The Minister for Justice in Ireland published the Communications (Retention of Data) Bill last week: it was made available on the Oireachtas website (and brought to my attention by the ever-helpful Darius Whelan), although curiously, some reputable (and normally reliable) newspapers wrote on Monday morning about the legislation being due to be published! It will presumably be debated in the Oireachtas (parliament) when its honourable members return after the summer. Data retention legislation requires service providers to keep certain types of data on the activities of their subscribers and users, and to disclose it to relevant authorities on request. I hope that this post is of interest to Irish and non-Irish audiences, though, as the issues are arising in many jurisdictions, whether through the EU’s data retention directive of 2006 or independently. I also point to this extremely helpful status report on transposition as of January 2009: it shows very clearly that many states have included both judicial authorisation and cost recovery, which are absent from the Irish proposals.
The publication of the Bill isn’t a major surprise. A draft had been leaked, and of course this is but the Irish implementation of the 2006 Directive – so we cannot blame the Irish government alone for bringing forward these proposals. The underlying Directive remains an unconvincing one. I am not opposed to all attempts to use new forms of communication in conjunction with crime prevention, detection and prosecution. Nor am I unsympathetic to the way that some in law enforcement will feel that they are falling behind those who they pursue in terms of the use of technology. But data retention carries with it a financial burden, an administrative nightmare and, most importantly, a shift in the balance between the citizen and the state that may be presumed to be irreversable: surveillance powers, once granted, are rarely rolled back. These are broad powers, requiring retention of everyone’s data even if those having data disclosed are a subset of this (rather than the alternative of notifying a service provider to retain data on a given subject for a limited, specific purpose). As is so often the case, specific information from law enforcement on the problems with existing legislation has not been forthcoming, and public statements focus on the most extreme of cases (the Irish Minister for Justice gave us international terrorism and child pornography in his public comments today). Anyway, to ten questions that occur to me after giving the Bill some consideration.
(1) We are reassured that the legislation, as with the Directive, doesn’t apply to ‘content’, but getting information on who you are communicating with and (particularly in the case of mobile telephony) where you have been over the course of two years is more than trivial – it is a very intrusive way of finding out what a person (unconvicted of any crime) has been doing in their private life. How is this acceptable?
(2) The proposals follow in the disreputable tradition of sidelining the judicial branch – making the powers in essence a general authority for digital search and surveillance operations without a warrant. Nothing in EU law requires that the powers of accessing data be exercisable by senior Gardai (not to mention principal officers in the Revenue Commissioners, a new addition to the Bill that was not part of the earlier draft) – although it does appear tighter than the UK version, which appears to let anyone with a tanard or a lanyard to make a request. There are some safeguards supposedly in place (annual statistical reporting, a judge with the job of monitoring the system), but we’ve seen that they are quite weak: see for example TJ McIntyre’s recent discussion of the current judicial ‘oversight’ of phone intercept and data retention legislation. Furthermore, the officer authorising the access to data merely has to be satisfied that it is required for preventing, detecting, investigating or prosecuting a serious offence – which, for example, carries no need for reasonable suspicion of criminal behaviour on the part of the person whose data is being disclosed. It’s a dragnet-style provision that gives powers to police, Army and revenue officials and enables them to carry out large-scale investigations without any disclosure of such to the affected individuals nor any effective right of appeal or transparency. Why could this system not be restricted to cases approved by an independent judge after specific evidence of necessity is presented by the requesting officer?
(3) Data retention remains doubtful in terms of fundamental rights compliance: in the ECHR, S & Marper v UK questions mass monitoring of the unconvicted, Copland v UK reiterates that traffic data is covered by Article 8 (as I argue here); the German courts are considering various challenges (summarised by Digital Rights Ireland: 1 | 2), and DRI itself is engaged in a challenge to the Directive. The prior case brought by Ireland against the Directive related purely to legal basis and did not address fundamental rights at any stage. Does this legislation comply with the high standards of the protection of fundamental rights that Ireland aspires to meet?
(4) Under the Directive, retention is required for between six months and two years. The UK provisions (SI 2009/859) require a standard 12 month period. The Irish proposals would require it for a year for Internet and two years for telephone. Supporters of the legislation are spinning this as a reduction from the existing (and supposedly stopgap) three year period under 2005 legislation, conveniently neglecting the requirement under EU law to reduce it to a maximum of 2 years in any event. Why is a 2-year period necessary, particularly where other implementing States are able to adopt shorter periods?
