0

Introduction: I co-run a VPN company. I have a few legal questions since our service has a strict NO-LOG policy enforced.

Question: In the UK, it is illegal to store sensitive and private customer data without their acknowledgment. My question is that if someone uses my VPN service for illegal activity, and Law Enforcement asks for this specific customer's data, would I be committing an offense by not storing this customer's data? By "data" I mean IP logs, access logs or any other pieces of data which could help Law Enforcement.

Thank you, Bobo

2 Answers 2

1

There is a lot of confusion around the UK and its laws which supposedly require full log retention - the only law which addresses this is the 2016 Investigatory Powers Act (amended by the 2018 Data Retention and Acquisition Regulations Act) and this act requires you to retain full logs only on receipt of a valid "retention notice" from the Secretary of State.

The validity of such a notice is one of the things amended by the 2018 act after the 2016 law was declared incompatible with the EU Charter on Fundamental Rights.

Up until receipt of a valid retention notice, or any other warrant regarding interception, integration with equipment et al under the 2016 act, you are within your rights to not retain logs.

The 2016 Investigatory Powers Act uses the following definitions for telecommunications service and system, which as you can see are very broad and would almost certainly cover a VPN provider:

(11) “Telecommunications service” means any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service).

(12) For the purposes of subsection (11), the cases in which a service is to be taken to consist in the provision of access to, and of facilities for making use of, a telecommunication system include any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted, or that may be transmitted, by means of such a system.

(13) “Telecommunication system” means a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electromagnetic energy.

16
  • That law refers to telecommunications providers though (phone companies, ISPs, and such). He does not fit that from what he said.
    – Putvi
    Commented Dec 4, 2019 at 21:23
  • @Putvi A VPN company can easily and trivially fall under the definition of the above - they are providing a telecommunications service in the same manner as a virtual ISP does when renting physical infrastructure from a larger ISP. Given that one of the intentions of this law was to allow legal access to VPN data, I think the UK government is more intelligent than you think.
    – user28517
    Commented Dec 4, 2019 at 21:29
  • well the UK government's definitons don't agree with what you have said.
    – Putvi
    Commented Dec 4, 2019 at 21:32
  • ico.org.uk/for-organisations/guide-to-pecr/…
    – Putvi
    Commented Dec 4, 2019 at 21:32
  • @Putvi I can see several definitions in there that a VPN service would fall under.
    – user28517
    Commented Dec 4, 2019 at 21:33
-2

No, it is not illegal to not store their data.

You can't destroy illegal data to hide crimes or participate in illegal activities in other ways, though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .