Slashdot Mirror
EU Data-Retention Laws Stricter Than Many People Realized
An anonymous reader writes with a snippet from the Telegraph: "A European Union directive, which Britain was instrumental in devising, comes into force which will require all internet service providers to retain information on email traffic, visits to web sites and telephone calls made over the internet, for 12 months."
If I'm using Gmail for email (using SSL) and am in the UK, does this directive affect my email?
Obviously my ISP won't be able to read the headers and Google is a US company, but is my data still stored in the UK and if so does it fall under the directive?
Does anyone know how this is supposed to be implemented and how it relates to "arbitrary" data passing through the system? For example, email "headers" are supposed to be logged. One might imagine this being done by logging smtp, pop and imap transactions. But given that almost everyone I know uses webmail these days, and given that web traffic (presumably monitored using transparent proxy servers) is only supposed to have the URLs logged, not content, how does that stack up -- especially when you throw SSL into the mix? Are ISPs legally required (even if it's technologically unfeasable -- that's never stopped the law) to inspect HTTP transactions to see if it's webmail passing through, and log the recipients? Or is this just a humungous loophole for webmail hosted outside of the jurisdiction? Also: how does it affect non-UK citizens whose services are hosted by a geographically-distributed provider who might have nodes in the UK or at least the EU?
No, if you look at the submitted article, on the firehose link, it's fine, correctly formatted, if a bit verbose. It took a human to fuck it up.