Statistics on Requests for data under the Data Retention Directive

Transcription

1 Statistics on Requests for data under the Data Retention Directive Introduction 1. Directive 2006/24/EC on data retention ('the DRD') 1 requires Member States to provide the Commission on a yearly basis with statistics on data retention. Article 10 of the DRD states: (1) Member States shall ensure that the Commission is provide on a yearly basis with statistics on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or a public communications network. Such statistics shall include: - the cases in which information was provided to the competent authorities in accordance with applicable national law, - the time elapsed between the date on which the data were retained and the date on which the competent authority requested the transmission of the data, - the cases where requests for data could not be met. (2) Such statistics shall not contain personal data. 2. In January 2009, following advice from the Commission's Data Retention Experts Group, the Commission issued a template for submitting annual statistics. The group in November 2012 adopted updated and more comprehensive guidance on the provision of statistics under Article 10, which the Commission encourages all Member States to follow Statistics for 2008 and 2009 were published in the report on the evaluation of the Directive 3, and 2010 statistics were published on the DG Home Affairs website. Subsequently some Member States have provided statistics for 2011 and This document brings together all of those the statistics, including where required updates and corrections. General notes 4. The evaluation report stated that not all Member States had been able to provide statistics and, where they had been provided, statistics differed in scope and detail: for instance, in Czech Republic, Latvia and Poland, competent authorities submit identical requests to each of the main mobile telephone operators, and the statistics reported 1 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ L 105, , p This experts group was established under Commission Decision 2008/324/EC which applied until 31 December Commission Decision C(2013) 2144 of set up a new experts group on best practice in the implementation of electronic communications data retention for the investigation, detection and prosecution of serious crime (C(2013) 2144 final). The current guidance is published here 3 COM(2011) 225 Evaluation report on the Data Retention Directive (Directive 2006/24/EC). 1

2 therefore distort the overall picture. This remains the case. A number of specific areas of confusion regarding Article 10 have been raised with the Commission. i. There are different interpretations of the term 'cases'. This term could mean (i) each and every item of data that was or was not provided, (ii) each request which may be for one set or multiple sets of data, or (iii) each investigation in which there might be multiple requests for multiple items of data. ii. iii. iv. Where the request is addressed to a service provider is for more than one item of data, the data may be of different ages. Recording the age of individual data records could be unduly onerous for operators and/or competent authorities. Statistics submitted from some Member States only refer to requests for traffic and location data and not to subscriber information acquired from operators. The phrase 'Cases where requests for data could not be met' has been interpreted in various ways to mean i) cases where the service provider was unable to provide data that should have been retained under the DRD but were not retained; ii) data that were needed but which do not fall within the scope of the DRD, or iii) data that had been retained but were no longer available because the request was made after the expiry of the retention period. 5. Furthermore, Member States law enforcement authorities and data protection authorities are generally not in a position to know whether the precise data used in investigations and prosecutions was stored by the operators solely in order to comply with the data retention obligation. There is no obligation to store separately those data needed for (a) business purposes), (b) purposes of combating 'serious crime', as referred to in the DRD, and (c) for public order purposes other than combating serious crime, which may be permitted under Directive 2002/58/EC. Supervisory authorities do not have enforcement powers to ascertain which data is kept for which purposes, although, according to a report by the Article 29 Working Party, separation seems to be the norm in most Member States Statistics are presented in two separate tables for each year from 2008: i. requests for retained data where data was disclosed according to age of data when requested; 4 Article 15(1) of Directive 2002/58/EC on 'e-privacy' allows Member States to restrict privacy rights and obligations, including through the retention of data for a limited period, to safeguard national security, defence, public security and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. See EDPS opinion on evaluation report on the DRD, May and Article 29 Working Party Report 01/2010 Report 01/2010 on the second joint enforcement action: compliance at national level of telecom providers and ISPs with the obligations required from national traffic data retention legislation on the legal basis of article 6 and 9 of the e-privacy Directive 2002/58/EC and the Data Retention Directive 2006/24/E amending the e-privacy Directive Recital 12 of the DRD acknowledges that data may be retained beyond the categories in the scope of the DRD and for purposes other than those set down in DRD. 2

