The data retention obligation does not work and therefore should be expanded. That, in brief, is the conclusion of the Evaluation of the Telecommunications Data Retention Act.
The report by the Scientific Research and Documentation Centre describes the extent to which the retention obligation for telcos and ISPs has been of use, including in court cases. And the results are disappointing.
In particular, the metadata collected on the use of email and web browsing has been of little use in recent years. The data are often too old, and “this has created a situation in which citizens’ data are being retained that are not or hardly used by investigative services,” according to the report, which is extensively covered in this article on Computerworld.nl.
The evaluation itself dates from 2012, but provides a good picture of the first years of practice with the retention obligation, which entered into force in September 2009 and has been recorded since early 2010. An evaluation had been agreed. Much documentation was reviewed and around 40 interviews were conducted. Read more on Computerworld.nl: Police do not understand the internet data retention obligation.
‘Expansion of the retention obligation is needed’
Therefore, the retention obligation must be expanded, according to experts cited in the evaluation. The current retention period is six months and should be longer. This is to prevent data from having already disappeared before an investigation is initiated or reaches a phase in which those data become important.
The data should also be expanded to include the end point of telephone calls and of internet sessions. Location data should be included to enable location-based tracking of mobile internet sessions.
Internet data appear to have been used only in a limited number of cases, and then almost exclusively in child pornography cases. In 26 judgments over four years, the use of those data is mentioned. Historical traffic data from telephony are used more often.