Where do we want the Data Retention Act to go?

Victor · 25-02-2003 10:02pm #1

Originally posted by Victor
How do we break down the rights of (1) the state / state organisations (2) non-state organisations (3) individuals (4) parties and information outside Ireland.[/B]

Originally posted by dahamsta
I dunno. Could you kick us off Victor? [/B]

OK as I see it, the major threats to privacy come from (1) business, (2) inappropriate use by individuals or groups in control of information (including state officials) and finally (3) (other) criminal elements from the 1337 script kiddie to the credit card scammer.

While the Data Protection Act and Freedom of Information Acts gives a good start and have to date been good at empowering individuals, they have a basic weakness in that (1) technology evolves (2) large amounts of information is inadvertently retained and (3) not everyone respects them.

(1) The State / State Organisations

State organisations generally have the highest level of legitimacy in seeking and keeping information. From the Garda to the Revenue to Social Welfare to Health Boards, information is vital in delivering services to the public. However there are some instances (ASTI union subscriptions & Dept of Education) where information is misused and I suspect many such instances do not come to light. I fully agree that the Garda or other investigating authority should be able to obtain a wide amount of information related to an investigation of a suspected crime.

However, such is the ability of modern computers / networks that much more information than is necessary for purpose can be obtained and retained. Potentially a rogue (never!) Garda could obtain information on someone's personal life, political and religious views (thinks boards.ie and blogs here) that are irrelevant to a criminal investigation. On the other side of this, individuals are entitled to know what information the sate has on them and how the state does it's business.

Once general suspicion has been raised, perhaps it may be legitimate to passively monitor (stored but not accessed) an individual. This monitoring should be kept under review and if these suspicions are justified within a stipulated period then a warrant could be sought to access the passive information. This may be of use in for example the investigation of organised crime and paramilitaries.

(2) Non-State Organisations

These perhaps have the greatest "need", desire and ability to collect information. Companies from banks to internet spammers retain large amounts of information even if much of it is in a disorganised fashion. Other companies, "data miners" compile vast amounts of information about individuals, both with and without consent. Every form and survey you fill in, every time you mask an electronic transaction, every time you log onto the internet or make a phone call, who you phone, how often you phone your mother, how long you talk to her. Examples of problems would include for example an employer cooperating with a data miner, with information such as someone's personal life or previous salary and this affecting a prospective employment.

(3) Individuals

Individuals generally have the least ability to obtain and use information and the most to lose from others having information. However disgruntled individuals could obtain private information on others and misuse it.

(4) Parties and information outside Ireland

Once outside Ireland, most information is outside the control of the authorites in Ireland and certainly outside the control of the individual. It would consequently be outside the control of the act. The means to stop abuse here is to limit transfer of information outside the state, even for processing / storage purposes. Examples of misuse here are data mining without any consent and misuse of for example credit card details.

Victor · 25-02-2003 10:17pm

(Copy here means search for, record, copy, retain and similar activities. Information means useable information.)

General. It must not remove the presumption of innocence.

Internet. It shouldn't copy the actual files transmitted. This creates the greatest possibility for abuse and would could tens of millions of euros to operate every year. Perhaps individual addresses and file statistics (name, size, date stamp, checksum(?)) could be retained for a period of time, but this information will generally be indicative as opposed to conclusive evidence as the content of a particular address could be changed.

Telephone. It should not copy conversations, text messages or precise locations (phone extension or GPS mobile location) without a good reason to do so. Emergency (112/999) calls may be a reason to retain some information. GPS may be used to improve / manage mobile phone systems, but not follow individual users from street to street (or room to room) once the call is ended.

Evil Phil · 26-02-2003 12:50am

What does the data retention act mean to an employer? Do they have to store a proxy server cache for 3 years? I worked for a company where the proxy server cache was used to sack somebody for sexual harrasment. The individual concerned had been sending obscene material from a hotmail account to a female member of staff. He did this from work and so got caught. Now this happened in the space of 48 hours, not 3 years. He did break the law though.

Statement by Joe Meade
In relation to the Internet, traffic data would encompass the e-mail addresses on all correspondence to and from the subscriber, a record of date, time, and size of message as well as other transmission details but hopefully excluding message subject and content. It would also encompass a record of every login session, every web page visited and read, every search term entered, every file downloaded, every purchase made, and so forth - in short, virtually the entirety of one's online "session" but hopefully excluding the content of e-mail messages.

This raises a number of questions

Will the same rules apply to a company with regards to email/webuse as to an ISP?
If this does apply to employers how much will the storage costs be?
How will this affect investment in Ireland?
What will the legal costs to a company be when/if somebody want access to this infomation?
If the company provide infomation will they then be liabel (spl?) if it is misused?

corley · 26-02-2003 4:22pm

I don't think it'll apply to companies as it looks like they'll want the legislation to apply to "licensed operators" - so that would exclude companies. However, as companies will use an ISP to handle their external communications' details would be stored at that point. This would have implications for companies who would be concerned about the privacy of their commercial communications.

dahamsta · 26-02-2003 6:29pm

Thanks for posting that Victor. One of these evenings I'll actually get a chance to read it!

adam

jmason · 28-02-2003 4:17pm

Yeah -- good point this.

With respect to (2) -- in the UK, it was proposed that *parish councils* could gain access to data retention records, which is pretty clearly absurd. If they expand the groups with access here, that'd be a similarly good point to push them on.

(ps: hi folks. Very busy right now so watching the forums is about all I can do!

Victor · 01-03-2003 2:09pm

What do people think of an independant (government) "Big Brother Agency" (BBA) that records all this information, but the information would only be accessable on a court warrant? What if the individual was able to access their records from the BBA?

Where do we want the Data Retention Act to go?

Comments