The General Assembly:
Recognizing that communications providers are being required by some governments to retain electronic data of their customers for an extended period of time.
Acknowledging that legitimate law enforcement often requires the cooperation of communications providers to combat crime and terrorism.
Concerned that forced data retention laws are imposing excessive costs on communications providers specifically, and on the technology sector generally.
Troubled that, absent reasonable restrictions, forced data retention could be abused by law enforcement to invade individual privacy.
Further troubled that, absent reasonable restrictions, forced data retention could compromise data security through leaks, hacks, and data breaches.
Affirming that an appropriate balance must be struck between the interests of privacy and the interests of law enforcement;
The General Assembly Hereby:
- Defines, for the purposes of this resolution:
- "Communications Provider" as any business, such as an internet service provider, that engages in the service of transferring electronic data.
- "Data" as any electronic information derived from a customer's use of a communications provider's services.
- "Data Retention Law" as any government mandate requiring communications providers to retain all customer data for a period of time..
- "Data Retention Request" as any government action requesting that a communications provider retain a specific customer's data for a period of time.
- Prohibits:
- World Assembly Member States from enacting or enforcing data retention laws that require communications providers to retain all customer data for a period greater than 90 days.
- World Assembly Member States from making a data retention request absent a showing of reasonable need for a specific customer's data in a law enforcement or national security investigation.
- Requires:
- World Assembly Member States to establish procedures through which citizens and communications providers can challenge the legality of the state's data retention laws.
- World Assembly Member States to establish procedures through which communications providers can challenge a data retention request.
- Does Not:
- Prevent communications providers from voluntarily storing customer data for periods greater than 90 days.
- Proscribe the exact procedures by which a World Assembly Member State is to comply with Sections 3a and 3b.
