Data retention: Two years too long to keep IP addresses, says Vodafone

There should be a shorter period 'for the data storage of IP identifiers,' the telco has argued

Telecommunications providers shouldn't be forced to store for 24 months the IP addresses assigned to their customers, Vodafone has argued.

Under the government's proposed mandatory data retention scheme, telcos and ISPs will be forced to store a range of customer data for access by authorised law enforcement and national security agencies.

The full details of the data that telcos will be forced to keep will be spelled out in regulation, not the legislation itself (the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014).

A proposed data set (PDF) includes the IP address "allocated to an internet access account or service".

Although IP addresses are somewhat analogous to phone numbers there are differences, Vodafone has argued in a public submission (PDF) to an inquiry into the data retention bill.

The telco also made two confidential supplementary submissions to the inquiry.

"We believe that these differences warrant a period shorter for the data storage of IP identifiers," the public submission argues.

"Two years is at the upper bound of the storage requirements being contemplated in Europe for this information. We note that the European Commission’s Evaluation report on the Data Retention Directive, April 2011, which found that most data requested by enforcement agencies was less than six months old. This is consistent with our Australian experience.

"We also believe (and have received feedback from our customers) that IP-identifier data is substantially more sensitive information than traditional telephone call records."

In addition, Vodafone states that the telco's customers are dynamically assigned IP addresses and in its view "it will take some years to firmly establish a standard industry capability to store this data".

"In particular, before we introduced the capability we would need to be confident that we could protect every customer’s privacy," the submission states.

Last year Vodafone revealed it was working on a project that would record for up to 90 days what online services customers access. Customers would be able to access the information to understand how they had used their mobile data quota.

At a September hearing of an inquiry into potential changes to the Telecommunications (Interception and Access) Act 1979, a Vodafone representative said that the ability for a telco to link an IP address to an individual customer is not fully developed.

"Now at this stage, that IP identifier system within telcos is in its infancy," a Vodafone representative told the inquiry.

"It's not been a traditional capability that has been a part of the way we store data, but it is something that is evolving."

The Parliamentary Joint Committee on Intelligence and Security will hold public hearings into the data retention bill on 29 and 30 January.

Follow Rohan on Twitter: @rohan_p

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacyVodafoneTelecommunicationscivil libertiesdata retention

More about BillCustomersEuropean CommissionVodafone

Show Comments