[AusNOG] Data Retention - List of Agencies

[Mike Everest]

> > Apart from catching those who already knew that the weighing was
> > bad and were trying to communicate this to someone else via email (ie.
an
> > employee reporting via email to management that they thought the scales
> > need calibrating).
> 
> That is of course, assuming the company didn't run its own mail server, in
> which case (unless they were also a carrier/ISP) there is no requirement
> for them to capture anything anyway!

I received a call from a member of the CAC technical team who offered some
further advice on this, the essence of which is something like:

"a company that runs it's own services for it's own use are not required to
retain any data at all.  A third party who provides such a service and
operates it on that company's behalf is also potentially exempt"

An example given is where an IT support company provides a service to
supply, install, and manage a company's exchange server - they are
potentially exempt under this rule.  Another example is where a network
services company supplies, installs, manages a border router (with NAT) for
purposes of their customer accessing internet (including, I suppose, VPN
etc) - that case is also potentially exempt.

I say 'potentially' a lot here, of course, since even the CAC engineer
advised that each potentially exempt case should seek specific determination
:-}

Gotta love those worms...

Cheers!

Mike.