These Regulations are made under the Data Retention and Investigatory Powers Act 2014. They are intended to revoke and replace the Data Retention (EC Directive) Regulations 2009. They effectively replicate the 2009 Regulations, while providing additional safeguards, in requiring telecommunications service providers to retain certain types of communications data for a period not to exceed 12 months.
Previously, under the Privacy and Electronic Communications (EC Directive) Regulations 2003, companies were permitted to retain communications data they needed for business purposes. Where that data was retained it was available for relevant public bodies to access. However, once the data was no longer needed for business purposes it should be deleted or made anonymous, unless otherwise required by law.
Part 11 of the Anti-Terrorism, Crime and Security Act 2001 provided a basis for the voluntary retention of communications data in the UK. Parliament approved a voluntary code of practice under that Act in 2003. The Data Retention (EC Directive) Regulations 2007 implemented the EC Directive in respect of mobile and fixed line telephony. The 2009 Regulations, which revoked and replaced the 2007 Regulations, implemented the EC Directive with respect to the retention of communications data relating to internet access, internet telephony and internet e-mail as well as mobile and fixed line telephony. These 2014 Regulations revoke and replace the 2009 Regulations.
Communications data is the context not the content of a communication. It can be used to demonstrate who was communicating; when; from where; and with whom. It can include the time and duration of a communication, the number or email address of the originator and recipient, and sometimes the location of the device from which the communication was made. It does not include the content of any communication: for example the text of an email or a conversation on a telephone.
Furthermore, communications data is used by the intelligence and law enforcement agencies during investigations regarding national security and, organised and serious crime. It enables investigators to identify members of a criminal network, place them in specific locations at given times and in certain cases to understand the criminality in which they are engaged. Communications data can be vital in a wide range of threat to life investigations, including the investigation of missing persons. Communications data can be used as evidence in court.
As such, communications data policy in the UK can broadly be split into two policy areas: retention and acquisition. If data is not retained it cannot be accessed. Considering its importance to law enforcement and the security service, it is crucial to ensure it is retained and can be accessed by relevant public authorities under strict controls.
