UK ISPs Propose Principles to Limit Government Internet Snooping

The UK Internet Service Providers Association (ISPA) has today set out the five principles that it hopes will be used by the Government as part of on-going plans to reform state surveillance laws and related regulations, which some fear could result in a broadening of powers and more unnecessary snooping on innocent individuals.

Anybody following the recent developments will know that two previous attempts to extend existing Internet snooping powers, first by the previous Labour Government and most recently by the Conservative half of the current coalition, have both been thwarted due to a lack of political support, concerns over costs / viability and general opposition from members of the public and other quarters.

Since then tentative efforts to revive the unpopular policy for a third attempt have already been dealt another blow after the European Court of Justice (ECJ) found that the EU’s much older Data Retention Directive, which requires member states and their phone / Internet providers to keep a basic access log of all website, email and phone call activity for up to 2 years (similar to the UK’s RIPA law), was now considered “invalid” (here and here) because, among other things, it breached the “fundamental right to respect for private life and the fundamental right to the protection of personal data” (i.e. Charter of Fundamental Rights of the EU).

The ruling ended up forcing the United Kingdom’s matching Regulation of Investigatory Powers Act 2000 (RIPA) to be redrafted, which the Government promptly did in July 2014. But this effort managed to ignore much of the substance in the ECJ ruling and even tacked-on a few seemingly questionable changes (here), albeit alongside a promise to review the measures in the near future and develop a more up-to-date policy.

But many fear that future policy will once again endeavour to revive the same aggressive Internet snooping approach as proposed twice before and it’s in this climate that the ISPA has decided to set out their five principles for achieving a better communications data regime.

The ISPA’s 5 Principles

* Data minimisation – Data retention should be limited as far as possible both in terms of data being retained and accessed

* Oversight maximisation – Data retention should be governed by a clear legal framework in which executive powers are subject to strong checks and balances

* Transparent operation – Data retention risks undermining public trust in communication networks if government does not publish information about the number of requests made to CSPs

* Jurisdictional respect – Any data retention regime must allow for a clear, robust and workable system to govern cooperation across jurisdictions

* Competitiveness – The impact of a communications data regime must protect the UK’s position as an attractive arena for digital businesses

Nicholas Lansman, the ISPA’s Secretary General, added: “The Internet plays a huge part in all our lives, and we ask that Government follow these principles when developing policy in this area to maintain public trust in the Internet and ensure the UK digital economy continues to thrive and innovate“.

The ISPA’s submission is somewhat vague, although a bit more depth on this approach can be found as part of their submission to Government’s Investigatory Powers Review (here). Ultimately any change to current policy may be a battle for the next Government, especially since the Liberal Democrats seem to be staunchly opposed to going much beyond what the current rules allow.

Quite how the political dynamic will change after the May 2015 General Election is yet to be known, although since both the Conservatives and Labour seem keen on data retention reform (i.e. with a view towards collecting more rather than less data about your online activity) then we wouldn’t be surprised to see tougher rules finally making it through.