(5) No information is provided in the Bill, explanatory memorandum or press release on who will bear the costs of retention. Compare this with, for example, the UK regulations which at least empower the Home Secretary to reimburse ‘any expenses incurred’ (which are well into the millions) in complying with the regulations. Bear in mind, too, that while some providers will keep billing data for obvious reasons, this is not the case for all providers. Who will pick up the bill and why has it not been ‘costed’ in a published impact assessment?
(6) The Bill applies without more to all providers of publicly available electronic communications networks and publicly available electronic communications services. These are wide (and imprecise) definitions that, given that specific statutory obligations are created (’a service provider shall retain’), causes doubt for many (webmail? webmail-like? open wifi? voice IM?). This will cause panic and confusion across the sector and will have seriously damaging consequences for Ireland’s ability to promote itself as a destination for high-tech industries. Compare with s 10 of the UK regulations, which provide that the obligation is only activated when the Home Secretary notifies the provider (although the Secretary does have a statutory duty to notify all relevant providers!) Why does the Government wish to create new duties without precision on who the duties will affect?
(7) There is a ‘redundancy’ provision in the UK regulations (again s 10), which states that the Home Secretary doesn’t have to notify providers where the data is retained by another provider. Presumably, this protects downstream ISPs and similarly situated others. There is no such provision in the Irish legislation and the clear terms would require the same data to be collected at multiple locations. Why are the supporters of data retention so generous with the time, money and effort of others?
(8) The detailed instructions (Sch 2, Part 1, 5(d)) requires retention of the date, time and (cell ID) location of the activation of a ‘pre-paid anonymous (mobile telephony) service’. Is this the end of pay-as-you-go anonymity through the back door?
(9) The definition of ’serious offences’ is broad (although it is an improvement on the draft, which would have allowed the powers to be used for any offence with a 12-month sentence attached to it). Any offence carrying a five-year sentence along with selected other offences (from poisoning to the false reporting of child abuse) count. How were these offences selected and what is the basis for their inclusion?
(10) The complaints procedure under s 10 of the Irish bill is bizarre – you can find out if a disclosure request has been made about you by making a request (if you believe that your data has been disclosed!!), but you will only be told if it has been made if it turns out that the rules have been contravened. Translation: meaningless. And there’s a broad barring of legal action other than the required constitutional right of action. And ‘a decision of the (referee who deals with complaints) … is final’. And evidence obtained in violation of the statute is not automatically excluded, as it should be. Given the argument that those with nothing to fear have nothing to hide, why does the Government fear challenges so much as to bar them?
Speaking on the Last Word with Matt Cooper earlier today FF TD Niall Collins trotted out that old canard – “if you’ve nothing to hide, you’ve nothing to fear” – in relation to the new data retention bill. Curiously, when asked if he’d be happy to provide us with his mobile phone bills for the last two years and details of his emails for the last year he claimed not to understand the question and refused to do so.
Just so there’s no confusion we’re repeating the request here – if he genuinely has nothing to hide then surely he’ll be happy to provide us with details of his (taxpayer funded!) mobile phone bills for the last two years and we’ll be happy to put them online. A request has been sent to him by email and by voicemail to his constituency office asking if he will make that information available to us and if not why not. Any reply will be posted to this blog. Though perhaps you shouldn’t hold your breath.
Update (14.07.09): The chutzpah of FF TDs knows no bounds. According to today’s Independent, at a recent FF meeting backbenchers opposed being required to use a swipe card to track attendance:
The TDs also resented the idea of a swipe card that would keep track of their comings and goings at Leinster House and prevent claims for expenses from absent members…
TDs and senators believe that a pilot scheme for civil servants where their attendance and hours in work would be monitored by a swipe card system will be used to check up on them. And while most privately acknowledge that a few may abuse their expenses and allowance privileges, they resent the idea of a “Big Brother system of electronic supervision”.
Good news from our friends in the German Working Group against Data Retention:
As the first German court, the Administrative Court of Wiesbaden has found the blanket recording of the entire population’s telephone, mobile phone, e-mail and Internet usage (known as data retention) disproportionate.
