Metadata retention: what will happen to your phone and web records now?
|
Version 0 of 1. The federal government is embarking on a mandatory data retention regime that will force internet and phone companies to store Australians’ web, call and location data for two years, giving government agencies warrantless access to this information. It is a proposal that is bucking the trend around the world, with many European nations either having had data retention laws struck down by courts or dropping proposals due to a major public backlash. It means that government agencies, with the click of a button, will be able to send a simple form to an internet service provider (ISP) and retrieve information about who you emailed, where you were at the time, and what kind of device you were using – and data of this kind that is up to two years old. Under the existing regime there were more than 500,000 disclosures made relating to Australians’ personal information in the last year. The bill was introduced with little warning on Thursday, even the Coalition party room only learning of it in a morning meeting. It is complex legislation and the proposal has already sparked major concerns among privacy advocates, the Greens and some crossbench senators, not to mention from ISPs who are concerned they will have to pass on the costs to their customers. So here are six key points you need to know about what will happen to your phone and internet records now. 1. What is the mandatory data retention proposal and what kind of personal information will be stored? The federal government’s data retention proposal is about forcing telecommunications companies to keep your phone and web logs in a consistent way. The government says this is so that agencies can access it for criminal investigations, and have argued the current state of affairs is hindering their capabilities. What the proposal specifically relates to is “metadata”, which is considered be information that does not include the contents of a communication. So what you actually write in an email wouldn’t be included. But this type of data can actually tell you more about a person than content ever could. Broadly speaking, it would allow government agencies to find out what numbers you called, who you spoke with, where you were at the time, who you emailed, where you accessed the internet from and what device you were using. That’s a lot of details about where you go, who you speak with and who you write to that can reveal significant parts of your life. The problem is we still don’t know exactly what information will be required to be stored, because it will be left up to the minister of the day. This bill would allow the minister to determine what the specific information would be, through regulations, although it does clearly state that content is excluded. 2. Do these government agencies need a warrant? No, they do not. One of the key criticisms of this entire regime is that telecommunications companies are being asked to hand over vast swaths of Australians’ phone and web data without a warrant. The current bill does nothing to alter that or heighten the threshold for access to telecommunications data. Australia’s approach to this type of retention has sparked global condemnation from privacy and press freedom organisations. 3. Which organisations will be able to access your personal data? This bill would drastically limit the number of agencies that can access Australians’ metadata, making it much harder for local councils, the RSPCA and other agencies to access it on demand. Instead, only state and territory police, the AFP, Icac and a few other enforcement agencies will be automatically granted access. This is in some respects a victory for privacy advocates who raised serious concerns about the number of agencies that could access telecommunications data, and for news organisations such as Guardian Australia who made submissions on this point. But it might not last. The bill entirely repeals the definition of an “enforcement agency” to curb the number of agencies, but it replaces this with a structure that allows the communications minister to declare which agencies can access metadata. This means it would of course be open to the minister to declare that, say, all local councils in NSW should be able to access metadata. 4. What will it cost and who will pay? The short answer is that you, your ISP and the government will all sustain costs. The government has pledged to “pay a reasonable share of upfront capital costs”, but it is not clear what this will be. This also appears to suggest that the ongoing costs to providers will be borne by them, which will inevitably flow down to consumers. There is already a mechanism in the Telecommunication Interception and Access Act that imposes some costs on providers, and some costs on the government. These new proposals appear to sit outside of that, so it is still not entirely clear what the division would be. What we do know is that Vodafone and other companies have warned the costs will go into tens of millions of dollars, some of which will inevitably be passed on to customers. iinet has previously warned it will cost consumers about $100 a year. 5. So who oversees it? The short answer is that nobody oversees the process of handing over telecommunications data as it happens. It’s a quiet exchange between the government agency and the ISP or phone provider – using just a one-page form – with no independent oversight whatsoever. The bill does create a more onerous role for the Commonwealth Ombudsman to inspect records after the fact, and this is definitely a new oversight mechanism (although it is not clear how the ombudsman will manage this additional role, as there is no indication it will be given more funding). But its oversight role happens well after the fact. Many civil liberties groups and news organisations – including Guardian Australia – have argued there should be a form of public interest monitor that would be able to examine authorisations as they occur. The current regime of such easy access could easily lead to journalists’ sources being exposed. It is also going to be harder to know how many times metadata is being requested, because in a separate bill the government is proposing to abolish statistics that telecommunications companies lodge on the number of disclosures they make to government agencies. In the last year it was over 500,000, but this may well be the last time we ever see such figures, leaving murkier statistics compiled by agencies. 6. What happens now? The data retention bill will be referred to the parliamentary committee on intelligence and security, which is made up of Labor and Coalition MPs and senators. The Labor party agreed to support both the first and second national security bills with the amendments proposed by this committee, and it remains to be seen whether it will deliver the same support that would guarantee the passage of this third bill. |