6.1 Meta Data and Data Retention Data retention in the context of communications surveillance relates to laws or policies that require telecommunications companies to store content data and metadata in case such data is required at a future date. Content data is the actual substance or subject of communications that individuals send to each other using modern communications. Meta data, on the other hand, is data about the communication. This includes information about: • the location that it was sent and received from; • the devices that it was sent and received on; • the times at which the message was sent and received; and • information relating to the sender and recipients such as email address, ISPs and IP addresses.195 Technological advancements mean that metadata can be analysed, mined and combined in ways that make it even more revealing about individuals than content data. Certain types of metadata, when aggregated “may give an insight into an individual’s behaviour, social relationships, private preferences and identity that go beyond even that conveyed by accessing the content of a private communication.”196 Through such information, individuals leave a digital trail which can be used by governments and commercial private sector entities to generate a profile about an individual’s private life and interactions. The OHCHR has noted that mandatory data retention laws are neither a necessary or proportionate limitation on the right to privacy.197 The Special Rapporteur on freedom of expression has also criticised that they limit an individual’s ability to remain anonymous, commenting that: A State’s ability to require Internet service and telecommunications providers to collect and store records documenting the online activities 195 See Privacy International, What is Metadata?, https://www.privacyinternational.org/node/53. 196 Human Rights Council Resolution 34/7, The right to privacy in the digital age (7 April 2017). 197 OHCHR Report, The right to privacy in the digital age, para 26 of all users has inevitably resulted in the State having everyone’s digital footprint. A State’s ability to collect and retain personal records expands its capacity to conduct surveillance and increases the potential for theft and disclosure of individual information.198 Technological advancements mean that metadata can be analysed, mined and combined in ways that make it even more revealing about individuals than content data. The issue of retention of metadata was addressed recently by the European Court of Human Rights (ECtHR). In a December 2016 judgment concerning legislation that requires the mandatory retention of data in bulk by telecommunication providers, the ECtHR held: The interference entailed by such legislation in the fundamental rights guaranteed in the Charter is very far-reaching and must be considered to be particularly serious. The fact that the data is retained without the subscriber or registered used being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance […]199 In that case, the ECtHR concluded that national legislation allowing for the general and indiscriminate retention of all traffic and location data cannot be considered necessary, even in the fight against serious crime.200 The ECtHR also held that retention of traffic data 198 Report of Special Rapporteur on freedom of expression, (22 May 2015) para 55 199 ECtHR, Tele2 Sverige AB Grand Chamber, Joined cases C‑203/15 and C‑698/15 (21 December 2016) para 103 http://curia.europa.eu/juris/liste. jsf?num=C-203/15. 200 Ibid. para. 103. 40