The decision published today by the Working Group on Data Retention (decision of 27.02.2009, file 6 K 1045/08.WI) reads: “The court is of the opinion that data retention violates the fundamental right to privacy. It is not necessary in a democratic society. The individual does not provoke the interference but can be intimidated by the risks of abuse and the feeling of being under surveillance [...] The directive [on data retention] does not respect the principle of proportionality guaranteed in Article 8 ECHR, which is why it is invalid.”
The Working Group on Data Retention which has initiated a class action of over 34,000 citizens against the total logging of the entire population’s communications and movements welcomes the court decision very much. It calls on social democrats and christian democrats to reject the latest government project to allow Internet service providers to record everybody’s Internet surfing habits.
“We call on all citizens to contact their MPs now in order to protest against the proposed retention of web surfing habits,” says Werner Hülsmann, member of the board of the forum of computer scientists for peace and social responsibility and actively working in the Working Group on Data Retention. To stop the project, which the Bundestag will debate on Thursday in the first reading, the Working Group on Data Retention has set up a campaign page on the Internet. In early March, the Federal Council of Germany (Bundesrat) also warned that the proposed “storage of all Internet usage data without a specific cause or with blanket coverage [...] violates” the Constitution.
“The recent criticism by Federal Minister of the Interior Wolfgang Schäuble (CDU) of the Constitutional Court’s preliminary decision on data retention proves that his surveillance mania is limitless”, criticizes Patrick Breyer of the Working Group on Data Retention. “It is not ‘a matter for the legislature’ to keep eroding our constitutional guarantees protecting us from errors and abuses by the authorities. We urgently need to establish a Fundamental Rights Agency to have all existing powers and programs of the security authorities systematically and scientifically reviewed as to their effectiveness, cost, adverse effects, alternatives and compatibility with our fundamental rights.”
Granted, this isn’t the end of the matter in Germany. It’s a decision of one court but may be appealed, while the highest court in Germany (the Constitutional Court) has yet to make a final ruling. It is, however, a very encouraging sign – particularly as the Constitutional Court has already indicated a provisional view that data retention may be invalid. It’s also very helpful for our own case with its finding that data retention is disproportionate and unnecessary.
You might have noticed Karlin Lillington’s story in the Irish Times today about the Department of Justice’s new proposals on data retention. To make a long story short, it turns out that the Attorney General was not impressed with its remarkable plans to change the law to extend surveillance on every citizen in Ireland via a ministerial order – sidestepping the need for the Oireachtas to review these changes. Having been rebuffed on this issue, the Department of Justice has now decided to proceed (as it should have done to begin with) via primary legislation.
An improvement for transparency? It would be, if Justice lived up to their past promises to hold an open consultation process. But they haven’t. Their website still claims that the Directive will be transposed via a statutory instrument – notwithstanding the fact that they have prepared a draft Bill which they have been circulating to industry groups. Nor are they willing to show the draft Bill to the public – consultation for Justice appears to mean a secret process controlled by them and excluding citizens.
We’ve contacted Justice for their comments. In the meantime, we think that the public should have the same right to see the draft Bill as industry insiders, so here’s a copy of what we understand is the latest draft: COMMUNICATIONS (RETENTION OF DATA) BILL 2009
Karlin Lillington has an interesting story in today’s Irish Times on recent UK developments in surveillance and what they might mean for Ireland. Here’s an excerpt:
NET RESULTS: When it comes to abuse of privacy, where Britain goes, Ireland tends to follow. That’s why we should be worried – very worried – about developments across the Irish Sea that emerged as the year rolled over into 2009, writes Karlin Lillington.
First came a New Year’s Eve story in the Guardian that home secretary Jacqui Smith will propose the creation of a single giant communications database and the option of outsourcing the storage of all the personal details held under the UK’s data retention regime to a private firm.
That means potentially that a single repository – a massive, national communications database – would hold all the details about, though not the content of, everyone’s e-mails, phone calls, faxes, text messages and internet use.
The same array of data is retained in Ireland as well, though at the moment, as is the case in Britain, data is retained by the communications providers, not in a central database.
Gathering such a spread of private information into a single database would create a “hellhouse” of personal private data that would not only be vulnerable to security breaches on a massive scale but would prove too great a temptation for law enforcement, according to Britain’s former director of public prosecutions, Sir Ken McDonald.
