European cyber crime bill lauded

A draft of the Convention on Cyber Crime from the Council of Europe looks set to impose more reasonable requirements on companies than a separate European Union (EU) proposal.

Both bodies intend to force companies to keep extensive records of data transfers, but while the EU wants all data kept for seven years, the Council wants records to be kept for only 60 days when ordered by a court.

The Council's convention, aimed at curbing online crime, has been drafted by its 43 member states, along with a number of other governments including those of the US and Japan.

If the UK government signs up to the convention, it is not duty bound to make it part of UK law, unlike directives passed by the EU. However, the EU is unlikely to draft legislation that contradicts the Council convention, acording to Dai Davis, a solicitor at law firm Nabarro Nathanson.

Jim Norton, director of ebusiness at the Institute of Directors, said: "This is far more acceptable than the [EU] proposal."

Tim Conway, director of industry affairs at trade body the Computer Software and Services Association, maintained that the seven-year proposal is "out of proportion with the requirements for law enforcement".

Firms want more detail on how the law would be policed. "Careful consideration must be made of what sort of data this law would apply to, and how the implementation would be regulated," said Norton.

The convention will be discussed by the Council in June, before being submitted for approval in September. If approved it could enter UK statute books in the next few years, said Rachel Bickler, European law specialist at Nabarro Nathanson.