April 10, 2014

ISPs and the Data Retention Directive

Letter sent to BT, Sky, TalkTalk and Virgin Media, asking for clarification of their data collection and retention policies after the Data Retention Directive is declared invalid

Data Retention Directive

I am writing to you to seek clarification of your approach to retention and use of your customers data, as a result of the European Court of Justice's ruling that the Data Retention Directive is invalid and does not apply as European law.

This directive was implemented into UK law by the Data Retention (EC Directive) Regulations 2009.  Since the European Court of Justice declared the directive outside the competence of the EU treaties, the UK was never required to implement it.  Therefore these regulations no longer have a valid basis in UK law.  It is our understanding that ISPs therefore should not be retaining user data unless there is some other legal basis for doing so.

We understand that you should only retain personal data such as IP logs and email communications data for legitimate business reasons or specific legal requirements.

In the interests of your customers, please can you:

(1) Confirm that you are not continuing to abide by the now defunct Data Retention Directive and regulations;

(2) Publish a description of the data you will be continuing to collect for business purposes (and how the data assists you) and what time period you will be holding the data for

Thank you,

Jim Killock
Executive Direcgtor
Open Rights Group