McDonald was scathing in his criticism of the idea. “Authorisations for access might be written into statute,” he told the Guardian. “But none of this means anything. All history tells us that assurances like these are worthless in the long run. In the first security crisis, the locks would loosen.”
While “security” would be cited as the main impetus for such a database, “the notion of total security is a paranoid fantasy that would destroy everything that makes living worthwhile” and bring an “ugly future”, he said.
One of the areas she points out – remote searches or the ability of the police to remotely hack into your computer to find evidence or monitor your activity – will certainly be one of the big issues of 2009. While Irish law doesn’t currently deal with this issue, there are moves at EU level to encourage (and possibly eventually require) all member states to allow remote searches. This becomes more worrying when combined with a growing law enforcement desire to be able to conduct “remote cross border searches” – that is, for the police in country A to be able to hack into a computer in country B. This strategy – also known as “chasing bits across borders” presents its own problems for privacy and especially accountability.
The Irish Times is reporting that the Joint Committee on European Scrutiny (a cross party committee which examines proposed EU legislation) has published a report which is highly critical of European proposals on passenger records.
The draft Framework Decision on the Use of Passenger Name Record (PNR) for Law Enforcement is an astonishing proposal which, if passed, would establish giant databases tracking the travel of every individual, logging details of every flight they make and keeping that information for 13 years. That information could then be accessed and shared with other countries without any individual suspicion, much less any form of warrant or prior permission. The proposal envisages using this information for “profiling” of all passengers. As originally proposed, the database would apply only to international flights (entering or leaving the EU) but some states are now pushing to extend this to include all flights within the EU while the UK is taking this further still and is seeking to create a database of all ferry and rail traffic within the EU.
We all support reasonable and proportionate measures to counter violence perpetrated against innocent people, but such measures should represent a proper balance between the need to combat such illegality and the rights of the innocent majority to go about their daily lives without undue interference by the State. In my opinion, and that of my EU colleagues, the Commission proposal fails this test. The proposal involves an obligation on air carriers to transmit to a state authority, called a “passenger information unit”, the PNR information that the passenger has provided to the air carrier in respect of any journey by air into or out of the European Union. The information typically includes contact details, such as address, phone number and e-mail, as well as payment information, such as credit card details. Under the proposal, the information has to be retained by the passenger information unit for a total of 13 years.
Such information is given by a passenger for the purpose of the provision of a service, namely air travel. The Commission proposal is that this information should be transmitted to state authorities for a totally different purpose, the combating of what is described as terrorism and organised crime. It is a basic data protection principle that information collected for one purpose should not be used for another purpose and should be deleted when no longer required for the purpose for which it was collected. The Commission proposal offends against this basic principle. Under the proposal, air carriers will have no choice but to hand over a complete record of an individual’s movements in and out of the European Union to a state entity that will retain it for 13 years, and not only a record of travel, but also of contact and payment information.
Many regular travellers would have difficulty recalling where they had travelled to, even in the past year. With this proposal, the state will have a detailed record of all such travel in and out of the European Union, and for a period going back 13 years. Therefore, whether it is a business trip to Singapore, a shopping trip to New York or a holiday in Morocco, the state will have full details. Can this invasion of individual privacy be considered a proportionate response to threats from the small number who may be tempted to engage in terrorism or organised crime?
One must also have concern for the ability of the state to protect the confidentiality of such information. Recent cases investigated by my office have, unfortunately, demonstrated that deliberate or inadvertent leaking or misuse of such information is a significant risk. Experience in other EU countries is no different…
There is little hard evidence of the actual usefulness of PNR passenger data in combating terrorism or organised crime. All we are presented with is general comments that such information is useful, with a small number of examples. There is even less evidence of the additional utility of PNR data over the more reliable API data that is already being collected. The result is that a key test under European law — that of proportionality — does not seem to be met. Even if one were to accept the case presented for this proposal — I do not — the protection provided for the innocent majority who have nothing to do with terrorism or organised crime is vague and inadequate. These deficiencies are spelled out in the written opinion my EU colleagues have already delivered and which has been provided to the committee.
