1. 21 st April 200737 th CEPIS Spring Council - Prague Presentation Title Here 30pt Arial Data retention Draft statement for CEPIS By CEPIS LSI

2. 24 th November 2007CEPIS Execom + Council AGENDA CEPIS LSI Motivation and Background: Importance of the topic Why a statement now? The statement Background Introduction Concerns Recommendations

3. 24 th November 2007CEPIS Execom + Council CEPIS LSI  CEPIS Special Interest Network "Legal & Security Issues"  Working field:  IT security aspects  Legal issues (connected with IT security)  Goals:  Rising IT security awareness  Discussion of IT security issues (technical and non-technical viewpoint)

4. CEPIS Execom + Council CEPIS LSI  Chair: Prof. Kai Rannenberg (GI, Germany)  Secretary: Marko Hölbl (SSI, Slovenia)  Members:  IT security experts  Lawyers  Other interested parties

5. 24 th November 2007CEPIS Execom + Council CEPIS LSI  Development of statements:  Background and motivation  Concerns  Recommendations  Past and recently adopted statements:  Governmental restrictions on encryption products put security at risk, 1996  E-commerce, 1999  Data retention has serious consequences, 2004  Authentication approaches for online banking, 2007

6. 24 th November 2007CEPIS Execom + Council CEPIS LSI  Statements in progress:  Data Retention, 2008  Virtual World and social networking, 2008

7. MOTIVATION AND BACKGROUND – IMPORTANCE OF THE TOPIC CEPIS has already taken position on the issue of data retention in its discussion paper dated 01.01.2004:  Some crucial issues needed to be taken into account when the EU regulated the issue of retention of traffic and location data  New issues have aroused since the adoption of the Directive 24 th November 2007CEPIS Execom + Council

8. MOTIVATION AND BACKGROUND – WHY THE STATEMENT NOW? The final text of the data retention Directive was adopted on the 15 th of March 2006. Article 14 of the Directive:  “the Commission shall submit to the European Parliament and the Council an evaluation of the application of this Directive and its impact on economic operators and consumers”  Deadline 15 th September 2010 CEPIS Execom + Council

9. THE STATEMENT Statement overview: 1.Background 2.Introduction 3.Concerns 4.Recommendations 24 th November 2007CEPIS Execom + Council

10. INTRODUCTION 24 th November 2007CEPIS Execom + Council Several concerns regarding the Directive: 1.Definition of serious crime 2.Definition of “providers of publicly available electronic communications services or of public communications networks” 3.Categories of data to be retained

11. CONCERNS 24 th November 2007CEPIS Execom + Council CEPIS LSI SIN concerns: 1.The time period of the retention of the data 2.The way data has to be stored and secured 3.Concerns regarding mutual cooperation between service providers and the authorities 4.Issue of reimbursement of the costs incurred by the providers 5.Different deadlines for implementation

12. RECOMMENDATIONS 24 th November 2007CEPIS Execom + Council 1.Definition of “serious crime” missing 2.Definition what data has to be retained missing 3.Caution about how much communication content can be revealed by traffic and location data 4.Consideration of adopting a shorter retention period than 2 years 5.Secure data storage and data transfer 6.Support of the ETSI initiative to standardise the handover interface 7.Reimbursement of the costs to the providers (by EU Member States) 8.The European Commission is urged to complete a timely evaluation of the Directive