Part 3: Data Retention
Summary and Background
93.Communications data is the who, where, when and how of a communication, but not its content. Internet Protocol (IP) address resolution is the ability to identify who in the real world was using an IP address at a given point in time. An IP address is automatically allocated by a network provider to a customer’s internet connection, so that communications can be routed backwards and forwards to the customer. Communications service providers (CSPs) may share IP addresses between multiple users. The providers generally have no business purpose for keeping a log of who used each address at a specific point in time.
Commentary on Sections
Section 21: Retention of relevant internet data
94.Section 21 amends section 2(1) of the Data Retention and Investigatory Powers Act 2014 (DRIPA) which provides definitions relating to the retention of relevant communications data under that Act. This enables the Secretary of State to require communications service providers to retain an additional category of communications data, namely data that will allow relevant authorities to link the unique attributes of a public Internet Protocol (IP) address to the person (or device) using it at any given time.
95.Subsection (2) adds an additional limb of “relevant internet data” to the definition of “relevant communications data” which communications service providers can be required to retain under DRIPA.
96.Subsection (3) inserts a definition of the “relevant internet data”, necessary to reliably attribute internet protocol addresses to a person or device, to which subsection (2) relates. Paragraph (a) of the inserted definition limits this to communications data which relates to an internet access service or an internet communications service. An internet access service is a service that provides access to the internet and can include a home broadband connection, mobile internet or publicly available wi-fi. An internet communications service is a communications service which takes place on the internet and can include internet telephony, internet email and instant messaging services. Paragraph (b) of the inserted definition describes data to be retained as data which may be used to identify, or assist in identifying, the internet protocol address or other identifier which belongs to the sender or recipient of a communication. Such data could include data required to identify the sender or recipient of a communication (which could be a person or a device), the time or duration of a communication, the type, method or pattern of a communication (e.g. the protocol used to send an email), the telecommunications system used or the location of such a telecommunications system that the person was communicating from. An IP address can often be shared by hundreds of people at once – in order to resolve an IP address to an individual other data (“other identifier” in this section) would be required. Data necessary for the resolution of IP addresses could include port numbers or MAC (media access control) addresses. Paragraph (c) of the inserted definition specifically prevents a telecommunications operator providing an internet access service from retaining under this legislation data that explicitly identifies the internet communications service or websites a user of the service has accessed. This type of data is sometimes referred to as web logs.
97.Subsection (4) adds definitions for “communication”, “identifier” and “person” to section 2(1) of DRIPA.
98.Subsection (5) provides that, like the provisions of DRIPA itself, these provisions are repealed on 31 December 2016.