If this proposal is implemented, we will have taken a further step to what has been called the surveillance society, where our day-to-day activities are constantly monitored and our private space is more and more restricted. We already have a situation, under data retention law, where the details of who we communicate with electronically is compulsorily stored, in case it would be useful for the investigation of crime. With this proposal, our international travel movements will be monitored by the State for the same reason. Can it only be a matter of time before this is extended to all of our movements? (Emphasis added)
The Joint Committee has now accepted these points (and also pointed out that – incredibly – neither Ryanair nor EasyJet were consulted in relation to the proposal).
What can you do about this? The responsible Irish official is the Minister for Justice. You might like to let him know that your privacy is important, and that the proposals (which Ireland has supported) are unacceptable. Ask him why he has ignored the concerns raised by the Data Protection Commissioner and proceeded with a measure based on “little evidence” with “vague and inadequate protections” for your personal information. Ask him whether he plans to ignore the concerns raised by our democratic representatives in the Joint Oireachtas Committee. Contact details? Email: minister@justice.ie, Phone: 01 602-8202 (ask for the Minister’s Office), Fax: 01 661-5461, Snail Mail: 94 St. Stephen’s Green, Dublin 2. And of course you should cc your local TDs (details here) and let them know that this issue is important to you in deciding how you will vote.
As I near my conclusion, let me, in my final public speech as DPP, repeat my call for level headedness and for legislative restraint in an age of dangerous movements.
We need to take very great care not to fall into a way of life in which freedom’s back is broken by the relentless pressure of a security State.
Over the last thirty years technology has given each of us, as individual citizens, enormous gifts of access to information and knowledge. Sometimes it seems as if everything is at our fingertips and this has made our lives immeasurably richer.
But technology also gives the State enormous powers of access to knowledge and information about each one of us. And the ability to collect and store it at will. Every second of every day, in everything we do.
Of course modern technology is of critical importance to the struggle against serious crime.
Used wisely, it can protect us.
But we need to understand that it is in the nature of State power that decisions taken in the next few months and years about how the State may use these powers, and to what extent, are likely to be irreversible. They will be with us forever. And they in turn will be built upon.
So we should take very great care to imagine the world we are creating before we build it. We might end up living with something we can’t bear.
The Advocate General of the European Court of Justice has just given his Opinion (summary, PDF) on the Irish Government’s challenge and has recommended to the Court that the challenge should be rejected, holding that the Data Retention Directive was correctly dealt with as an internal market measure rather than a criminal justice measure (which would have required unanimity to pass). Opinions of the Advocate General aren’t binding but are generally followed by the Court, making it more likely that the Government’s challenge will now fail.
It’s important to point out, though, that this ruling only relates to the procedural way in which the Directive was passed. It doesn’t affect our case that the Directive breaches fundamental principles of human rights, and we still await a decision from the High Court referring these issues to the European Court of Justice.
Full text of the Advocate General’s opinion available here.
The German Working Group against Data Retention (Arbeitskreis Vorratsdatenspeicherung) is also bringing a legal challenge to data retention and has put out a press release on the Opinion.
What’s the significance of the State’s challenge? Here’s what we said about it before:
On the plus side, the challenge will certainly delay implementation of the Directive, and stands a very good chance of striking it down in its entirety. There is a very strong case that the passing of the Directive was flawed.
On the minus side, the challenge is purely procedural. The Government agrees with the principle of spying on every citizen – it merely alleges that the wrong legal mechanism was chosen. According to the Government, the measure should have been passed by unanimous agreement of all the member states – not by a majority voting procedure. We agree – the directive is clearly an attempt to deal with matters of criminal law that are reserved to the member states, and the fundamental rights of Irish citizens should not be set aside by the majority vote of other EU states. But we’re disappointed that the Government shows no interest in asserting the right to privacy of Irish citizens. The result is that the European Court of Justice, when it eventually deals with the case, will only be hearing about procedure – not privacy.
Obviously we hope that the Government’s challenge will succeed in invalidating the Directive. Whatever the outcome of their case, however, our own challenge to data retention – where we raise these privacy issues about Irish law as well as the Directive – will continue.
(Thanks to Joris van Hoboken for pointing out that the Opinion had been timetabled.)
The Irish Times published an opinion piece today from us on data retention. A subscription is required to read it at that link, so here’s the full text:
Violations only made worse by new plans for data retention
The Government is planning an alarming expansion of its surveillance of citizens, writes TJ McIntyre .
