An Orwellian nightmare

Written by Baroness Sarah Ludford MEP and published in European Voice on Thu 21st Oct 2004

In 1997, ministers at a global IT conference declared that since the State cannot intercept or record everyone's letters, it should not be able to do so for our electronic communications.

But since 9/11, there have been increasing incursions into privacy rights. Governments and police have found the idea of 'data retention', making telecoms and internet services providers keep for law enforcement purposes details of everyone's phone, fax, mobile, email and internet use, irresistible. The theory is that this excludes content, but you can 'profile' someone quite comprehensively from knowing whom they contacted, when and from where, and which websites they visited.

The latest proposal, from the UK, France, Sweden, and Ireland is for European rules obliging all Member States to order their providers to keep data for up to 3 years, though the Presidency has amended that to 12 months. Presumably the Council will deign to consult MEPs at some point, though they can - and will - ignore us as this is an intergovernmental 'third pillar' proposal.

Worryingly, the draft contains no rules on access to the data, supervision or correction. It also features mission creep, since while it refers to the 'anti-terrorism roadmap' it actually concerns crime in general and even excludes 'national and public security' grounds!

The basic law laid down in EU Directives is that telecoms/internet data can only be collected and processed to send out bills. For that, a period of 3-6 months is judged reasonable by the 'Article 29 working party' which gathers together all the national data protection supervisors with the European Data Protection Supervisor.

Member States can make an exception if there is a need to safeguard national or public security, and to prevent or investigate crime. But in a series of recommendations, the Article 29 working party has warned that this must be targeted, proportionate and necessary, which mass monitoring of potentially unlawful behaviour is not.

Thus mandatory systematic retention amounting to exploratory general surveillance of the whole population is an illegal invasion of privacy under European law. They said 'traffic data should in principle not be kept only for law enforcement purposes' beyond the billing period. The imminent recommendation of the working party on the present proposal is expected to be forceful in reiterating its consistent pro-privacy line.

Telecoms and internet companies share the worries about privacy, not least because their customers could sue them for breach of contract. But they also have concerns about the cost of having to store longer massive amounts of data, and indeed they fear they could in time be required to collect additional data specifically for law enforcement agencies.

We need a comprehensive and effectively-enforced European privacy and data protection regime that covers both economic and, as long promised by the European Commission, 'third pillar' policing activities. The Commission is thought to be preparing its own data retention proposal to substitute for the sloppy one from Member States; it is essential that this should be subject to co-decision with the European Parliament.

In any case the Commission should test, much more rigorously than governments have done, police claims that long retention is necessary and analyse closely the legality of exceptions to privacy against the requirements of the ECHR and EU data protection Directives.

Telecoms firms say it is rare for police to ask for data more than 6 months old. We must wonder if they would ever get round to analysing vast volumes. Terrorist and major criminals are smart enough to blur their traces anyway, so 'Big Brother' would spy on you and me, but not on Osama Bin Laden; funny that.