In essence, the Bill requires telecommunications companies, internet service providers, and the like, to retain data about communications (though not the content of the communications); phone and mobile traffic data have to be retained for 2 years; internet communications have to be retained for one year. This is better than it could have been, in that the Directive would have allowed 2 years for all traffic data; but it is a lot worse than the minimum of 6 months allowed by the Directive. This will impose significant costs on those obliged to retain and secure the data, and those costs will be passed on to their already hard-pressed customers. And it is likely to drive international telecommunications and internet companies to European states which have introduced far less demanding regimes.
Traffic data retention (like any example of pre-emptive and widespread surveillance) is simply a bad idea; it is a massive invasion of privacy; it is founded on the illiberal and anti-democratic suspicion that someone somewhere might be doing something; and it is not good enough to reply that if you have nothing to hide, you have nothing to fear from surveillance. As the prolific and challenging AC Grayling argues in his new book Liberty in the Age of Terror: A Defence of Civil Society and Enlightenment Values (Bloomsbury, 2009; reviewed by The Economisthere), this perniciousassertion is “one of the most seductive betrayals of liberty” imaginable; it assumes that
the authorities will always be benign; will always reliably identify and interfere with genuinely bad people only; will never find themselves engaging in ‘mission creep’, with more and more uses to put their new powers and capabilities to; will not redefine crimes, nor redefine various behaviours or views now regarded as acceptable, to extend the range of things for which people can be placed under suspicion—and so considerably on.
The concerns might be met by strong protections coupled with meaningful oversight, but the Bill is worryingly bereft on this score. Although it imposes obligations to retain data, and to maintain it secure, and to prevent unauthorised access to data, it does not provide any redress to someone whose data is retained insecurely or accessed without authorisation; and the Data Protection Acts, 1988 (also here) and 2003 (also here) are inadequate to cope (for example, they would provide no criminal sanction for the News of the World’s recently-disclosed shenanigans). Worse than that, large-scale databases are peculiarly vulnerable to attack – an investigation by More4 News for Channel 4 reported last week (in a story that should give some pause to those planning a system to trace patients for Ireland) that more than 8,000 dangerous viruses have infected NHS computers in the last year, overloading networks, and massively compromising large amounts of personal data.
It is appropriate to restrict individual privacy provided that there is a good reason to do so, and the restrictions do not good too far. In the context of this Bill, the prevention of crime is a good reason, but the restrictions seem to go very far indeed, especially in the absence of proper protections and oversight. In S and Marper v UK 30562/04 [2008] ECHR 1581 (4 December 2008) one of the reasons given by the European Court of Human Rights for holding that the UK’s retention of innocent people’s DNA records on a criminal register infringed their right to privacy was the lack of sufficiently strong safeguards. I am a Director of Digital Rights Ireland; this is one aspect of our ongoing challenge to Ireland’s data retention regime; and this flawed Bill does nothing to alleviate these concerns.
Shami Chakrabarti, director of Liberty (the National Council for Civil Liberties), has an editorial letter published in today’s Guardian which begins:
Sir – 75 years ago today, in a Britain strained by economic crisis and social unrest, and in the long shadow of international conflict, the birth of the National Council for Civil Liberties was announced in a letter to this newspaper.
The situation is equally as grim in Ireland. Today’s Irish Times carries an article by Elaine Byrne on a forthcoming report prepared by her for Transparency International on serious shortcomings which have weakened the quality of Ireland’s democracy. The same edition carries an article on the financial costs associated with the forthcoming data retention regime being challenged by Digitial Rights Ireland. More generally, the Irish Council for Civil Liberties (ICCL) was formed in 1976 for reasons similar to those which motivated the 1934 letter writers; and – as I have already noted on this blog – it too is one of the organisers of a forthcoming conference on the state of civil liberties in Ireland.
Were it not for such organisations, more of our civil liberties would be eroded by stealth. What liberties we still have we owe to their vigilance. So, what are you waiting for? Get involved: click on the links in this post; click on one of the buttons in the right-hand column; or find your own way to begin to contribute. Lest they perish, we must all do our bit to protect our civil liberties, human rights and fundamental freedoms.
The European Court of Justice has given its decision today in the Irish Government challenge to the Data Retention Directive – [Case C-301/06] Ireland v. Parliament and Council (Press Release | Judgment). Unsurprisingly (in light of the Advocate General’s Opinion) it has held that the directive was properly adopted as an internal market measure (by qualified majority voting) rather than as a criminal matter (requiring unanimity). Where does this leave us and our case?
