The Communications Data Bill comes into force in March

[Geoff]

Under the Communications Data Bill (The UK version of the EU Directive 2006/24/EC on the retention of communications data) From March all ISPs will have to retain all incoming and outgoing email for a period of one year. As far as I can tell there is no exceptions for public bodies/schools.

 

Modify your polices and email systems as required by this change in UK law.

[john]

Are you basically saying with this bill we need to set our servers to take a copy of all emails then if we are running our own rather than the government paying some scheme to take a copy off the "cloud" as it were? Just think of the extra storage we will need with teachers emails always having huuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuge attachments!

[localzuk]

I think you may be a bit wrong there Geoff, I was under the assumption that ISPs had to retain information about emails sent, for one year - ie. headers only.

 

Also, a school isn't an ISP as far as I'm aware - that would be your RBC.

[GrumbleDook]

I'll make a request for advice on this from Becta and NEN.

 

The options to consider are that some schools will have a raw feed and be in complete control of their SMTP traffic, so it is not possible for the ISP (eg BT) to keep the logs of headers, the RBC you connect to may also allow you to have direct connections to run your own mail server ... not forcing it via a relay / filter ... and finally you have RBCs that force all mail traffic via a relay / filter and so could easily capture logs etc.

 

Does anyone have anything else to add to these options? I'll put the request in whilst at BETT.

[john]

Sounds good to me Tony Look forward to the answers

[powdarrmonkey]

I haven't looked into this, so I don't know what the rules are for those of us who run our own private mail servers. Does anyone know? I don't suspect for a minute that we have any kind of exception

[Jay]

Under the Communications Data Bill (The UK version of the EU Directive 2006/24/EC on the retention of communications data) From March all ISPs will have to retain all incoming and outgoing email for a period of one year. As far as I can tell there is no exceptions for public bodies/schools.

 

Modify your polices and email systems as required by this change in UK law.

 

I was under the impression March was the deadline for the UK to implement the EU directive, but that it had been dropped from the Queen's speech and put back to 2010.

Edited January 9, 2009 by Jay
Grammar

[nutso]

Sorry to bring up an old thread, but since I believe this came in to force this week I was wondering if anyone knows how much of it applies to schools? Also, doesn't the data retention law apply to web traffic as well as emails?

[AngryTechnician]

I'm also interested in this, particularly regarding email. We have a leased fibre from ntl for our internet connection, and while they will clearly be covering the web access logging, do we have to retain the email data ourselves as we run our own mail server? Or are ntl obliged to install DPI that logs our email traffic?

[UKDarkstar]

..and what about all the hosting companies (UK based and elsewhere) ? Haven't seen any of them saying that they or their customers must retain emails.

 

I hosts several domains on a VPS. I have no control over the end users and their POP accounts. If they choose to set their mail client not to leave a copy on the server there's not much I can do.

[PiqueABoo]

Ask a lawyer, but I'm pretty sure a (typical) school, or some shared web+mail server, is not a "public communications provider" i.e. you can basically all go back to sleep.

[UKDarkstar]

Ask a lawyer, but I'm pretty sure a (typical) school, or some shared web+mail server, is not a "public communications provider" i.e. you can basically go back to sleep.

 

That's what I would have thought too

[Geoff]

Well we'll hopefully get a definitive answer when Tony gets back to us. If your being badgered about it, I suggest you contact your LEA's legal department and ask them if you need to do anything. That's what they are there for after all.

[TheFopp]

I was wondering if you'd heard back from BECTA yet Tony as I was browsing the site in the hope that someone could tell me if we as a School (independant) should be actually be archiving all incoming and outgoing emails in case they ever need referring to for legal reasons etc. Don't we have to keep paper copies of various documents for certain numbers of years... so it would make sense for the same to apply to emails I guess.

[GrumbleDook]

I had covered this on another thread, but will quickly run through it again.

 

This was investigated for JA.NET and it was decided that legally JA.NET is a private network, not a public one so HE/FE institutes do not have to worry about this.

 

When I raised the question about EMBC it was investigated and the same view is taken, so it does not apply there either, but different RBCs / LAs are each set up slightly differently so the question would have to be raised to each one individually. I am not sure if a national consensus is possible between the RBCs / LAs on this one, but they will have the benefit of the analysis by JA.NET if nothing else. Lawyers *will* be involved in the decision.

 

The area of concern is if you have a non-RBC/LA connection (eg Virgin / BT / Pipex / etc) ... It does apply there and you should be contacting your provider immediately to obtained full details as to how they will be complying to the law with relation to your connection.

 

I hope to get a notice out to the few schools in Northants that are non-EMBC shortly but the short answer is to ask your LA/RBC what the position is.

 

Sorry I can't give a definitive answer about it.

[AngryTechnician]

The area of concern is if you have a non-RBC/LA connection (eg Virgin / BT / Pipex / etc) ... It does apply there and you should be contacting your provider immediately to obtained full details as to how they will be complying to the law with relation to your connection.

My emphasis - does this mean that with our ntl Business lines, the onus is on ntl to perform the required monitoring?

[GrumbleDook]

The provider of the public network (is the service provider) is responsible. There is no 'onus' as that implies it can be negotiated who does what. In your case NTL *have* to do it unless they have a legal directive otherwise. If that is the response you get then you would need to get it checked out by your LA legal team.

[jamesb]

So, ISPs will be forced to hold on to our data for a year, with or without our consent.

 

Meanwhile websites will have to get express consent before doing something as simple as dropping an identity cookie onto your computer.

 

Please kill this cookie monster to save Europe's websites | OUT-LAW.COM

 

Do the people who make these laws actually bother speaking to each other at all, or do they just roll dice to decide which way to go?