Data retention: too many unknowns, too many unanswered questions
|
Version 0 of 1. Mandatory data retention is mass surveillance. As the former Victorian Privacy Commissioner said, it “is characteristic of a police state. It is premised on the assumption that all citizens should be monitored”. But what if you’ve got nothing to hide and you’re not fussed about rights and freedoms? Here’s some further practical consequences of data retention to consider. Your “metadata” in the court room The data retention bill does not impose any limitation on access to the retained data by other legal avenues. This means there’s nothing stopping your ex-husband, your employer, the tax office or a bank using a subpoena to get access to that data if it is relevant to a court case. Your telecommunications data – such information as who you called, when you called, your location, or who you emailed or messaged – could be relevant to any range of disputes. And the draft data set is complex and not yet finalised. Metadata isn’t like an envelope, whatever the politicians might say. It is possible to create meaningful personality profiles – including personal preferences, social and political affiliations, sexual orientation, health information, financial interests and ethnic identity. For example, certain phone numbers & email addresses are context specific: suicide hotlines, political parties, doctors, police, the list goes on. Telco data would be useful in commercial disputes involving trade secrets, intellectual property, or breach of confidence. And then there’s family law disputes, insurance disputes, workers compensation claims – and that’s before we get to the ubiquitous copyright cases. All this will likely increase the cost of litigation and reduce access to justice. Better resourced companies or individuals can more easily afford cost of issuing subpoenas or even preliminary discovery applications, as in the Dallas Buyers Club case. Taxpayers will fund their own surveillance We’ve heard much about the government’s cutting the red tape agenda, but less about the costs and regulatory burden of data retention on small telcos. The Australian Interactive Media Industry Association argues that data retention will be a strong disincentive for companies to invest in infrastructure in Australia. It’s unclear what the level of contribution the federal government will make to industry towards the up front or ongoing cost of complying with the proposed data retention regime. We do know that the costs will be significant. What costs will be passed on to residential and business customers? Ultimately we’ll all pay as tax payers and consumers. How much will this all cost? We still don’t know. Drive consumers away from Australian businesses A range of pragmatic compromises have been made to get this bill introduced into parliament. Just one example: what are known as third-party over the top services such as Gmail, Skype and Facebook are not currently covered by the data retention obligations. But data associated with services such as email, VoIP and SMS provided by your telco will be retained. As Greens senator Scott Ludlam points out, this means that “if my email account is an @iinet.net.au address, it will be within scope. And if my email is an @gmail.com, it’ll be out of scope”. This decision about the scope of the regime is likely to penalise Australian businesses, reduce their revenue, and reduce the already questionable effectiveness of the scheme in making the community safer. Off-shore data storage Your ISP can choose where it wants to store your data. As the Victorian Privacy Commissioner, David Watts, has submitted: So how is your personal information safe from the reach of foreign countries? How safe will your data be? The bill does not place any additional obligations on your telco to keep your data secure. Telcos and the privacy commissioner warn of increased risk of security breaches from the retention of large amounts of personal information for an extended period of time and the attraction to hackers by retention of larger amounts of data. Your telco has no absolute liability for the results of these increased risks, only a potential obligation under the Privacy Act to take “such steps as are reasonable in the circumstances to protect the information”. According to the Victorian privacy commissioner: Breaches to the security of large, well resourced private sector organisations are commonplace but many remain unknown because of commercial secrecy and the fact that Australia does not have a data security breach framework in place The risk of security breaches are real, as Privacy International has highlighted: In recent years, the privacy commissioner has investigated breaches of security by telcos and government agencies, saying that “Major telecommunications services providers that will be covered by the scheme are amongst the 20 entities most complained about to our office.” And if your telco does get hacked and your personal information is disclosed, they don’t have to tell you. But don’t ASIO and the AFP need data retention to protect us? The attorney general’s department couldn’t provide Ludlam with any evidence that data retention was effective in addressing the claimed objectives of tackling serious crime or protecting national security. What’s more, there is no limitation in the bill that the data can only be accessed to investigate or prosecute serious crimes. Our government isn’t alone in scratching around for evidence. UK representatives before the European court of justice in July 2013 conceded there was no “scientific data” to underpin the claimed need for data retention. In the US, the privacy and civil liberties oversight board found that there is little evidence that the metadata program has made the US safer. |