The UK Government has been consulting on the latest phase of transposition of Directive 2006/24/EC – the Communications Data Retention Directive (for an overview of the Directive see here). The Directive imposes requirements on providers of publicly available electronic communications services or publicly available networks to retain traffic and location data in order to assist law enforcement authorities with the investigation and prevention of terrorism and serious crime. Last autumn the UK transposed the requirements of the Directive in relation to fixed and mobile data (see here). Then, in August this year, the Home Office published the draft Data Retention (EC Directive) Regulations 2008 which addresses retention obligations for internet access, internet email and internet telephony data. The extensive list of data to be retained is that necessary to trace the source, destination, time, date, duration and type of communication plus that necessary to trace the user’s communications equipment. These new regulations will also supersede the 2007 Regulations, thus bringing the rules for retention of fixed, mobile and Internet data under a single piece of legislation. The transposition deadline for the internet and email data rules is 15 March 2009. The new rules will replace the Code of Practice For Voluntary Retention of Communications Data, made under the Anti Terrorism Crime and Security Act 2001, which has governed the retention of internet and email data (and, until last year, fixed and mobile call data) since 2004 (discussed here).
Most aspects of the new rules are fixed by the Directive. As well as retaining the prescribed data for the minimum period, service providers will be obliged to meet security and storage requirements and report annually to the Home Secretary with disclosure statistics. However, the UK has flexibility over three key aspects of implementation.
* Length of retention periods: the Government proposes a minimum retention period of 12 months, with a power for the Secretary of State to specify shorter or longer periods (subject to a minimum of six and maximum of 24 months) by notice to a service provider;
* Reimbursement of costs: the Directive does not oblige Member States to meet service providers’ costs, but drawing on the experience of the voluntary regime over the past few years, the Government believes that investment in good data retrieval systems is key to realising the benefits of the legislation. It therefore proposes to reimburse expenditure on additional capacity, provided this is uniquely for the purpose of providing retention and disclosure for the purposes of the new regime. The relevant draft regulation gives the Home Secretary power to reimburse the industry, rather than imposing an obligation. Reimbursement is also subject to notification and audit conditions.
* Clarification of which service providers are affected: The Government aims to minimise the burden on industry by avoiding duplicative retention of the same information by different players in the hierarchy, i.e. ensuring that the data is only retained at the network level. The consultation seeks views on whether the draft regulations make it sufficiently clear to communications providers whether they would be covered or not.
The consultation also seeks views on whether the data to be retained under the new rules is sufficiently clear, whether the draft rules will have a detrimental impact on competition and whether the rules provide a workable framework for transposition of the Internet aspects of the Directive.
The UK legislative framework for communications data retention is at present unusually complicated and still in a state of evolution. The latest set of Regulations, once in force, will sweep away the current two tier, part mandatory, part voluntary regime; however, they are unlikely to remain on the statute book for very long since the government plans to introduce primary legislation in this area. The new Communications Data Bill (discussed here) is expected to be published after the Queen’s speech in December 2008. It is unclear whether the Bill would also consolidate the rules on access to communications data currently set out under Part 1of the Regulation of Investigatory Powers Act 2000, thus bringing the rules on retention and disclosure under a single statute.
The consultation document A consultation paper: transposition of Directive 2006/24/EC is available on the Home Office website here.