Two years ago, a bill was passed regarding changes to the Data Retention Law of Australia. This law has since taken effect mid-April this year. Data Retention refers to the archiving of metadata of online activity of individuals by telecommunications and network providers.
The new law states that all metadata, that is, data relating to the basic information of online communications, must be stored by service providers for a minimum of 2 years, previously in which no minimum time existed. Many debates ensued regarding this change as users worry that their personal information is under threat.
Greg Gomme replied to an article on TheConversation, stating his disapproval in that “…it’s none of their damn business”.
However, I believe that data retention is a necessary aspect of online activity as it highly enhances the efficiency and accuracy it would bring to solving criminal cases as well as security threats, such as data hacking and/or terrorism. It was because of an inconvenience in investigation due to lack of metadata archives that led to the proposal of this law.
For one, it would allow investigation agencies to quickly rule out innocent people from suspicion. This is done by filtering suspects through variables such as location and time, thus massively reducing the time required to find the culprits.
It would also allow suspects to be identified and thus identifying potential crime associates, for example, finding the identity of one culprit allows police to then go through all incoming and outgoing calls of that person, leading to finding more suspects.
Furthermore, it can be used as evidence in court. Evidence such as alibis can be contradicted by presenting the metadata of the suspect, where the location presented by the suspect does not match the location shown on the metadata of their cell phone.
It is important to understand that the data retention law only refers to the basic information of communications, such as sender and recipient, IP addresses, date and time, etc. It does not include information such as browsing history or content of an email or SMS.
The law clearly defines what kind of data must be retained. Information that can directly lead to the identification of the user must be kept in a separate archive from activity of different users. Information of the user must be retained, but information about the user does not. Data Retention only controls the former. It has nothing to do with the latter.
Regarding the sceptical thoughts towards security, only higher agencies of the government can access identification data, and only when they can make a case that it is ‘reasonably necessary’ to an investigation.
Australia's former Privacy Commissioner, Malcolm Crompton argues that not enough security precautions are being placed to protect the metadata of citizens. The system behind metadata archives have higher standards for audits when it comes to the tracing of access of these data. Furthermore, sensitive information such as the content of an individual’s text message or their browsing history are not required to be archived, though they probably are anyway, but that’s not a problem of Data Retention.
People seem to quickly link Data Retention to the breach of privacy. While Data Retention itself do breach privacy in a way, it is not the law itself that gave rose to this system. Data Retention has been a recurring system among a broad range of telecommunication and network providers.
@renailemay on Twitter addressed a point with his post on the day of which the new Data Retention law begins to take effect: “Reality check:  Data Retention might technically ‘start’ today, but the major Telcos have been storing the required data for years”.
That’s right. Telecommunication and network providers have been retaining metadata from users long before this law was even put into place. The new Data Retention law effectively changes only one thing: the 2 years minimum retention.
The fact that I believe Data Retention is a necessity in today’s era where telecommunication and networking are the norm is one thing, but the people who believe that their personal information is under threat due to this law are simply misinformed.
There have been no heated debates before this new law. Individuals were clearly provided with terms and conditions upon contracting an internet provider. They knew that their metadata ‘may’ be archived for security purposes. With the new law, ‘may be’ becomes ‘will be’. If people had no problems about this statement before, why reject it now?