McDowell's sneaky data law heralds surveillance state

Net Results: Appalling and deeply cynical about the democratic process. That's how you describe a government that first slaps a broad semi-surveillance order secretly on its own population through a cabinet direction condemned by international privacy organisations, and then turns it into law three years later through a last minute amendment to a Bill "debated" by an empty Dáil.

Data retention, the controversial plan to store traffic information about all personal and business faxes, phone and mobile calls for three years, quietly became law early this month after Minister for Justice Michael McDowell stapled a small amendment to the Criminal Justice (Terrorist Offences) Bill in its final stages of discussion.

The amendment came in with such stealth that even TDs, business leaders and privacy advocates who had been following the issue closely were caught unawares. No doubt the whole point of the amendment, of course.

Mr McDowell had repeatedly promised, on radio, television and in print, a full Bill dealing with data retention, which would be broadly and openly debated in both houses of the Oireachtas.

However, Mr McDowell's department had failed over three years to introduce such a Bill - which the department is on record as promising "within months" more than half a dozen times since 2002, according to documents obtained under the Freedom of Information Act.

The Bill failed to materialise with any urgency, despite more than five threats of a High Court challenge by the Data Protection Commissioner over the constitutionality of the Cabinet direction. The direction imposed three years of mandatory data retention on the largest phone operators, with no proper governance over who should have access to such sensitive citizen records, when and how.

The vulnerability of such information has led Europe's data protection commissioners to consistently and strongly oppose holding data traffic records of any sort for longer than six months. The commissioners have also noted that retaining data for such long periods keeps years of personal data available for trawling expeditions.

The proposal to introduce data retention here - which the State originally had been on track to do ahead of every other EU country, according to a leaked EU Council of Ministers document - was vehemently opposed by Irish technology business leaders when made public.

Industry groups such as ICT Ireland, and heads of several multinational and indigenous technology companies, all expressed their belief that data retention could seriously damage Ireland's business attractiveness, especially for inward investment from the US, which does not have mandatory data retention.

According to documents, the Department of the Marine, Communications and Natural Resources had also repeatedly expressed concern to the Department of Justice at the proposed three-year period of retention. It clearly stated fears that the State's ability to attract inward investment could be damaged.

Last week, I spoke to several industry organisations and business leaders who expressed astonishment that data retention had been passed in a Bill they had heard nothing about, without any consultation on the amendment with industry bodies.

Even the few groups that had been consulted as part of the slow progress towards the long-promised Bill were shocked, having had no idea that data retention had been quickly popped into another bill.

Mr McDowell claimed before both Dáil and Seanad that the hasty amendment was necessary rather than the preferred Bill, as the Data Protection Commissioner, Joe Meade, had insisted in January that proper legislation be brought in by May.

No mention was made that his department had had several years to draft a Bill, and the lack of one was entirely due to delinquency in his own department, which, over nearly three years, blithely ignored all the other threats from Mr Meade, and failed to produce a Bill despite insisting to Mr Meade, other departments and the public, that it was nearly ready.

Mr McDowell also promised that the amendment was a simple little thing, merely bringing into law a situation that had already existed for several years. Indeed, the amendment would be supportive of greater privacy as to date, the telecommunications companies were retaining data for six to seven years, to fulfil obligations under the statute of limitations, he told the Dáil.

This is blatantly untrue and the Minister knows it. The telecom companies were found to be illegally retaining data under such pretences, in violation of EU data protection law which limits storage to six months, several years ago.

The secret Cabinet direction was brought in to cover the Government's behind, so that data would continue to be available to the Garda for investigations. However, the three-year period of the direction also far exceeded data protection law. Once made public, it was immediately under dispute, as no major criminal investigation to date has needed call data from longer than six months prior to the investigation, including the Omagh bombing and the Veronica Guerin investigation, both regularly cited as reasons data retention is needed for at least three years.

As the Department of Communications pointed out in a communication to the Department of Justice, "The imposition of a three-year data retention period for the purposes of criminal investigation etc, is an entirely new concept and should not be portrayed as a mere amendment to existing procedures". It added it found no "particular justification for this period or any statistical information that would indicate this to be the optimum period based on previous experience of gardaí in investigations".

Mr McDowell also claimed before the Dáil that the State had a legal obligation to bring in data retention for that convenient scare-reason du jour, "the battle against terrorism". Yet the State is under absolutely no obligations to do this. Indeed, the EU parliament has formally rejected plans for mandatory data retention - plans that were hatched by our own Government and pushed forward (unsuccessfully) during our stint in the EU presidency.

Having failed at that back-door plan to introduce his pet data retention project via an EU directive (so convenient for removing blame), the Minister saw the chance to introduce it by stealth. One wonders where Mary Harney was in all this - she, unlike Mr McDowell, is usually well able to recognise measures that could batter Ireland's business competitiveness, but apparently not this time.

And so here we are, the best little banana-republic style state in the EU, sneaking in the laws we don't want the citizens to see, willing to risk the State's future economic health and business environment in order to make one Minister's quest for a surveillance state a success.