3 The EU Data Retention Directive in an Era of Internet Surveillance
Hal Roberts and John Palfrey
Introduction
The European Union (EU) enacted a directive on data retention in 2007 that requires
all member countries to mandate the retention by telecom companies of the sender,
recipient, and time of every Internet or other telecom communication. The directive
requires the collection of the Internet Protocol (IP) address, user ID, phone number,
name, and address of every sender and recipient, but explicitly excludes (but does not
forbid) the monitoring of content itself. All the monitored data must be retained for a
period ranging between six months and two years, contingent upon the local law of
each member state. Telecom companies must promptly give these data to law enforcement authorities upon request to assist with serious crimes, overseen by a national
public authority monitoring the data retention practices. 1 As of its effective date of
April 2009, all Internet service providers (ISPs) in EU countries must comply with the
relevant national implementations of the directive.
The monitoring required by the EU data retention directive amounts to a form of
surveillance. The directive does not take the form of surveillance that most quickly
leaps to mind: the two men in a van with headphones listening to phone conversations of an unwitting crook in a seedy apartment. But it has functional similarities.
The directive requires that the participating states collect personal data about their citizens without the citizens’ consent. It enables states to use these data to control some of
the subjects of monitoring (including by arresting them). What matters most about the
directive and its relationship to surveillance is its impact on citizen activity and its
place in the growing constellation of surveillance activities online.
The Internet is a ‘‘surveillance-ready’’ technology. There is a wide range of choices
for any state that wishes to know more about its citizens. This digital information
comes in the form of bits of data that flow through rivers and into oceans of data.
These rivers are full of information that passes by a given point, or series of points, in
a network and can be intercepted; these oceans are stocked with information that can
be searched after the fact; and the rivers arise from springs that can be watched at the
source. The data involved are held in private hands as well as public.
Hal Roberts and John Palfrey
Introduction
The European Union (EU) enacted a directive on data retention in 2007 that requires
all member countries to mandate the retention by telecom companies of the sender,
recipient, and time of every Internet or other telecom communication. The directive
requires the collection of the Internet Protocol (IP) address, user ID, phone number,
name, and address of every sender and recipient, but explicitly excludes (but does not
forbid) the monitoring of content itself. All the monitored data must be retained for a
period ranging between six months and two years, contingent upon the local law of
each member state. Telecom companies must promptly give these data to law enforcement authorities upon request to assist with serious crimes, overseen by a national
public authority monitoring the data retention practices. 1 As of its effective date of
April 2009, all Internet service providers (ISPs) in EU countries must comply with the
relevant national implementations of the directive.
The monitoring required by the EU data retention directive amounts to a form of
surveillance. The directive does not take the form of surveillance that most quickly
leaps to mind: the two men in a van with headphones listening to phone conversations of an unwitting crook in a seedy apartment. But it has functional similarities.
The directive requires that the participating states collect personal data about their citizens without the citizens’ consent. It enables states to use these data to control some of
the subjects of monitoring (including by arresting them). What matters most about the
directive and its relationship to surveillance is its impact on citizen activity and its
place in the growing constellation of surveillance activities online.
The Internet is a ‘‘surveillance-ready’’ technology. There is a wide range of choices
for any state that wishes to know more about its citizens. This digital information
comes in the form of bits of data that flow through rivers and into oceans of data.
These rivers are full of information that passes by a given point, or series of points, in
a network and can be intercepted; these oceans are stocked with information that can
be searched after the fact; and the rivers arise from springs that can be watched at the
source. The data involved are held in private hands as well as public.