A4 (1) of between 12 – 36 months). Clearly there will be disparity and therefore different cost obligations on service providers in different Member States.
As far as Ireland is concerned the longer the retention period, the more likely it is that foreign direct investment projects in the electonic communications sector will decide to locate elsewhere.
6.) Differences will also arise in terms of how each Member State defines and prioritizes different types of traffic data. This will also lead to some EU disharmony.
7.) A key point will be who will have access to the data. This is not adequately addressed in the proposed measure.
8.) The Irish Internet Association Legal Working Group urge that there be a full consultation on the propsed measure and on whether Ireland should avail of any derogations and in particular the length of any retention period and the circumstances under which the data may be accessed.
Head of Information Technology Law Group
Matheson Ormsby Prentice
30 Herbert Street