3 ii. requests for retained data where data was disclosed according to the category of data requested. (Note: this information is not required under the DRD.) 7. Figures in brackets indicate cases number of requests where data was not disclosed. 8. 'Age' means time elapsed between the date on which the data were retained and the date on which the competent authority requested the transmission of the data. 9. 'Internet-related data' means data concerning internet access, internet and internet. 10. Statistics in brackets denote number of requests where data could not be disclosed to competent authority. Notes on Member States which have provided statistics (1) DRD has not been fully transposed. Data provided by Ministry of Justice. Bulgaria (1) Statistics provided by the Bulgarian data protection authority, the Commission for Personal Data Protection (CPDP), on the basis of information provided by operators subject to data retention requirements. (2) No breakdown of age of data was provided, but the CPDP has instructed operators to provide such a breakdown in statistics for (3) Breakdowns were provided according to operator receiving the requests for the data, and according to the competent authority requesting the data. (4) The CPDP did not report using the categories of data in the template developed in 2009 by the Data Retention Expert Group template. Instead the DPA statistics included breakdown of requests according to four 'types of service': (i) 'public telephone service', (ii) 'data transmission services', (iii) 'access to internet' and (iv) 'other electronic communications services'. For the purposes of this document, we treat (ii) and (iii) as 'internet-related data' and (i), (iii) and (iv) as 'not specified'. (5) The 2010 statistics cover the period 10 May March 2011 and represented the information provided by 33 operators; the 2011 statistics cover the whole calendar year (therefore there is duplication between the 2010 and 2011 statistics) and represent information from 22 operators; 2012 statistics cover the whole calendar year and represent information from 111 operators. (6) The CPDP adopted end 2012 compulsory instructions to all operators required to comply with data retention measures which led to the increase in the number of operators providing data for (7) According to the CPDP in its submission of 2012 statistics to the Commission, the category 'other electronic communications services' is defined as 'the transfer of radio and television programs and ones not specified by the company'. This term has been 3

4 the subject of 'misunderstanding' on the part of operators, which is believed to explain the considerable discrepancy between the 2011 and 2012 statistics. Czech Republic (1) Statistics provided by Ministry of Justice, which stated that 'The statistical register in the Czech Republic is kept according to case and not according to applications. A single application might contain several cases.' Estonia (1) Statistics provided by Estonian Technical Surveillance Authority, which stated that 'the increase in the number of cases was caused by the fact that the enquiries were made about ranges of telephone numbers, but the enumeration counted all the numbers separately and there were also used various modes of enquires that also imposed the figures.' (1) The overall statistic for 2010, which was submitted by the Ministry of the Interior, is an estimate of the total number of requests for data by the Hungarian authorities. Greece (1) Statistics provided by Hellenic Authority for the Information and Communication Security (ADAE) and Privacy via Ministry of Justice. (2) Data based on information from 11 operators. (3) No detailed breakdown available, although ADEA reported that the time elapsed between date of retention and date of request from competent authority was '3-5 months'. Ireland (1) Statistics provided by the Ministry of Justice. Lithuania (1) Statistics provided by State Data Protection Inspectorate. (2) Method for collating statistics was changed in Pre-2010 statistics include all requests for data; statistics for 2010 onwards include only requests in connection with serious crime. (3) Lithuanian law enforcement agencies calculate each query as a separate case, which may include a request for data on say, 10 telephone numbers. To investigate mobile phone activity, identical requests tends to be sent to the three mobile operators. Luxembourg (1) Only partial statistics available, which were provided by Police Grand-Ducal (2) Statistics on requests by data category refer to mobile location data - cell ID and data and time of communication. 4

5 Poland (1) Statistics provided by Office of Electronic Communications (UKE) (2) 2010 statistics were based on information from 262 entities (or 4% of all entities which are subject to the data retention obligation) which transmitted data on behalf of 283 operators statistics were based on information from 1040 entities (14% of all entities) transmitting data on behalf of 1074 operators; 2012 statistics were based on reports from 1908 entities (26% of all entities)on behalf of 1948 operators. (3) UKE considers that those entities which did not provide information probably did not receive any requests for data. (4) UKE report that in 2010 and 2011, 96% of overall number of requests were tended to be addressed to the five largest operators, and in % of total requests for data were addressed to the five largest operators. (1) No overall annual statistics available, but Ministry of Justice reported in March 2012 that since legislation transposing the DRD was adopted, there had been 225 requests for data for 39 separate judicial processes. The average age of the data requested was reported to be 4.7 months. (2) Statistics which have been provided only relate cases of data retained and requested for the purposes of investigation and prosecution of organised crime and terrorism,in compliance with national measures transposing the DRD. (3) Ministry of the Interior reported in May 2012 that the Immigration and Borders Service made 131 requests for data (not necessarily under the DRD) in 2010, 107 in 2011 and 80 in 2012; no figures were provided for other competent authorities. Slovenia (1) Statistics provided by the Ministry of Justice based on data from the courts. (2) Statistics are broken according to 'voice traffic' (understood to be fixed and mobile data) and 'internet traffic' (internet related data). Slovakia (1) Statistics provided by the Ministry of Transport, Posts and Telecommunications. (2) Breakdown by age and category of data not available for years before Finland (1) Statistics provided by the Ministry of the Interior (2) Number of requests where data could not be provided concerned data which was not available as the retention period had elapsed. (3) Breakdown by data type not available. 5

