IIA statement on Data Retention
1. We understand and support the Government's objective of having effective and accountable processes in place to address criminal activity.
2. The internet industry has a track record of providing reasonable assistance to law enforcement agencies as required by law. Many successful prosecutions would not have been possible without the assistance of the internet sector in accordance with laws.
3. Our concerns about a blanket data retention regime are longstanding and have been consistently expressed to successive governments since 1999.
4. We are not permitted to comment on specific proposals due to confidentiality conditions imposed by the Government.
5. However at a general level, and consistent with comments we have made in the past, we have raised with the Government our core concerns:
- privacy (the legitimate privacy expectations of users who interact online assuming that their communications are private and browsing activity are private, unless they have been clearly informed otherwise or otherwise agree);
- proportionality (whether the harm being addressed is outweighed by the economic or social burden or privacy intrusiveness of the measures proposed);
- security of data held (including by whom it is held, in what circumstances this data may be accessed and the scope for its misuse);
- cost (including the upfront and ongoing costs of compliance);
- efficacy (the demonstrated need for such a policy and whether a policy will deliver on its stated objective); and
- transparency (whether the policy is understood by users to be a mandatory government requirement).
6. Law enforcement and national security demands for access to certain information relating to internet activity must be balanced against these considerations.
7. A full and open public consultation process must be undertaken before any policy is concluded.