call +44 20 7096 1079
June 19, 2014 | Ed Paton-Williams

Demand your ISP stops retaining your data

In April, the European law forcing Internet Service Providers like BT, Sky, TalkTalk and Virgin to collect our communications data was struck down by the European Court of Justice. The judges said the law interfered with our right to privacy.

But UK ISPs have passed the buck. On the Government's advice ISPs are still retaining your personal data about who you email, text and phone, where you are and the websites you visit. We'll likely have to take legal action to stop this. First though, we need lots of the ISPs' customers to make a complaint.

ORG's new Legal Director Elizabeth Knight and solicitors from Deighton Pierce Glynn have prepared a legal letter of complaint demanding that your ISP stops retaining your data.

This is a really exciting time for ORG. We've just hired Elizabeth as our new Legal Director so we can take on big legal campaigns like this. We still need your help though to make sure we have lots of examples of people who have told their ISP to stop retaining their communications data.

Can you email the letter to your ISP in your name now? It's already written for you so it'll just take a minute.


At the moment we've only set up the action to contact BT, Sky, TalkTalk and Virgin Media. If you use another ISP, you can use this template letter to complain to them.

Dear [ISP name],

You will be aware of the judgment of the Court of Justice of the EU on 8 April 2014 in the Digital Rights Ireland case Joined Cases C-293/12 and C-594/12, which found the Data Retention Directive (Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC) to be in breach of Articles 7 and 8 of the EU Charter of Fundamental Rights and Freedoms and Article 8 of the European Convention on Human Rights.

This is likely to have the effect of rendering unlawful the UK's regulations implementing that Directive, known as the Data Retention (EC Directive) Regulations 2009. Accordingly, any requirement imposed on you by the Regulations or otherwise by the UK Government is likely to be unlawful as it is in breach of those same fundamental rights.

I ask you as my ISP to confirm to me within 21 days that you shall not store any data relating to me for any period other than as strictly required for the provision of internet services to me i.e. as soon as any data ceases to be necessary for technological reasons only then it shall be automatically deleted. I also ask you to confirm that you shall delete any data already held in relation to me.

If you are not prepared to provide the assurances I seek, then I ask you to state on what authority you continue to retain my data and for what purpose. I also ask you to clarify what arrangements you currently have in place with the UK Government for the retention of my data.

Yours sincerely,

[Your name]

google plusdeliciousdiggfacebookgooglelinkedinstumbleupontwitteremail


Comments (18)

  1. Mike:
    Jun 19, 2014 at 02:24 PM

    The form doesn't work for Sky Broadband. It just spits out the error message "Contact not found"

  2. D:
    Jun 19, 2014 at 02:30 PM

    Does this apply to Plusnet?

  3. Mike:
    Jun 19, 2014 at 02:34 PM

    Ok, it works now. Well, I assume it does, the success message had a mistake in it though: "You've just complained to Sky Broadban, but we might have to take legal action to stop this.". Missing a "d" in "Sky Broadband"

  4. Chris M.:
    Jun 19, 2014 at 02:59 PM

    I don't see how this works. Do I copy the text and send it through my email. I don't seem to be able to edit where it goes. Does it apply to Plusnet?

  5. Ed Paton Williams:
    Jun 19, 2014 at 03:47 PM

    @Mike - Sorry about that. It's fixed now.

    @D @Chris M - Yes it does apply to Plusnet but we've concentrated on the largest four providers here. Can you contact them using their Contact page? https://portal.plus.net/home-broadband/contact/

  6. Ian Gregory:
    Jun 19, 2014 at 06:07 PM

    Section 10(1) of the directive means that ISPs do not have to start logging until given notice in writing. My ISP (Andrews & Arnold) never received such notice so they never started logging (and if they do receive a notice they will challenge it).

    http://aa.net.uk/kb-other-data-retention.html

  7. T:
    Jun 19, 2014 at 07:12 PM

    I've had the impression that along with the porn filters this is only really enforced by the big four, i'm with newnet which is now owned by timico so i'm wondering if it's worth sending it to them. The closest i can find in their privacy policy regarding this is the following:

    NewNet stores information about users including usernames, circuit identifiers, IP addresses, email addresses etc. and may retain this information in accordance with requirements for business purposes and Data Retention. Stored information may be accessed and released in response to duly submitted requests by authorised law enforcement agencies.

    http://newnet.co.uk/Bottom-Bar/privacy-policy.php

    That little 'etc.' there is somewhat concerning. As privacy policies go it's scant on detail.

  8. Paul:
    Jun 19, 2014 at 08:00 PM

    I'm surprised that Orange/EE isn't classed as a major broadband provider. Is it still worth me sending your letter to them?