6 UK (4) Finland also provided statistics on the number of requests from the police and the number of requests from other authorities: the majority of requests were from the police. (1) Statistics are provided by the Home Office who require service providers to provide statistical information annually. Statistics provided concern not calendar year but financial year (ie April March). Service providers each operate different working practices and have different data retention systems which may cause some variability across the statistics provided. For example, some providers report the figures on the basis of the number of requests (which may involve several individual pieces of data of differing ages) where as others report on the number of pieces of data disclosed. (2) Due to the different working practices, the statistics may include requests for traffic, subscriber and user data as well as data retained already for business purposes and not necessarily as a result of DRD obligation. Separate statistics collected within the UK indicate that subscriber data may account for up to 50% of the data returned. (3) No more than 2/3 of service providers were able to supply the age of data disclosed between 2009 and Between 2008 and % of disclosures where the age of the data is known concerned data under 3 months old, 13.60% concerned data 3-6 months old, 6.13% concerned data 6-9 months old and 5.54% concerned data 9-12 months old. As the UK s transposition of the DRD mandates retention for a 12 month period, cases where the returns were known to include data which had been retained by a service provider beyond 12 months for business purposes have not been included. (4) The increase in the number of disclosures in 2011 and 2012 can, at least in part, be attributed to the fact that the UK hosted the Olympic and Paralympic Games in 2012 and that communications data supported a number of operations undertaken to ensure the Games were safe. Other significant events during the period, including the Queen s Diamond Jubilee celebrations, will also have an impact on these figures. (5) The sum of the figures on age of data requested for 2011 and 2012 do not equal the total number of disclosures. This is because some service providers were unable to distinguish and remove requests which were withdrawn or not met from their breakdown of the figures but could do so for the estimated number for the total period. (6) There may be a range of reasons why data requested were not disclosed: this includes where data requested were outside the retention period (and were not retained for business purposes), where data were requested from the wrong service provider in error, or where a system error prevented retrieval of the data. 6

7 2008: Requests for retained traffic data: Age of data when requested Age of data requested (months) Not specified Bulgaria Czech Republic (2490) (2490) Denmark (5) 3599 (5) Germany (931) Estonia (1526) 4490 (931) (1526) Ireland Greece Spain France Cyprus (5) 34 (5) Latvia (696) Lithuania Luxembourg Malta (133) 869 (133) Netherlands Austria Poland Slovenia Slovakia Finland (5883) (97) ( (5883) 7

8 2008: Requests for retained traffic data: Category of data Category Fixed network Mobile Internetrelated Not specified Bulgaria Czech Republic 4983 (131) (2276) 1537 (83) (2490) Denmark 192 (0) 3273 (5) 134 (0) 3599 (5) Germany (931) (931) Estonia 4114 (1519) 376 (7) 4490 (1526) Ireland 5317 (16) 5873 (48) 2905 (33) (97) Greece Spain 4448 (0) (0) 9117 (0) (0) France Cyprus 3 (0) 31 (5) 0 (0) 34 (5) Latvia 1602 (90) (530) 1052 (76) (696) Lithuania Luxembourg Malta 29 (0) 748 (120) 92 (13) 869 (133) Netherlands Austria Poland Slovenia Slovakia Finland (0) (0) (0) (0) (5786) 8

9 Age of data requested (months) Bulgaria Czech Republic 2009: Requests for retained data: Age of data when requested Not specified (10 446) Denmark (11) Germany Estonia (2768) 8410 (2768) Ireland (92) (92) Greece Spain France Cyprus (3) 37 (3) Latvia (560) (560) Lithuania Luxembou rg Malta (902) 4023 (902) Netherlan ds Austria Poland Slovenia 1918 (48) Slovakia 5214 (157) 1918 (48) Finland (157) (14 987) (14 987) 9

10 2009: Requests for retained data: Category of data Category Bulgaria Czech Republic Fixed network (934) Mobile (9141) Internetrelated (371) Not specified (10 446) Denmark (10) 162 (1) 4066 (11) Germany Estonia 6422 (2279) 902 (21) 1086 (468) 8410 (2768) Ireland 4542 (16) 5239 (20) 1502 (56) (92) Greece Spain (0) France Cyprus 0 23 (3) (3) Latvia 1672 (218) (102) 1628 (240) (560) Lithuania 1321 (0) (6237) (343) (6580) Luxembourg Malta 156 (10) 3693 (882) 174 (10) 4023 (902) Netherlands Austria Poland Slovenia 1918 (48) 1918 (48) Slovakia 5214 (157) 5214 (157) Finland (6237) (343) (14 987) (21 567) 10

