Firms count cost of keeping tabs on terrorists

By Anna McLauchlin

Date: 17/03/05

Europe's internet service providers and telecom companies are bracing themselves for increased costs as the European Commission and national governments edge towards new rules on data retention.

Following the Madrid terrorist attack in March last year, EU interior ministers set themselves a deadline of June 2005 to propose new rules on data retention and have since been working on a plan shaped by France, Ireland, the UK and Sweden.

On Tuesday (15 March), ministers from Europe's biggest states - France, Germany, Italy, Spain and the UK - said that they would back plans to oblige industry to retain for a year telephone and internet traffic details, such as the numbers of people called, addresses of mobile phone-owners and websites visited by internet users. But the requirements would fall short of recording actual conversations.

A proposal being discussed in working groups in the Council of Ministers would also force companies to retain significant amounts of data for at least 12 months, but would give member states leeway to extend this period up to three years.

Sources say that negotiations are being slowed by delegations wrangling over a list of exactly what data must be retained. A draft proposal is not expected to reach ministerial level before May.

Meanwhile, the European Commission's justice department is also working on its own proposal, which is being sent around the European Commission for consultation today (17 March).

An EU source confirmed that the Commission proposal, to be adopted "as soon as possible" in the Spring, would give less freedom to member states to decide how long data should be kept.

It will be based on the 'first pillar' of the EU treaty, where the Commission has the sole right to initiate legislation. Based on the internal market clause (Article 95), the proposal would see all member states following the same rules for the sake of a single market.

But justice and home affairs falls under the third pillar, allowing the Council to initiate legislation. Ministers would be free to shape the proposal and derogate from its rules if they so wished.

The Commission is under pressure to adopt its proposal before the Council reaches a decision, it will be harder for the Commission to push through its own rules.

"Once the Commission has adopted its proposal, for the sake of institutional harmony, the Council should probably back down," said one EU official.

But interior ministers may not give up their right to govern data retention at a national level so easily. "We will continue to work until the Commission presents something and then we will consider its arguments for basing a directive on the first pillar," said a Swedish official.

The Commission's justice department takes the lead on the proposal, which needs to be cleared by EU Information Society Commissioner Viviane Reding, who is expected to fight industry's corner.

The proposal will face fierce opposition from industry, which is worried about the cost of retaining vast amounts of data. For example, if the proposal required all email addresses to be retained, including those copied in, the data capacity needed would be huge.

Richard Nash, regulatory affairs manager at EuroISPA, an internet service provider association, claims the cost burden will be "phenomenal". "And what we're still missing is the justification for data retention," he adds.

Gus Hosein from Privacy International added: "Putting the whole of the EU population under surveillance just because at some point the information might be useful is simply illegal."

On 15 March 2005, Ministers from Europe's largest states - France, Germany, Italy, Spain and the UK - said that they would back plans to oblige industry to retain for a year telephone and internet traffic details, such as the numbers of people called, addresses of mobile phone-owners and websites visited by internet users. But the requirements would fall short of recording actual conversations. Following the Madrid terrorist attack in March 2004, EU Interior Ministers had set themselves a deadline of June 2005 to propose new rules on data retention and have since been working on a plan shaped by France, Ireland, the UK and Sweden.