Small ISPs under the pump as data retention laws come into effect today

Small internet service providers (ISPs) are among those scrambling to implement compliance programs after new data retention laws came into effect today.

The new data retention laws mean ISPs must begin complying with new requirements regarding the collection and storage of metadata, including data from phone ecalls, emails, website visits and other electronic messages, and must start doing so from today.

Under the new regime all ISPs are required to store such data for a period of two years, with the Attorney-General’s Department and other law enforcement agencies able to access this information without a warrant.

However, a survey by the Communications Alliance earlier this year found most ISPs were not ready to start collecting such data and almost two-thirds of ISPs were not certain about exactly what sort of information they were required to keep.

Broadband Solutions director Sam Bashiry told SmartCompany this morningwhile his own company is getting “close to being fully compliant”, he is concerned about the impact the new laws will have on smaller ISPs.

“It’s about having a plan in place and having the right legal advice about what needs to be implemented,” he says.

“It’s a lot of work and time-consuming. (But) I do welcome the new laws, if it helps the government and if it’s going to make things safer for us.”

Bashiry estimates his own ISP will be finished going through the final stages of the implementation plan in the next 30 to 60 days.

“There is a lot more implementation to be done and costs involved,” he says.

Bashiry says while the costs are part of doing business and the business had allocated funds for it, getting clarification around some of the compliance processes can be a costly exercise.

“It’s good to get more clarification, there are a lot of legal costs involved in getting those clarifications, that is likely to hurt a lot of smaller ISPs,” he says.

Bashiry says even for a very small ISP player it could still cost “tens of thousands in legal fees in terms of getting clarification” about some of the new requirements.

“If you don’t have funds to get clarifications, you could be in a lot of trouble,” he says.

Bashiry says his business is lucky to have had advice about the main requirements.

“That’s where cost goes in; we’ve been lucky to have that advice,” he says.

“If we didn’t it would be difficult, that’s not helpful for ISPs.”