11 2010: Requests for retained data: Age of data when requested Age of data requested (months) Not specified Bulgaria (920) Czech Republic (104) (35) 9964 (9986) (920) 494 (69) (10 194) Denmark Germany Estonia 1466 (692) Ireland (3) Greece 952 (251) 1612 (1) 612 (17 379) 1143 (80 086) 4173 (98 408) (4) Spain France Cyprus 76 (7) 3 (1) 79 (8) Latvia (288) Lithuania (1) 4407 (95) 1734 (40) (30 701) 2013 (46) 392 (438) 1443 (52) 1216 (39) (560) (31 140) Luxembourg Malta Netherlands Austria Poland (16 623) (3) 23 (3) Slovenia (18) Slovakia (291) 7125 (291) Finland (149) 5663 (149) (1095) (492) (383) (58 106) (80 639) (52) (39) (18 496) (492) ( ) 11

12 2010: Requests for retained data: Category of data Category Fixed network Mobile Internetrelated Not specified Bulgaria (916) 109 (4) (920) Czech Republic (761) (9086) 7807 (347) (10 194) Denmark Germany Estonia 2570 (97 935) 706 (27) 897 (446) 4173 (98 408) Ireland (4) (4) Greece Spain France Cyprus 57 (8) (8) Latvia 1132 (191) (122) 1604 (247) (560) Lithuania (31 102) 1820 (38) (31 140) Luxembourg Malta Netherlands Austria Poland (16 623) (16 623) 23 (3) 23 (3) Slovenia 1728 (18) 1728 (18) Slovakia 7125 (291) 7125 (291) Finland 5663 (149) 5663 (149) (98 887) (40 349) (1082) (492) (492) (18 492) ( ) 12

13 2011: Requests for retained data: Age of data when requested Age of data requested (months) Not specified Bulgaria (1376) (1376) Czech Republic (4791) (5011) (9027) (187) (19 016) Denmark Germany Estonia 1689 (367) 954 (222) Ireland 9301 (1) 1152 (1) Greece Spain France 545 ( (5569) 3813 (1338) (2) Cyprus 55 (1) 11 (1) 66 (2) Latvia (430) 4982 (183) 1822 (102) 1623 (89) 1622 (87) 2171 (131) (1022) Lithuania (1847) 104 (25) (1872) Luxembourg Malta Netherlands Austria Poland (17 219) (17 219) Slovenia (6) 1473 (6) Slovakia (115) 4520 (86) 2050 (89) 2905 (24) Finland 5331 (221) (5705) (786) (5504) (11 245) (894) (87) (131) (19 608) (314) 5331 (221) (786) (43 174) 13

14 2011: Requests for retained data: Category of data Category Bulgaria Czech Republic Fixed network Mobile Internetrelated (517) (151) 6370 (179) (17 117) 4556 (1720) Not specified (708) (1376) (19 016) Denmark Germany Estonia 1477 (1030) 807 (25) 1529 (283) 3813 (1338) Ireland (2) (2) Greece Spain France Cyprus (2) 66 (2) Latvia 981 (157) (330) 3246 (535) (1022) Lithuania 376(14) (1858) 513 Luxembourg Malta Netherlands Austria Poland (17 219) (1872) (17 219) Slovenia 1473 (6) 1473 (6) Slovakia 158 (62) (88) 689 (164) (314) Finland 5331 (221) (1959) (19 420) (2855) (786) (18 940) 5331 (221) (786) (43 174) 14

15 2012: Requests for retained data: Age of data when requested Age of data requested (months) Not specified Bulgaria (1083) Czech Republic (7581) 4539 (1831) 720 (1794) 2104 (110) (1083) (11 316) Denmark Germany Estonia 1561 (427) Ireland 6415 (257) 910 (371) 1034 (329) 925 (167) 589 (30) 773 (366) 325 (32) (12) Greece (3026) Spain France Cyprus Latvia Lithuania (1878) Luxembourg 35 (10) 145 (1) 6 (2) 4149 (1331) 8829 (664) (3026) (1888) Malta Netherlands Austria Poland (44 505) (44 505) Slovenia (1) 1277 (1) Slovakia Finland (497) 5534 (497) (8265) (716) (2531) (3869) (518) (49 831) (716) (65 027) 15

16 2012: Requests for retained data: Category of data Category Bulgaria Czech Republic Fixed network Mobile Internetrelated (699)* (355) (1104) (9161) 3016 (1051) Not specified 13 (29) (1083) (11 316) Denmark Germany Estonia 1469 (1030) 845 (43) 1855 (258) 4169 (1331) Ireland (193) 2187 (469) 8829 (662) Greece (3026) Spain France Cyprus Latvia Lithuania Luxembourg Malta Netherlands Austria (1888) 102 Poland (44 505) (3026) (1888) (44 505) Slovenia 1263 (1) (1) Slovakia Finland 5534 (497) (2834) (11 285) (2133) (716) (48 775) 5534 (497) (716) (65 027) DG Home Affairs European Commission October