CopperEye identifies data-retention issues

Data management vendor CopperEye outlines key points for UK internet data legislation

LONDON - In response to the UK Home Office's approach to the second phase of the European Union's Data Retention Directive - focused on online security measures - data management and compliance software firm CopperEye has identified a number of key issues to consider when the legislation is translated into UK law.

The first phase of the EU directive came into force in October 2007, requiring phone companies to retain fixed and mobile data, while the second phase has extended requirements to include internet communications, including email event data, to be retained for police and government use.

Duncan Pauly, CopperEye's chief technology officer, lists five key considerations for communications providers.

The first is tightened security to meet compliance requirements and ensure data is securely retained to prevent unauthorised access. An automated system is needed to destroy data once it has fallen beyond the retention period.

The second is proportionate access - in that only the relevant information for a specific investigation should be disclosed, minimising potential exposure of any other information held.

Legal evidence and timeliness are the third and fourth considerations - making sure information disclosed is accurate and complete to avoid unnecessary or inappropriate investigations, and collected and disclosed quickly to prevent delays in investigations.

Fifth is the total cost of ownership, to deliver long-term value for the service provider, with proportionate costs of hardware, implementation and maintenance of the compliance system.

"Providers should consider that existing systems might not have the capability to comply with new legislative requirements," says Carmen Carey, chief executive officer of CopperEye. "Unlike telecommunications companies that usually have extensive data-management capabilities, many internet service providers are smaller and are not able to manage the volumes of data this directive demands."

"Therefore, they must implement a data-management solution that is appropriate to their size and needs, and leverage the most appropriate technology to satisfy the European Union Data Retention Directive requirements. Further, providers must turn to solutions that are proven to support the directive and that are compliant with the European Telecommunications Standards Institute - anything else is an expensive compromise," says Carey.

Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.

To access these options, along with all other subscription benefits, please contact or view our subscription options here:

You are currently unable to copy this content. Please contact to find out more.

Financial crime and compliance50 2024

The detailed analysis for the Financial crime and compliance50 considers firms’ technological advances and strategic direction to provide a complete view of how market leaders are driving transformation in this sector

Investment banks: the future of risk control

This survey report explores the current state of risk controls in investment banks, the challenges of effective engagement across the three lines of defence, and the opportunity to develop a more dynamic approach to first-line risk control

Op risk outlook 2022: the legal perspective

Christoph Kurth, partner of the global financial institutions leadership team at Baker McKenzie, discusses the key themes emerging from’s Top 10 op risks 2022 survey and how financial firms can better manage and mitigate the impact of…

Emerging trends in op risk

Karen Man, partner and member of the global financial institutions leadership team at Baker McKenzie, discusses emerging op risks in the wake of the Covid‑19 pandemic, a rise in cyber attacks, concerns around conduct and culture, and the complexities of…

Moving targets: the new rules of conduct risk

How are capital markets firms adapting their approaches to monitoring and managing conduct risk following the Covid‑19 pandemic? In a webinar in association with NICE Actimize, the panel discusses changing regulatory requirements, the essentials…

You need to sign in to use this feature. If you don’t have a account, please register for a trial.

Sign in
You are currently on corporate access.

To use this feature you will need an individual account. If you have one already please sign in.

Sign in.

Alternatively you can request an individual account here