By Karlin Lillington

 

A Cabinet direction last April ordering phone companies to secretly retain the telephone call records of Irish citizens for three years may violate European law and the Irish Constitution, according to Irish and international legal experts.

 

Commentators – including the Data Protection Commissioner, Mr Joe Meade -- have also expressed grave concern that the Direction was enacted in a such a way that it was not subject to Oireachtas oversight or judicial review.

 

According to several legal sources, the Government seems to have secretly used laws designed to allow the interception of phone calls to collect data traffic on the State's entire population. However, because the actual Direction has remained secret, the Irish Council for Civil Liberties (ICCL) noted that it was difficult to determine exactly what was done. 

 

The Department of Justice disputed this view. A spokesman said that data traffic retention (retaining records of information about when and where calls were made, by and to whom, and for how long) was different from data interception (the retention of the content of calls or faxes), and said the State was allowed to retain data traffic.

 

But data traffic laws allowing mass retention do not yet exist. The order for retention of data traffic was made using data interception laws intended for the surveillance of the call information of individuals suspected of committing a crime.

 

“It appears that the original laws would not have been intended to be used for the blanket retention of traffic data for all the citizens of Ireland,” said Mr Malachy Murphy, Irish Council for Civil Liberties. "The fact that this was done in secret also raises serious cause for concern, because there was no way anyone could have known about it to request a judicial review."

 

“This is a potential violation of the EU Convention on Human Rights, Article 8," said Mr Cedric Laurant, policy counsel for the Electronic Privacy Information Center (EPIC). EPIC is a well-known Washington DC-based public research organisation that has regularly taken court challenges on laws affecting privacy up to US Supreme Court level.

 

"If a government wants to intercept or retain data, there has to be an existing law with a text that is accessible to the public, and the action must be proportionate to need. Here, there was no law, and it was done in secret," Mr Laurant said. Ireland appears to be the only western country to have brought in mandatory data retention.

 

One senior Irish legal source said: "The Department's view seems to be that because there are no explicit restrictions on retaining data traffic, they can do this. Whereas, in a constitutional culture, the law is most likely to be interpreted in another way – because there is no explicit permission, it's not allowed. Unless there was express permission, this is unconstitutional."

 

The Direction, issued a month before the General Election by then Minister for Public Enterprise Ms O’Rourke on the instruction of then Minister for Justice Mr O’Donoghue after a Cabinet decision, remained under Cabinet confidentiality.

 

Telecommunications companies were explicitly told not to reveal the Direction, according to a statement made by Mr Meade at a Department of Justice forum on data retention last week.

 

The revelation comes as ministers have controversially announced proposals to restrict the terms of the Freedom of Information Act. Under the proposals, new limitations would be placed on the public's ability to scrutinise ministerial actions, and Cabinet decisions and discussions would not be revealed until 10 years afterward, rather than the five years specified in the current Act.

 

Mr Meade noted last week that he "was not happy with the Direction" in part because "it would have remained confidential until a Minister chose to reveal it." After Minister for Justice Mr McDowell disclosed the existence of the Direction at last week's forum, Mr Meade provided additional detail. Mr Meade was involved in Government discussions that led to Cabinet ordering the Direction.

 

In separate responses to a question on why the Direction was issued secretively through the Cabinet, and why phone operators were told to keep the Direction confidential, the Department of Communications -- which now has oversight of the communications portfolio -- and the Department of Justice each said the question should be referred to the other's Departments.

 

The power to issue the April Direction is partially based on a section of the 1983 surveillance act -- the Postal and Telecommunications Services Act, which was extensively revised to limit Ministerial power to order surveillance, after it emerged that the State had placed phone taps on several journalists' phones.

 

The Direction also is based on sections of the Interception of Postal Packets and Telecommunications Messages (Regulation) Act, 1993 – a revision of the 1983 ACT which explicitly requires judicial oversight when personal privacy might be compromised. The two Acts were designed to allow the collection of communications data from individuals believed to be guilty of a criminal offence.

 

University of Limerick law professor Mr Dermot Walsh, who has written on the 1983 and 1993 Acts as well as a book on Constitutional law, said: "This [basis for the Direction] strikes me as going beyond the scope of the Acts." The original laws were directed at individuals suspected of involvement in a crime, allowing law enforcement to conduct surveillance on that individual as calls are being made, not for "interception [after the fact] of all citizens' data traffic, to be held for several years" he said.

 

"Under one interpretation, the Acts might be broad enough to allow for what the Minister seems to be doing. But in the context in which this arises, and taking into account the '93 Act's intention to provide privacy and human rights protections, the Minister seems to be using a provision designed for one particular purpose for a much broader purpose. One could see the courts striking down such a Direction."

 

 

The Direction was issued after Mr Meade challenged the operators' practice of retaining call records for up to six years, which they said they needed to do to conform to the Statute of Limitations. He recommended six months' retention instead, and determined the operators were not legally required to retain records at all.

 

The Department of Justice and law enforcement were concerned that if records were not retained, data helpful to criminal investigations could be lost. According to Minister for Justice Mr McDowell, the Direction was intended as a short-term measure until legislation could be brought in to cover how such data should be handled. The Department is currently advocating a three-year data retention law to cover all phone, fax and mobile calls, as well as data traffic for all email and internet use.

 

Mr Meade has expressed his concern that the Direction, intended to a short term measure, has now been in place for a year and is intended to remain in place until the planned data retention legislation is implemented in October.

 

Existing data protection laws would not allow for mass data retention, said Mr Laurent.

 

A month after issuing the secret Direction, Ms O'Rourke issued a Statutory Instrument (SI) bringing into law the EU's 1997 Data Protection Directive, five years late and with the State under threat of legal action from the EU for the delay.

 

 

This Page was last update: 30/03/2003; 12:39:10
Copyright 2003 Karlin Lillington
Theme Design by Bryan Bell