SUPPOSE THAT someone was monitoring you every day, writing down your movements, making a note of everyone you talked to, copying the name and address on every letter you posted, and then storing that information for three years. Now suppose that every person in the country was under similar surveillance.
While this might seem like science fiction, since a secret ministerial order of 2002 the Government has required telephone companies to do just that. They are required to track the whereabouts of all users via their mobile phones, to log details (but not the content) of every telephone call made and every text message sent and to store that information for three years.
The Department of Justice now proposes to extend this to the internet, by requiring internet service providers to monitor the internet use of every person in Ireland, recording names, details of every e-mail or instant message sent and every time a user logs on, and to store that information for 12 months.
Moreover, they plan to do this in a way which will limit democratic scrutiny, by using a statutory instrument and not a Bill which would be examined by the Dáil and Seanad.
(Ironically, these proposals were revealed on the same day that thousands of Bank of Ireland customers learned that their confidential data had been stolen.)
This system has been given the bureaucratic and innocuous-sounding name “data retention”. A more apt term, however, is “dataveillance” – surveillance through the use of databases. Unlike traditional targeted surveillance, it involves the gathering of information on all citizens – judge, journalist and jailbird alike – creating a digital dossier of their movements and communications, without any requirement for judicial authorisation or even police suspicion.
What protections are in place to limit the use of this information? The former minister for justice, Michael McDowell, promised that access to these databases would be an extraordinary measure, used to deal with serious crime and terrorism.
However, such safeguards were never implemented. Under current law gardaí can access these databases without a warrant, in respect of any crime (or even possible future crime), however trivial, and in respect of any person (not merely suspects). The result, according to the Data Protection Commissioner, is that more than 10,000 requests are made for this information every year – more than 300 per day.
European law should have changed this, by restricting access to cases of serious crime only. Generally under Irish law a serious offence is one which carries a possible prison sentence of five years or more. However, the current Department of Justice proposals cynically negate this safeguard by redefining serious offences for the purpose of data retention to mean offences which have a possible sentence of six months’ imprisonment.
This will include such crimes as failure to move on when asked to do so by a garda.
There is also a likelihood that others will abuse or simply lose these records. In Germany it was revealed recently that Deutsche Telekom had been using telephone databases to spy on journalists who wrote unfavourably about the company. In the United Kingdom government departments have allowed confidential data on many millions of individuals to be compromised.
Here in Ireland officials in the Department of Social Welfare have been found by the Data Protection Commissioner to be engaged in the systematic leaking and selling of personal information from government databases. There is no reason to think that this information will be treated any differently.
Information gained from telephone and internet records can be valuable in the investigation and prosecution of crime – but there are other ways of ensuring that police can have access to this data without jeopardising the right to privacy.
In 2001 Ireland signed the Council of Europe Convention on Cybercrime, which achieved international agreement on a more proportionate “data preservation” system, which would enable police to mount surveillance and preserve evidence but would avoid blanket surveillance of all citizens at all times.
This system would still have provided for the use of this information in, for example, investigating the Omagh bombing.
But without any explanation, the Government has failed to implement the convention, jumping straight to the more intrusive option of data retention without first testing data preservation.
Privacy is a fundamental right, guaranteed under Irish, European and international law. Being able to go about our everyday business without systematic state scrutiny is an essential part of a democratic society. Data retention is something entirely new – it provides for pre-emptive surveillance of the entire population on the basis that some of them might at some stage commit some crime and that this information might then be of assistance.
In effect, it treats everyone as potentially guilty and as such reverses the presumption of innocence. Such ongoing monitoring of the entire population is remarkable in a democracy and is so excessive and disproportionate as to violate the right to privacy. No evidence has been put forward to show that it is necessary or that less intrusive alternatives would not suffice.
Digital Rights Ireland has brought a High Court challenge to Irish and European data retention laws, which will ultimately determine whether surveillance of all citizens can be compatible with the Constitution and the European Convention on Human Rights.
In the meantime, the Department of Justice proposals to extend data retention to the internet should at the very least be the subject of primary legislation, allowing for a full public discussion of these issues and democratic scrutiny by the Oireachtas.
TJ McIntyre is a solicitor, lecturer in law in UCD and chairman of Digital Rights Ireland