<p>The European Union (EU) Parliament, as part of an anti-terrorism and anti-crime initiative, has approved a <a href="http://www.edri.org/docs/2decembercouncil.pdf" target="_blank">Directive</a> that requires service providers to retain records of all Internet messages and telephone calls they handle. Similar action is likely in the U.S.</p>
<p><b>Details of the Directive</b></p>
<p>The services included in the Directive include fixed network telephony, mobile telephony, Internet access, Internet e-mail, and Internet telephony providers. Affected providers must make records of all e-mail messages, phone calls, faxes, and text messages available to their national authorities for up to two years. The information to be kept includes data necessary to identify:</p>
<ul type="disc">
<li>The source of a communication.</li>
<li>The communication's destination.</li>
<li>The communication's date, time, and duration.</li>
<li>The type of communication.</li>
<li>The user's communication equipment or what purports to be their equipment.</li>
<li>The location of mobile equipment.</li>
</ul>
<p>Communication industry groups have been strongly opposed to these measures because they will be costly and ineffective</p>
<p>in providing useful information to the police. Member states are expected to incorporate the Directive in their own laws during 2006.</p>
<p><b>Activities in the United States</b></p>
<p>A corresponding law currently in place in the United States, the Electronic Communication Transactional Records Act, is much less demanding, requiring companies to retain information only upon prior request from authorities. However, there are indications that the U.S. Department of Justice is considering expanding its data retention requirements to match those of the EU. Expect U.S. changes in the near term.</p>
<p><b>Impact on All Organizations</b></p>
<ul type="disc">
<li><b>Employers can become involved in policy investigations.</b> Messages and calls made from a corporate location by an employee can be linked to the organization, but not to the individual. Therefore, if there is inappropriate activity carried out by their staff, then organizations will be drawn into investigations of illegal activity. </li>
<li><b>Internet and telephone prices will be increased.</b> It is unlikely that service providers will get financial relief for the significant costs of the new data retention regulations. These costs will be passed on to their customers.</li>
</ul>
<p><b>Recommendations</b></p>
<p><b>1.Eliminate improper staff usage of Internet and telephone services.</b> This is an essential first step in avoiding involvement in potentially embarrassing investigations. Ensure that there are clear policies in place forbidding employees from using organizational resources (especially the Internet and the telephone) for personal reasons. This is especially urgent in the EU, but is good practice in all jurisdictions.</p>
<p><b>2.Prepare for price increases for Internet and telephone services in the EU.</b> There will be serious cost pressure on suppliers as a result of the significant development and storage costs associated with the legislated data retention rules.</p>
<p><b>Bottom Line</b></p>
<p>The EU Directive on data retention will have an impact on all organizations in the EU and will likely have similar impact in the U.S. in the near future. All organizations should expect price adjustments for telephone and Internet services. Revisit employee policies to ensure that employees are prohibited from using the Internet and telephone systems inappropriately.</p>
