What jurisdictions are you speaking of? Cites would be cool too.
What jurisdictions are you speaking of? Cites would be cool too.
As far as I know the EU does have data retention laws on the books for ISPs.
> On 8 April 2014, the Court of Justice of the European Union declared the Directive 2006/24/EC invalid for violating fundamental rights. The Council's Legal Services have been reported to have stated in closed session that paragraph 59 of the European Court of Justice's ruling "suggests that general and blanket data retention is no longer possible".[18] A legal opinion funded by the Greens/EFA Group in the European Parliament finds that the blanket retention data of unsuspicious persons generally violates the EU Charter of Fundamental Rights, both in regard to national telecommunications data retention laws and to similar EU data retention schemes (PNR, TFTP, TFTS, LEA access to EES, Eurodac, VIS).[19]
I'll have to look them up on Eurlex, I'll post them here if I find the time.
DIRECTIVE 2006/24/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 15 March 2006
on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC
Some citations from the preamble showing the purpose of data retention On 13 July 2005, the Council reaffirmed in its declaration condemning the terrorist attacks on London the need to adopt common measures on the retention of telecommunications data as soon as possible.
Given the importance of traffic and location data for the investigation, detection, and prosecution of criminal offences, as demonstrated by research and the practical experience of several Member States, there is a need to ensure at European level that data that are generated or processed, in the course of the supply of communications services, by providers of publicly available electronic communications services or of a public communications network are retained for a certain period, subject to the conditions provided for in this Directive.
The citations of the corresponding paragraphs:Article 3 para. 2 (data necessary to trace and identify the source of a communication):
The obligation to retain data provided for in paragraph 1 shall include the retention of the data specified in Article 5 relating to unsuccessful call attempts where those data are generated or processed, and stored (as regards telephony data) or logged (as regards Internet data), by providers of publicly available electronic communications services or of a public communications network within the jurisdiction of the Member State concerned in the process of supplying the communication services concerned. This Directive shall not require data relating to unconnected calls to be retained.
Article 5 Categories of data to be retained
para. 1/a/2 concerning Internet access, Internet e-mail and Internet telephony:
(i)the user ID(s) allocated;
(ii) the user ID and telephone number allocated to any communication entering the public telephone network;
(iii) the name and address of the subscriber or registered user to whom an Internet Protocol (IP) address, user ID or telephone number was allocated at the time of the communication;
Article 5 para. 1/b/2 ( data necessary to identify the destination of a communication): concerning Internet e-mail and Internet telephony:
(i) the user ID or telephone number of the intended recipient(s) of an Internet telephony call;
(ii) the name(s) and address(es) of the subscriber(s) or registered user(s) and user ID of the intended recipient of the communication;
Article 5 para 1/c/2 data necessary to identify the date, time and duration of a communication: concerning Internet access, Internet e-mail and Internet telephony:
(i) the date and time of the log-in and log-off of the Internet access service, based on a certain time zone, together with the IP address, whether dynamic or static, allocated by the Internet access service provider to a communication, and the user ID of the subscriber or registered user;
(ii) the date and time of the log-in and log-off of the Internet e-mail service or Internet telephony service, based on a certain time zone;
Note: Legislation is said to be anulled in 2014 by the European Court of Justice. [3] I don't know how EU legislation works. But many countries adapted the regulation in their national law. The EU anulment doesn't automatically change the regulations in other legislations. For more info on how data retention is implemented in different countries, you could look at the wikipedia link jacquesm provided.[1] Link to the directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
[2] Link to the reddit thread: https://www.reddit.com/r/VPN/comments/7x07am/if_a_vpn_doesnt...
[3] Decision of the anulment of the directive: http://curia.europa.eu/juris/liste.jsf?language=en&num=C-301...
> in most legal systems they do not need any warrant to request this data.
From a quick read of your law extract, it doesn't seem to cover that aspect of your original claim (and if it does, I'd warmly suggest you highlighted the controversial bit for those who like me have a hard time grokking through such a long text)
Law enforcement is generally allowed to request just about anything just like everyone else.
https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016#...
0) http://www.legislation.gov.uk/ukpga/2014/27/contents/enacted
1) https://www.theguardian.com/technology/2017/nov/30/police-to...
2) https://www.theguardian.com/uk-news...ruled-unlawful-appeal-...
I think a VPN provider in this case is still obliged to keep logs, albeit only hand them over if the necessary conditions are met.
Coming from Turkey, I could not imagine a state, where the communication logs are not saved. But it seems the US does this only through intelligence agencies and does not force the ISPs to keep logs.
Furthermore, at least here in Turkey, communication records are also used in civil cases. For example, in a divorce case, the parties sometimes request the phone log through a judge and prove disloyalty by showing call history and duration of each call.
I looked into this fairly carefully some months ago, consulting with Nick Pestell, IVPN's CEO. In writing for their blog.[0] And I got from him that data retention requirements are now rare in the EU.
0) https://www.ivpn.net/blog/collection-of-user-data-by-isps-an...
As we import our laws from other European countries (for example criminal procedure law was imported from Germany) I thought that this must've been the case in many law systems.
This discussion has been eye-opening for me.