---

Data Retention (EC Directive) Regulations 2009

My Lords, I thank all noble Lords who have spoken and made important contributions. I remain convinced that this is a necessary measure and that the way we are transposing it is proportionate to the challenges of law enforcement and the security threats we face. I do not regard it as unclear or woolly. I shall go into some of the points raised by various speakers. I completely agree with the noble Baroness, Lady Neville-Jones, that the guidance puts the horse before the cart, and that is just where horses should be. It is standard practice to release guidance after parliamentary approval because we would not want to presume it. In any event, the directive sets out the types of communications data that are to be retained. We are obliged to ratify this now. We are working to a timescale set by the EU. Notwithstanding what the noble Baroness, Lady Miller, said, it has been set by the EU, and the EU has agreed it. The noble Lord, Lord Stoddart, asked how many countries have signed up to this. I mentioned in my opening speech that 17 nations have signed up to it already. In answer to other small things, spam is not retained. ISPs already deal with spam and are able to tell the difference between that and other data. The subject line in an e-mail is content, not comms data. The noble Baroness, Lady Neville-Jones, asked about the implementation group. It will start in two months’ time. The regulations only bring additions to communications data that relate to internet e-mail, internet telephony and log-on history. The EU directive excludes data that relate to third-party services. Internet-related data must relate to the services provided by the communications provider and no data revealing the content of the communication can be retained under these regulations. An existing code of practice determines the difference between communications data and content and was approved by Parliament. It is worth remembering—a number of speakers have touched on this—that data will be held by CSPs and will be accessed only under RIPA. Most of these companies hold data for their own business processes. The regulations codify these data and put them in such a way that, if we ever need to use them, they are more accessible. We will hold them for 12 months, as set out in the regulations, rather than for the maximum of 24 months, which can be done. Most of these data will never be accessed. The noble Earl, Lord Northesk, referred to that.