Report - Guardian

254 The LSE Identity Project Report: June 2005There are strong technical and legal analogies with the debate over the mandatoryretention of telecommunications traffic data (cf. Anti-Terrorism Crime and Security Act2001 Part.11), but with the following differences:- audit trails are strictly superfluous to the function of the Register, rather thanarising through ordinary business processes;- the data are created and retained centrally by a government-operated onlineauthentication service, rather than scattered in different private-sector (ISP andtelephone company) records systems. (ECHR Article 8 therefore fully applies);- the debate in Standing Committee strongly suggests government currentlyintends no finite limit on retention, and deletion will be the exception not therule;- the trails are very strongly authenticated to the individual, and thus more privacyinvasive than other forms of retained data (e.g. traffic data).The way to cut the Gordian knot that abuse cannot be redressed unless an audit trailexists, is that there should be a retention period fixed by statute (perhaps one year – inline with the remit of the IPT) after which all audit trails should be deleted. A long orindefinite retention period will over time become the main privacy threat to theindividual, one that outweighs the risk of a potential inability to pursue redress, but thisdoes not seem to have been widely appreciated so far in public debate.Design Considerations and Legislative Implications of Audit Trails- In order to deal with privacy issues arising from access to the central register,the audit trail should record all occasions when access or verification takes placewithout the consent or awareness of the individual;- The Investigatory Powers Tribunal and Intelligence Services Commissionerwould benefit from direct access to the complete audit trail, including thoseportions recording access events within their purview authorised under clause23(5);- The audit trail should distinguish the trail of access and verification events ofwhich the user is aware or to which they have consented from other types ofevent, and require deletion after a period fixed by statute, or sooner at theindividual's request;- It is technologically feasible to require the provision of online Data Protectionsubject access to trails, at the discretion of the individual and certified as validwith an official digital signature from the Register. The ID card itself can beused as the means to authenticate subject access online;- To enable such a system to operate within the confines of British law, throughthe design of the system we can ensure that Commissioners and Tribunals canaccept trails in user possession, certified by an official digital signature, as validevidence in any complaint or investigation of abuse, and we can ensure thatunauthorised parties cannot accumulate and retain copies of audit trails throughperiodic and incremental lawful access to the Register, beyond the fixedstatutory period allowed for retention in the Register.