 |
 |
Ian, The report to which you refer may be confusing the RIPA with a report issued by the deputy Director General of NCIS in which the dDG asked Government to introduce legislation requiring 'communications service providers' to retain data for up to 7 years - something which is totally unacceptable. The Home Office have just rejected the NCIS proposals. Access to 'communications data' will be regulated by PartII of RIPA when it comes into force this April. All law enforcement agencies (and other bodies authorise under RIPA) will have to submit a 'notice' requiring CSPs to supply comms data - the notice can also require CSP to retain data for one month (extendable for one month again). If a CSP doesn't hold data it can't supply it! I used to be with BT Internet for my sins - BT internet keep comms data for 3years! Why -they couldn't answer this and so I decided to take my custom elsewhere. The DPA obviously plays a role in how long a data controller retains data but I would respectfully suggest that other EU and UK privacy legislation plays a greater role in the context of comms data and especially a proposed privacy directive currently being debated by the EU parliament see: the processing of personal data and the protection of privacy in the electronic communications sector http://europa.eu.int/ISPO/infosoc/telecompolicy/review99/com2000-385en.pdf and Article 29 Working party papers on the same + a report on privacy on the Internet see http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/index.htm I hope this has been of some help Pat -----Original Message----- From: Ian Welton [mailto:[log in to unmask]] Sent: 25 January 2001 20:58 To: [log in to unmask] Subject: ISP's retention of Internet e-mail A recent article in Network News 24 January 2001 "ISP'S stage debate over government's frustrating RIP Act" indicates the difficulties and frustrations ISP's are experiencing with complying with that legislation and the retention of e-mails for 7 years. There seems to be a significant data protection implication in this retention. ISP's have for years argued successfully that they do not control the internet users data on their sites. The control of that data, including e-mails rested with the users, not the ISP's. Internet users within the EU have to apply the European data protection directive. That directive requires data controllers (Internet Users in this context) to retain their data for no longer than necessary. The retention of personal e-mails sent by myself, via my ISP, is something I have taken the trouble to find out about in order to ensure compliance with that principle. Workwise I had need to do the same because of subject access and addressing ISP retention periods by encouraging an adjustment of suppliers is an ongoing task. If data is to be retained by ISP's for 7 years, irrespective of the data controllers wishes or requirements, what is the effect of that on control of the data? Does the ISP become the controller, if so why and how? If not how can retention be justified for 7 years? IanW