The PTS has adopted provisions for telecoms operators to retain additional information alongside IP addresses, when these cannot identify an individual.
Background: Data retention rules are an essential instrument for law enforcement. Through these rules, public authorities are able to obtain communications data from operators in order to investigate crime. Within the EU, data retention laws have become a legal grey area since the demise of the 2006 Data Retention Directive, which was struck down in 2014, after the European Courts of Justice found the Directive to be disproportionate and contrary to the European treaties.
The Swedish case: In Sweden, Tele2 stopped retaining communications data entirely following the 2014 ECJ ruling. This resulted in a legal dispute since the National Police Board made a formal complaint to the regulator PTS, which in turn ordered Tele2 to resume data retention. In 2016, the European Courts of Justice ruled in favour of Tele2, stating that data retention requests shall be reviewed by courts or independent administrative bodies. This led to a comprehensive reform, which came into force in October 2019.
What happens when IP addresses are insufficient? The PTS has now passed new rules operators have to follow when they use Network Address Translation (NAT) technology in assigning IP addresses. This technology makes sure one IP address can be shared across many users, to avoid IP addresses scarcity. On the other hand, it means an IP address is not sufficient to identify an individual. Through the new provisions, the PTS now specifies which information operators have to store, alongside the IP address, in order to enable law enforcement authorities to identify individuals. The additional data points the PTS requires are the UDP and TCP port numbers associated to the IP address, as well as the time of the connection.
Next steps: The new rules will be valid from 1 April 2020. The PTS notes these provisions create more certainty and will ensure operators do not store too much or too little information.
