Data retention and the devotees of mass surveillance

While European judicial bodies with teeth rein in the way data retention is used, when and if it should even be permitted, countries such as Australia continue to show faith in the very idea. Last month's hack of the country's second largest telecoms company, Optus, was a reminder that unnecessary data retention measures are an incitement for unlawful access.

In 2015, when the Data Retention Bill was introduced, advocates and those in the telecommunications industry had reason to be worried. In testimony to the Parliamentary Joint Committee on Intelligence and Security , Telstra Director of Government Relations, James Shaw, noted that the telco's practice over peak times such as New Year's Eve was to only retain some data for a few hours before being overwritten. This was markedly shorter than the Bill's proposed two-year retention period.

Telstra's Chief Information Security Officer Michael Burgess also issued a warning that such legislative requirements would embolden hackers. "We would have to put extra measures in place … to make sure that data was safe from those that should not have access to it."

Electronic Frontiers Australia Executive Office Jon Lawrence was even more trenchant in explaining to the Joint Committee that such data retention requirements were an "unnecessary and disproportionate invasion of privacy" and would "literally be a honeypot to organised crime, to any sort of person who can potentially access it".

Despite such warnings, the Joint Committee approved the bill, subject to a number of vague and ineffectual recommendations about security and appropriate data use. This has left those in Australia vulnerable to data loss and unprotected by the woefully inadequate Privacy Act 1988 (Cth). But even the European example shows us that the forces of law and order remain attritive in their efforts to undermine rights and liberties via requirements for data storage. Even in the face of judicial rulings and precedents, the attempt to maintain mass surveillance through data retention regimes remains a burning, threatening issue.