Public internet data law threatens small businesses, say experts

A LAW that requires anyone offering public internet access to retain data on internet users could damage small businesses and make Ireland less competitive, experts have warned.

The Communications (Retention of Data) Act 2011, which was signed into law during the final days of the last government, requires telephone service providers to retain telephone data for two years and internet data to be kept by internet service providers (ISPs) for 12 months.

Anyone offering public internet access must retain the name, address, and technical identities of internet users, but do not need to keep data concerning the content of calls or emails to be retained.

The law is based on an EU-wide concern that police forces need a way to track cyber-criminals across Europe by enabling certain members of the gardaí, defence forces and revenue officials to make a disclosure request to access internet user data in certain circumstances.

However, the director of Wi-Fi network operator Bitbuzz, Alex French, said the act will have implications for business due to the additional costs associated with retaining data and safeguarding it appropriately.

“We have no problem complying with the act as long as it is a real benefit to detecting criminal activity, but the problem is the financial impact it will have on businesses — retaining data is one more cost for small ISPs and it’s another nail in the coffin for cyber-cafés. Unlike here, the government in the UK will pay ISPs for a proportion of a request to retrieve data, which could be very costly.

“But the big implication for Ireland is that it could make us less competitive. If you are a Google or Microsoft you will have to look at the cost of complying with this act when considering what data centre to locate your services by weighing up the cost of hosting in countries such as the UK and Germany versus here.”

Mr French said there needs to be clearer guidelines on the protection for ISPs when releasing confidential data.

“On one hand ISPs are being asked in this act to safeguard information, and on the other hand to release it. There needs to be clear guidelines on what to do if ISPs act in bona fide way in the event of an emergency, such as a kidnapping, and a means of verifying that the correct people are requesting the information.

“We need to know what to expect and what the process is to safeguard internet providers, as well as everyone else,” Mr French said.