Real time communications monitoring legislation would need privacy safeguards to comply with EU laws, expert says

The Government confirmed its intention to introduce new laws on the use of 'communications data' at the weekend.

The laws would give UK intelligence body GCHQ real time access to information held by internet service providers (ISPs) and other internet firms, such as information on who individuals are contacting, how frequently and for how long, according to media reports. GCHQ would not require a warrant to access that data but would require one to access the content of those communications. The plans have been widely criticised by civil liberties groups.

Data protection law specialist Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law.com, said that the plans appear to be an attempt to strengthen access rights already available to the police and intelligence under the Regulation of Investigatory Powers Act (RIPA) and the Data Retention Regulations. However, she said the European Commission could challenge any new laws that unreasonably invade on internet users' privacy. 

"On the privacy side little has changed as ISPs and carriers are already required to give GCHQ access to information on request," Wynn said. "What is new is that this legislation means it could be demanded in real time, rather than simply asking for historic data." 

"However, the UK Government will need to take account of privacy when drafting any new law. It has already had to change UK laws on the interception of communications after the Commission challenged its compatibility with EU privacy laws. With a general strengthening of individuals' rights already planned under reforms to EU data protection laws, the Commission is likely to be similarly willing to clamp down on any new privacy-invading laws the UK drafts," Wynn said. 

Last year the Government made changes to RIPA after the Commission had referred the UK to the European Court of Justice (ECJ) over the claimed failings of UK law. The Commission had said that the privacy of internet users in the country was not being adequately protected. 

Earlier this year the Commission reported that its concerns had been addressed after RIPA was amended to state that it is now generally only legal to intrude on private communications if you have a warrant or both the sender and recipient of information have given consent, even if it is done unintentionally. Under the old RIPA regime there only needed to be 'reasonable grounds' for believing that consent had been given to allow communications to be intercepted without a warrant. 

The balance of privacy with communications monitoring has been the subject of two recent rulings by the ECJ in relation to online copyright infringement. The Court ruled that national courts cannot order ISPs or social networks to introduce broad monitoring and filtering mechanisms to identify and prevent illegal file-sharing by their customers. 

In both cases the ECJ assessed EU laws on copyright and the enforcement of intellectual property rights as well as laws on the liability of service providers, data protection and privacy in communications. It also weighed the fundamental rights to the protection of intellectual property against the rights to privacy, free speech, the freedom to conduct business, and protection of personal data. It said that, on balance, it would be unfair if courts could force social networks to monitor for illegal file-sharing.

"Any new legislation requiring ISPs and other internet companies to provide GCHQ with real time access to communication data must be carefully drafted to avoid non-compliance with EU law," Wynn said. "Suitable parameters will have to be put in place to provide a balance between the UK being effectively tooled in the fight against serious crime and the safeguarding of privacy."

"RIPA already provides scope for the use of communications data in investigating serious crime. Access to that information is already subject to certain parameters so it remains to be seen whether new laws would in fact much change the powers that are currently in place," Wynn said.

Law enforcement bodies already have the power to access historic communications data held by telecoms firms under the EU's Data Retention Directive. The Directive was established in 2006 to make it a requirement for telecoms companies to retain personal data for a period determined by national governments of between six months and two years. The Commission decided to regulate following terrorist attacks in Madrid in 2004 and London in 2005.

Telecoms firms are required to retain identifying details of phone calls and emails, such as the traffic and location, to help the police detect and investigate serious crimes, the Directive states. The details exclude the content of those communications.

Law enforcement bodies in the UK also already have the power to intercept individuals' communications in certain circumstances. RIPA enables law enforcement bodies to intercept communications by requiring telecoms providers to hand over certain information they hold.

Telecoms companies have a duty under RIPA to hand over communications data it has or could obtain about customers when asked to do so by police unless "it is not reasonably practicable" to do so. The Home Secretary can ask the courts to issue an injunction "or any other appropriate relief" against telecoms firms that fail to comply with their duty under RIPA. The type of injunction that courts can issue is not defined by RIPA.

However, first the law enforcement bodies must obtain the Home Secretary's authorisation to intercept the communications.

Under RIPA the Home Secretary has to assess whether the request to intercept communications is necessary and proportionate in order to protect the UK's national security interests, prevent and detect terrorism and serious crime or to safeguard the UK's economic well-being.

Under the Act the Home Secretary must consider certain factors relating to the necessity and proportionality of any interception before authorising it, including "whether the information which it is thought necessary to obtain under the warrant could reasonably be obtained by other means".

The Act can be used by law enforcement agencies to force telecoms companies to hand over customers' details in order to tap phone, internet or email communications.

Wynn said that ISPs and social media networks could face technological challenges in complying with real time access requests and that GCHQ would face "information overload" unless real time access was suitably focused.

"Whether it is feasible or not to access real time communications data without the content of those communications being disclosed depends on whether there is the technology available to deliver that information quickly – otherwise ISPs will struggle to comply through no fault of their own," Wynn said.

"Given the enormous number of transactions involved there is also the danger that GCHQ will suffer from information overload, trying to sift through millions of calls, emails, texts and web visits to find what they are looking for in real time, rather than analysing patterns in historic data instead.”

The Home Office said communications data was "vital" to law enforcement investigations into "serious crime and terrorism and to protect the public," according to a report by the Guardian.

"We need to take action to maintain the continued availability of communications data as technology changes. Communications data includes time, duration and dialling numbers of a phone call, or an email address. It does not include the content of any phone call or email and it is not the intention of government to make changes to the existing legal basis for the interception of communications," the Home Office spokesman said.

"As set out in the Strategic Defence and Security Review we will legislate as soon as parliamentary time allows to ensure that the use of communications data is compatible with the government's approach to civil liberties," the spokesman said, according to a report by the BBC.

Under the Human Rights Act individuals are guaranteed the right to privacy surrounding their communications other than if a public authority, such as the police, believe it necessary to interfere with that right "in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others".