  9. Keith Lovett:
    Jun 20, 2014 at 06:59 AM

    I sent letter to Plusnet media enquiries: pressroom@plus.net. Hope this OK. Btw would a cc. address be a good idea for you to retain copies of email's sent . . . . or not? Keep up important work, Keith Lovett

  10. Brian Beesley:
    Jun 23, 2014 at 10:08 PM

    Plusnet? I'd suggest support@plus.net which is the general contact point for anything to do with your account. Brian Beesley

  11. Ralph:
    Jun 23, 2014 at 10:48 PM

    I've just written to Sky via https://contactus.sky.com/uk/make-a-complaint/about-sky-broadband/email (Appeared to accept it OK. Note I didn't send it via my Sky e-mail a/c because I haven't bothered to set it up (don't need it either, still using O2.)
    I also added: 'Please also note that should you not comply with my request, that damages may be sought against Sky, my ISP.'

  12. Tomas:
    Jun 24, 2014 at 10:24 AM

    I got a reply from Sky if anyone is curious:
    "Thank you for your email. We are aware of the ruling by the Court of Justice of the European Union. However, the Government has confirmed that it continues to consider that the UK Data Retention (EC Directive) Regulations 2009 remain in force within the UK. We will therefore continue to meet any obligations as set out in those Regulations under UK law, and retain data in accordance with our data privacy notice, which is attached for your convenience.

    http://help.sky.com/security/privacy/privacy-and-cookies-notice

    Sky does not comment on the specific operational arrangements for the retention of data."

  13. Ralph:
    Jun 24, 2014 at 12:10 PM

    I got a reply from one of their IDIOT employees: 'I am sorry, but it is not clear from your email what your enquiry is in connection with. Please respond to my email providing more details of your enquiry in order for me to fully resolve this matter.' [sic]

  14. Roger the Shrubber:
    Jun 24, 2014 at 05:42 PM

    The relevant BT URL seems to be: http://bt.custhelp.com/app/write_to_us

    That said, it doesn't work.

    No change there then...

  15. Mark Fraser:
    Jun 24, 2014 at 07:27 PM

    Got this reply from Sky

    Thank you for your email. We are aware of the ruling by the Court of Justice of the European Union. However, the Government has confirmed that it continues to consider that the UK Data Retention (EC Directive) Regulations 2009 remain in force within the UK. We will therefore continue to meet any obligations as set out in those Regulations under UK law, and retain data in accordance with our data privacy notice, which is attached for your convenience.

  16. barry clutton:
    Jun 26, 2014 at 12:38 AM

    Thought you might like to see the reply to the letter from my isp. Eclipse Internet....

    Dear Mr Clutton,

    (Call Transferred) Thank you for contacting Customer Support.

    I am unable to comment directly on the case you refer to but I can tell you that we comply with all regulations imposed on us. Details of our policies can be found in full at the following link:

    http://www.eclipse.net.uk/legal/

    Kind Regards,

    Michael Knight
    Technical Support
    Eclipse Internet

    40 pages of mumbo jumbo. No mention of data retention. There's a surprise, and why was it answered by Technical Support!
    Keep up the good work.
    Regards
    Barry Clutton  
     
     

  17. Anon:
    Jun 30, 2014 at 06:10 PM

    It is our understanding that the Data Retention (EC Directive) Regulations 2009 remains in force within the UK even though the European Data Retention Directive has fallen. We refer to an exchange in Parliament on 16 June 2014 in which James Brokenshire, on behalf of the Government, said “At the present time, we consider that the UK Data Retention (EC Directive) Regulations 2009 remain in force. Those in receipt of a notice under the regulations have been informed that they should continue to observe their obligations as outlined in any notice.”

  18. Anon:
    Jun 30, 2014 at 09:19 PM

    My response from Plusnet:

    Thank you for your letter. Plusnet, like most internet service providers (ISPs), retains your personal data for the primary purpose of providing our service and facilitating our billing and marketing, the latter having an opt-out option for all customers which is implemented at their discretion. The two cases mentioned by the Open Rights Group were recently settled at the European Court of Justice (ECJ) after the ECJ was asked to clarify the interpretation of an EC Directive in two separate court cases; one originating in the Republic of Ireland, and one from Austria. The ECJ’s decisions will now be taken into consideration by those local courts. As far as we are aware these two decision will have no immediately binding implication on any other member states, including the UK. The current law in the UK requires that all Internet Service Providers (ISPs) retain customer data for 12 months under the existing Data Retention (EC Directive) Regulations 2009. Although these ECJ cases may have an impact on future ECJ interpretations of the Directive, there is no ‘direct effect’ for the result of the case in the UK. In other words, the default position of UK ISPs is unchanged.



This thread has been closed from taking new comments.