criminal-law united-kingdom internet privacy gdpr
Is it illegal to NOT store logs within the UK? (VPN related)
<p><strong>Introduction:</strong>
I co-run a VPN company. I have a few legal questions since our service has a strict NO-LOG policy enforced.</p>

<p><strong>Question:</strong>
In the UK, it is illegal to store sensitive and private customer data without their acknowledgment. My question is that if someone uses my VPN service for illegal activity, and Law Enforcement asks for this specific customer's data, would I be committing an offense by not storing this customer's data? By "data" I mean IP logs, access logs or any other pieces of data which could help Law Enforcement.</p>

<p><strong>Thank you, Bobo</strong></p>

<p>There is a lot of confusion around the UK and its laws which supposedly require full log retention - the only law which addresses this is the <a href="http://www.legislation.gov.uk/ukpga/2016/25/contents" rel="nofollow noreferrer">2016 Investigatory Powers Act</a> (amended by the <a href="http://www.legislation.gov.uk/uksi/2018/1123/made/data.htm" rel="nofollow noreferrer">2018 Data Retention and Acquisition Regulations Act</a>) and this act requires you to retain full logs only on receipt of a <a href="http://www.legislation.gov.uk/ukpga/2016/25/part/4" rel="nofollow noreferrer">valid &quot;retention notice&quot; from the Secretary of State</a>.</p>
<p>The validity of such a notice is one of the things amended by the 2018 act after the 2016 law was declared incompatible with the EU Charter on Fundamental Rights.</p>
<p>Up until receipt of a valid retention notice, or any other warrant regarding interception, integration with equipment et al under the 2016 act, you are within your rights to not retain logs.</p>
<p>The 2016 Investigatory Powers Act uses the <a href="http://www.legislation.gov.uk/ukpga/2016/25/section/261" rel="nofollow noreferrer">following definitions for telecommunications service and system</a>, which as you can see are very broad and would almost certainly cover a VPN provider:</p>
<blockquote>
<p>(11) “Telecommunications service” means any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service).</p>
<p>(12) For the purposes of subsection (11), the cases in which a service is to be taken to consist in the provision of access to, and of facilities for making use of, a telecommunication system include any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted, or that may be transmitted, by means of such a system.</p>
<p>(13) “Telecommunication system” means a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electromagnetic energy.</p>
</blockquote>
