[AusNOG] LAW REVIEW - Data Retention for Content Service, Providers and Hosting Service Providers

[John Lindsay]

I’m a director of a web hosting business so I made enquires of the CAC as part of keeping myself informed about the industry.

The advice I received from the CAC was that _they_ couldn’t determine if the business providing only web hosting was an ISP because that is administered by the ACMA and Department of Communication and that I would need legal advice to determine if we are. That means they will require advice too since they’ve stated they can’t work it out by themselves.

We’re not members of the TIO and don’t provide an Internet carriage service to the public a logical reading of the amended Intercept Act is that we’re not actually obliged to comply and that we are in fact an “end user” not an ISP. We don’t do any of the ISP compliance things like file an ICP or submit responses under any Record Keeping Rule.

Naturally we will continue to retain relevant data but of interest my reading of the FAQ and the comments from the CAC seem to suggest that retaining the web access logs is not permitted. That’s a pity because I am aware from media reports that web server logs have been used by law enforcement in the past.

What a mess. It’s such poor drafting. They could have trivially made the amended Act include “Content Service Providers” in the definition and all would have been crystal clear.

I wrote a long piece on this here:

http://blog.lindsaystrategic.com/2015/07/31/how-data-retention-affects-web-hosting-service-providers/ <http://blog.lindsaystrategic.com/2015/07/31/how-data-retention-affects-web-hosting-service-providers/>

where I go through the logical steps to come to the conclusion.

It’s pretty obvious that you can find lawyers who will agree and lawyers who will disagree.

Cheers,

John Lindsay
johnslindsay at mac.com
+61403577711

> On 27 Aug 2015, at 12:23 pm, Chad Kelly <chad at cpkws.com.au> wrote:
> 
> On 8/27/2015 11:25 AM, ausnog-request at lists.ausnog.net wrote:
>> Data Retention Issues
>> We are confident that Intervolve will not presently be caught by the legislation as drafted.  We have also had a look around for any hints as to future declarations. Estimating costs is extremely difficult should such a declaration ever be made.  We have used the estimate from PwC that were given to the government to give some sort of guidance. We have also included guidance on creating a data retention plan.
>> Do the metadata retention laws apply to Intervolve?
> Have you spoken to the AGD directly?
> Your advice in this review is similar to the advice i've been given by a few other hosting providers. But the advice through the AGD and the CAC varies considerably.
> But this review also varies from the departments own advice given in the May version of the Frequently asked questions, which were produced to clarify the previous concerns over the unclear nature of the previous  FAQ.
> Long story short, the latest FAQ doesn't  seam to exclude hosting providers at all, in fact it seams to include both hosts and resellers of infrastructure and both providers with and without their own networks.
> Most of the concern with people who rent infrastructure appears to be around the storage of email data.
> Most of us have been talking about this over the last few months, just not all publicly.
> Regards Chad.
> 
> 
> 
> -- 
> Chad Kelly
> Manager
> CPK Web Services
> web www.cpkws.com.au
> phone 03 9013 4853
> 
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20150827/b1158b3b/attachment.html>