Don't believe State on data retention

NET RESULTS: Don't believe everything the Government tells you. In particular don't believe the official line being spun (and I do mean spun) about its proposed three-year Data Retention Bill.

At least two TDs have tabled questions to the Minister for Justice Mr McDowell about this proposal. The replies sent to both Fine Gael deputy Mr Richard Bruton and Sinn Féin deputy Mr Aengus Ó Snodaigh are - to say the least - disingenuous.

This proposal would require phone, mobile and internet service provider companies to hang on to the traffic information about every call, fax and email sent and received, and about every Web page visited.

The Government is portraying this enormously important privacy and business issue as if it's really only a minor bit of bother in need of some cleaning up. To quote a letter the Department sent to some deeply concerned industry groups, the Bill would just maintain "the status quo". But this Bill has absolutely nothing to do with maintaining the status quo.

The Minister's formal reply to Deputy Bruton states: "The time limit being considered is three years which is shorter than the period which licensed operators historically retained such information for billing purposes."

Don't believe it. Licensed operators such as Eircom, Vodafone and O2 did indeed retain data for six years - but when he heard of it, Data Protection Commissioner Mr Joe Meade challenged this policy. According to data protection laws, he felt six months was allowable. Eircom agreed to this time limit last October, as stated in a notice it enclosed in subscriber bills.

In addition, this information was not held in immediately accessible form. After a time period of six months to a year, it was "atomised" - made anonymous by separating out the constituent parts so that no-one could look at the records and connect a specific person to a specific call.

And finally, traffic information on email and internet usage has never been retained, and many in industry and privacy groups consider this part of the proposal to be even more worrying than call data proposals.

So, to imply that an acceptable industry norm is now simply being formalised is a gross distortion. And to suggest that three years is somehow a BOOST to our privacy - as the Minister's replies to both deputies indicates - beggars belief.

In what must rank as one of the most shocking violations of civil rights in the State's recent history, this Government also secretly directed telecommunications operators to retain such data anyway for three years last April through a cabinet decision that only came to light last month.

To do this, it used parts of the State's data interception acts to order the interception of all data traffic of its own citizens without telling them, the Oireachtas, or the judiciary. No other nation - including the terrorist-fearful US - has imposed mandatory data retention on its citizens.

This Government's actions were immediately registered worldwide, as the major human rights and privacy agencies across Europe and North America will confirm.

"If a Government wants to intercept or retain data, there has to be an existing law with a text that is accessible to the public, and the action must be proportionate to need. Here, there was no law, and it was done in secret," Mr Cedric Laurant, policy counsel for the Electronic Privacy Information Centre (EPIC), told me last week. "This is a potential violation of the EU Convention on Human Rights, Article 8."

EPIC is a well-known Washington DC-based organisation that has regularly and successfully challenged US laws to Supreme Court level.

Thus, Ireland appears to be the only western democracy to have brought in mandatory data retention in a deliberately hidden manner worthy of the worst tinpot dictatorships.

Finally, the Minister told both deputies that the Government has the right to retain data. "I feel it is necessary to point out that access to retained data for the purpose of the investigation of serious crime and in the interest of the security of the State is already allowed in law."

Well, I feel it is necessary to inform the Minister that such laws were brought in to allow interceptions to be placed on individuals suspected of a specific crime.

As three senior lawyers with a knowledge of constitutional law told me, it is a considerable - and likely, unconstitutional - stretch to imagine that such laws would ever have been intended to allow the surveillance of the data traffic of the entire State for crimes not yet committed.

One of the acts he cites requires judicial oversight of interceptions, for the reason that Government ministers were a little too enthusiastic and secretive in imposing interceptions in the past.

But because of Cabinet confidentially, no one in the judiciary knew that the entire State's data traffic was under an interception order, which raises another question about the direction's legality.

And of course, if the Freedom of Information Act is neutered, a proposal vigorously defended by the same minister, we could have been spared worrying about the Government's bizarrely secretive actions regarding data retention for a full decade.

• Karlin's tech weblog: http://radio.weblogs.com/0103966/