The Legal Landscape: Understanding ICR Requirements

There is a delicate balancing act between an individual’s right to privacy and their right to security. On the one hand people expect their online activities to be private. On the other, they expect law enforcement and other government agencies to detect and prevent crime.  

Legislation is set to protect citizens from harm on both sides of the argument, but this too creates tension. In the UK, the Investigatory Powers Act 2016 (IPA) imposes specific requirements on the retention of and access to ICRs to aid in crime prevention and investigation.  

In contrast, the European Union’s approach has shifted from the now-annulled Data Retention Directive to the more privacy-focused General Data Protection Regulation (GDPR). These differing regulatory frameworks reflect the ongoing balance between security needs and the protection of individual privacy rights. 

The scope and purpose of the relevant legislations are outlined below.  

Data Retention Directive 2006-2014 

Scope: This directive required member states to ensure that telecommunications operators retained metadata (including ICR-like data) for a period between 6 months to 2 years.  

Purpose: The aim was to aid in the investigation, detection, and prosecution of serious crimes. However, the directive faced significant legal challenges. 

Status: In 2014, the Court of Justice of the European Union (CJEU) annulled the Data Retention Directive. The court ruled that the directive violated fundamental rights to privacy and the protection of personal data. This landmark decision underscored the tension between security measures and individual privacy rights within the EU. 

Investigatory Powers Act 2016  

Scope: The IPA, also known as the “Snooper’s Charter,” requires telecommunications operators to retain Internet Connection Records (ICRs) for up to 12 months.  

ICR Definition: ICRs include data such as the websites visited, IP addresses, and the time and duration of connections. However, it’s crucial to note that ICRs do not include specific details about individual pages within those websites. This means that if a certain website was visited it is recorded, but the exact pages viewed on that site are not. 

Purpose: The regulation aims to aid law enforcement and intelligence agencies. By having access to this data, these agencies can more effectively combat terrorism, organised crime, and other serious offenses. The ability to track online activity can provide critical insights into criminal activities and help in the prevention and investigation of these crimes. 

Access: Authorised entities such as law enforcement agencies can access ICRs under strict oversight and with proper authorisation. Access to ICRs is strictly regulated. Only authorised entities can access these records, such as law enforcement agencies, national security agencies, and regulatory and oversight bodies.  

General data protection regulation 2016  

Scope: The European Union has also had its own approach to the retention and regulation of metadata, including ICR-like data, that has evolved over time. Although GDPR does not directly mandate the retention of ICRs, it plays a crucial role in regulating how personal data, including ICRs, is processed across the EU. 

Purpose: The GDPR’s primary aim is to protect the privacy and personal data of individuals within the EU. It sets strict guidelines on how personal data should be handled, ensuring that any retained data is protected and used lawfully. Under the GDPR, organisations must implement appropriate security measures and obtain clear consent from individuals for data processing activities, thereby safeguarding individuals’ privacy rights.

The regulation of Internet Connection Records is a complex and evolving landscape. However, it remains that ISPs are required to create and store metadata no matter what the current or future legislation is. Creating and collecting metadata can also help ISPs to optimise their networks, monitor traffic and trends, as well as fulfil their legal obligations.