---

Data Retention (EC Directive) Regulations 2009

My Lords, I rise to support my noble friend’s amendment. In so doing, I declare my various interests in this field, as an unpaid adviser to the Enterprise Privacy Group, Privacy International and 80/20 Thinking. I do not have all that much to add to my noble friend’s excellent and devastating critique, but I should like to reinforce one or two of the issues to which she referred and probe the Minister on a few more. First, it is a source of regret to me that the Government’s justifications for their data retention policy—and, it has to be said, various other IT fields—seem to be riddled with intellectual and technological vacuity. I am sure that none of us disputes that traffic and communications data and their retention can be of immense help in the fight against terrorism and crime, as the Minister intimated in his introduction. Indeed, I and my party have been utterly consistent in stating that case; albeit I would add the mild caveat that it is all too easy to overstate their potential utility. As the Explanatory Memorandum says: ""Lawful access to communications data allows investigators to identify suspects and their ‘hidden’ means of communication, trace their criminal contacts, establish hierarchical relationships between conspirators, place them in specific locations at specific times, identify their banks and those engaged in laundering their criminal finances and assets both in the UK and abroad, and can confirm or disprove suspects’ alibis"." In sum, a regime of data retention allows our law enforcement agencies and intelligence services to generate detailed whole-of-life profiles on individuals who may be engaged in terrorist or criminal activity. Indeed, as the Government have frequently and correctly argued, it is this aspect of data retention that gives it its critical significance as part of their investigative and preventive armoury. I have no difficulty with this whatever. However, if we apply this to a mandatory whole-of-population scheme, the corollary to this must be equally true; namely, that detailed whole-of-life profiles of every single citizen in a member state are made available to their respective Governments. In effect, the oft-repeated mantra that lies at the heart of the Government’s insistence that these proposals are proportionate and compliant with the ECHR; namely, that definitions of communications data, ""do not include the contents of communications"," is little more than a fig leaf. The stark reality is that, on the Government’s own admission, the communications data on their own are more than adequate to define the individual and the minutiae of his or her life. To all intents and purposes, the content of communications can, in a vast majority of cases, be inferred by resort to analysis. In this context, it is worth noting a significant ruling earlier this month by the Administrative Court of Wiesbaden. Its opinion states that, ""data retention violates the fundamental right to privacy. It is not necessary in a democratic society. The individual does not provoke the interference but can be intimidated by the risks of abuse and the feeling of being under surveillance ... The directive [on data retention] does not respect the principle of proportionality guaranteed in Article 8 ECHR, which is why it is invalid"." I accept that this probably does not have immediate relevance per se to our proceedings today. Nevertheless, and given that the German Working Group on Data Retention is awaiting a ruling from the European Court of Justice in respect of its suit against the German version of this directive, I wonder how sanguine the Government, and indeed the European Commission, are that these proposals are properly ECHR compliant. After all, there is a very real possibility that the judgment, as and when it is made, will be consistent with that made in respect of the UK’s DNA database in December of last year. My noble friend has referred to the wooliness and imprecision of the drafting, particularly in the context of properly articulating what classes of communications data are to be retained. For example, in Part 3 of the schedule dealing with, ""Internet Access, Internet E-Mail or Internet Telephony"," there is no indication of which internet protocols and/or data fields may or may not have to be specifically logged by service providers. This is a crucially important point because, without clarity in this area, communications service providers will not have certainty as to the parameters of their retention obligation. This in turn will give rise to a number of serious issues with respect to their contractual obligations to their customers, particularly with respect to data protection policies, as well as leaving the individual citizen utterly in the dark as to how to mitigate any compromise of his private and personal communications that could be engendered by implementation of the mandatory scheme. At a potentially much more sinister level, to which my noble friend referred, the regulations are silent on whether it is the Government’s intention that the directive should authorise the use of deep packet inspection technology to facilitate their data retention policies. I apologise for the techno-speak, but this, too, is critical, particularly in respect of the security and privacy of data, because DPI allows for interrogation and analysis of layers 2 to 7 of the OSI seven-layer model. Put simply, DPI devices can classify traffic and communications data on the basis of information extracted from the data part of the packet, thereby blurring the boundaries as to whether message content is being retained or not, rather than being confined to the header information alone. It may be that I have too suspicious and cynical a mindset, but I am tempted to suppose that a principal reason for the Home Office being so lackadaisical in responding adequately to recent concerns about behavioural advertising and DPI may be based in its unstated ambition to make use of the technology itself for its IMP ambitions. Be that as it may, the point at issue today is whether there is also an aspiration that the technology should be available in the context of these regulations. I hope that the Minister will clarify that for me. In this context, he may be tempted to suggest that we should not worry about these issues of technical detail on the basis that they will be attended to and resolved by the implementation group. That may or may not be the case, but, to put it bluntly, neither Parliament nor this House should accept this sort of pig in a poke. I support my noble friend and I look forward to the Minister’s response.