EU Data Retention Plans Heat Up

The European Union recently proposed harmonized data retention rules requiring telecommunication service providers to collect and store telephone traffic data for up to one year and Internet traffic data on all subscribers for up to six months. The data would be accessible by law enforcement agencies from other member states on request. Currently, the majority of the European Union's 25 member states have no mandatory data retention legislation, while half of those who do have such policies have not put in place all the laws needed to enforce the rules. Those that do have data retention schemes differ in their required retention scope and period. There has been a predictable hue and cry from privacy advocates. The EU's data protection supervisor has also criticized the retention plans, saying they fail to protect civil liberties and give too much freedom to intelligence-gathering agencies. The European controversy provides an interesting backdrop to the Canadian government's own promise to introduce cybercrime legislation next month. While the Canadian proposal does not include a general data retention scheme, it does include a data preservation power to retain data about a specific individual who is the subject of an investigation. Critics have suggested that preservation could become retention in practice, if generalized retention is the least expensive way for telecommunications service providers to comply with individual-specific preservation orders. For more information on the EU data retention scheme, visit: http://eudr.notlong.com For FAQs on the so-called "lawful access" initiative, see: http://cippic-la.notlong.com Summary by: Jason Young