(Dieser Artikel ist auch in deutscher Sprache verfügbar)
a. Data Retention - a reality
15 September 2007 - data retention became a reality in Denmark. The administrative order, which sets the scope and conditions for data retention, was approved on 28 September 2006 with an implementation deadline of one year. The order, which was drafted by the Ministry of Justice, had been underway for more than four years. The Act providing for data retention was approved by the Danish Parliament already in June 2002 as part of the Danish "anti-terrorism package," which extended the scope of Section 786 of the Administration of Justice Act (Act No. 378 of 6 June 2002).
The administrative order regulates in more details the obligations of the telecommunications providers and further implements the recently adopted EU Directive on Data Retention. On some issues the order goes further than the EU Directive, e.g. session logging. The order applies only to commercial ISPs, excluding non commercial ISPs, libraries, universities and smaller housing associations. There is no obligation on ISPs to invest in new systems, but the law demands 24/7 point of contact at ISPs and security clearing of relevant ISP personnel.For fixed lines and mobile phones (including voice, voicemail, call forwarding, conference calls, SMS, MMS) the retained data are: phone number, user ID (e.g. customer number), name and address of customer, IMSI / IMEI number, unsuccessful call attempts, first and last cells ID and physical location (mobile communication), and date and time for start and end of communication. For Internet use, the retained data are session logging (first and last or every 500 package), IP address, port number and transport protocol, user ID, phone number for dialup access, location and ID of hot spots, date and time for start and end of communication. For email and VoIP the order covers the ISPs own email services (and not hotmail, gmail, etc) and all VoIP services. The retained data are sender and receiver, user ID, email address, date, time and duration of communication.
During the 4-year drafting period, the proposed scheme for mandatory data retention was heavily criticized by the Telecom and IT industry, the Data Protection Agency, the Human Rights Institute, and non-governmental organizations for being privacy invasive, disproportionate and inconsistent, i.e. letting private companies store large amounts of personal information, while at the same time being easy to evade, because of the many exemptions, such as libraries and universities.
b. Extended means of surveillance
On 1 June 2007 an Act on TV Surveillance, which replaced the previous Act Prohibiting Video Surveillance was adopted in the Parliament (Act. no. 162 of 1 June 2007). The bill gives private enterprises such as banks, gas stations, hotels, shops etc. extended powers to perform surveillance on areas related to their property. The police may set quality standards for the recordings. General surveillance of public areas such as public streets and squares are not allowed for private parties, however the police may perform surveillance in any public area if it is found necessary to prevent or investigate crime. Both public and private surveillance must comply with the Danish Data Protection Act, i.e. requirements of deletion of data after max. 30 days. However, there is no longer a duty to notify the Data Protection Agency prior to installing surveillance equipment.
c. Extended access to personal information
On 8 June 2006, an Act amending the Administration of Justice Act, Act Prohibiting Video Surveillance etc., and Act on Air Traffic (Strengthening of the efforts to fight terrorism etc.) was adopted in Parliament (Act No. 542 of 8 June 2006). The bill was presented as the second "anti-terrorism package" in Denmark. The amendment to the Administration of Justice Act gives the Police Intelligence Service increased powers to exchange information with the Defense Intelligence Service and to collect information from other public authorities, e.g. hospitals, schools, libraries, social services etc. without a warrant. Concerning phone tapping in relation to criminal investigations, this is now targeted to individuals rather than means of communication, for instance a specific landline. This implies that all the phones a person may use may be tapped. Also, the notification of the individual may be omitted or postponed for a fixed period of time if the notification is considered to be detrimental to the investigation. The amendment of the Act Prohibiting Video Surveillance gives the police increased powers to demand of public offices and private parties that they install and conduct video surveillance. The amendment of the Air Traffic Act obliges airline companies to register and keep data on passengers and crews for one year and to provide the Police Intelligence Service with electronic access to the data, without a warrant.
Draft Administrative Order on data retention in Denmark (19.07.2006)
http://www.edri.org/edrigram/number4.14/denmark
EU Data retention directive and its implementation in Denmark (in Danish
only)
http://logningsdirektivet.dk/
CCTV (in Danish only)
http://www.update.dk/cfje/Lovbasen.nsf/ID/LB04720872
Privacyforum.dk - about CCTV (in Danish only, 21.11.2006)
http://www.privacyforum.dk/?p=25
Act No. 542 of 8 June 2006 (in Danish only, 8.06.2006)
http://www.ft.dk/doc.aspx?/Samling/20051/lovforslag/L217/index.htm
(contribution by Rikke Frank Joergensen - Digital Rights Denmark)