While it’s a pity to see the Directive upheld, the Government’s challenge was a very narrow one, dealing only with the essentially technical matter of the legal basis for the Directive. The Government didn’t raise and the ECJ wasn’t asked to decide on the fundamental rights issues. Indeed it expressly stated:
The Court notes at the outset that the action brought by Ireland relates solely to the choice of legal basis and not to any possible infringement by the directive of fundamental rights resulting from interference with the exercise of the right to privacy.
Consequently, the decision doesn’t affect the core of our challenge to the Directive, which will still go ahead on the basis that it infringes the rights to privacy and freedom of expression. At the moment we’re waiting on a decision from the High Court on our application to refer these issues to the ECJ – we’re confident that when these issues reach the ECJ that they will decide in our favour.
Google is to halve the amount of time it stores users’ personal search data in response to continued pressure from the EU over its privacy policy. The search giant has said it will anonymise identifiable IP addresses on its server logs after nine months. Google said respecting users’ privacy is “fundamental to earning and keeping their trust”.
0. Prolegomenon, or Why me? Today is Bloomsday, the centrepiece of a weeklong festival in Dublin celebrating the day in 1904 on which the events of James Joyce’s novel Ulysses unfold, which is the day Joyce first formally went out with Nora Barnacle (the story is told in the enthralling movie Nora; other movies with 16 June references include The Producers and Before Sunrise). In the novel, all human life is there; and Eamon Fitzgerald’s Rainy Day is currently by far the best guide to the important things in life: democracy, football, and technology. Expect a Bloomsday post today (this is last year’s; update: this is this year’s). Just like Oh Brother, Where art Thou?, the novel loosely parallel’s Homer’s Odyssey, and this blogpost will very very loosely parallel Joyce’s Ulysses (or at least his chapter headings). Read the rest of this entry »
I’ve had this Joni Mitchell song going round in my head since I read Damien Mulley’s apocalyptic post Privacy in a world of lifestreaming on Friday (and the song is relevant to my point even though Joni has sold out to Starbucks – say it ain’t so, Joni, say it ain’t so – she has signed a 2-album deal with Starbucks’ “Hear Music” label, and the first album, released in September, will contain a new version of Big Yellow Taxi).
Anyway, prompted in part by a story that UK police will soon have cameras in their helmets, Damien raises important questions about a world where our privacy is invaded – not so much by state surveillance or corporate cctv, which we all now recognise, tolerate, even accept (so the helmet cams are little more than portable cctv) – as by each other, as others post photos of us to flickr (or other photo sharing sites), or videos of us to YouTube (or other video sharing sites), or all this and much much more on bebo (or other social networking sites), to say nothing of what we reveal about others in the blogosphere. Read the rest of this entry »
In a welcome example of enlightened self interest, US law firm Morrison & Foerster realised that they had “a vast resource of privacy materials” arising out of their world-wide practice in the area, and they have taken the unusual but highly commenable step of making the fruits of their own research available as a dedicated Privacy Library on their website (see the press release here; hat tip Concurring Opinions). Although not an entirely altrusitic endeavour, it is nonetheless a superb resource, with links not only to US Federal and State legislation, but also to many other countries and multilateral organisations. It seems to be a great place to find otherwise hard to locate primary privacy materials.
This is basically the information about data protection available on the Data Protection Commissioner’s website; it would be churlish to point out that it doesn’t yet have our data retention legislation (Part 7 of the Criminal Justice (Terrorist Offences) Act, 2005), or a link to the Privacy Bill, 2006 (pdf). And it won’t replace EPIC or Privacy International. For all that, though, it is an extremely useful store of privacy materials; and Morrison & Foerster are to be commended for their initiative in making it available.
The Communications (Retention of Data) Bill 2009, published last week, has caused a bit of a stir in this morning’s newspapers. It will give effect to EU Data Retention Directive 2006/24/EC of 15 March 2006 (blogged here) which recently survived challenge by the Irish Government in the European Court of Justice, and it will replace the radically misconceived and deeply flawed stop-gap Part 7 of the Criminal Justice (Terrorist Offences) Act, 2005 (also here) (blogged here). 
Entries (RSS)