ISPs foresee crisis of confidentiality

The UK government's Anti-Terrorism Bill raises serious questions over data protection laws and storage costs, industry bodies and the Information Commission have warned.

Internet service providers (ISPs) have said that the Bill, published last week, could leave them in breach of the 1998 Data Protection Act (DPA).

The Act states that companies must not keep personal data, such as email and traffic logs for billing purposes, longer than needed.

"This Bill allows us to keep data that we wouldn't otherwise be able to, so what are our liabilities? What parts of the DPA apply and what parts don't and under what circumstances? The words are very vague and woolly," said Tim Snape, ISP Association member and managing director of West Dorset Internet.

This could lead to ISPs being fined or prosecuted for misusing customer data, said Roland Perry, director of public policy at London Internet Exchange.

"If someone takes civil action against you for keeping their data too long under the DPA or Human Rights Act for misuse of data, how watertight is this exemption in the Bill?" he asked.

The Information Commission has already written to the Home Office expressing concern about the voluntary retention of data for longer than is necessary.