Privacy security

The Guardian view on surveillance: make your number unobtainable

One of the strangest features of the current debates about privacy on the internet is the way in which private advertising companies are able to get away with practices that no democratic government could. The security services and police are restricted in their surveillance of private citizens on the web by the Investigatory Powers Act 2016. Around 130,000 people signed a petition against it, largely because of the provision requiring internet providers to keep for up to a year records of all the websites that their users visited. One campaigner described it as “one of the most extreme surveillance laws ever passed in a democracy”.

Yet the material collected in this way can only be accessed under a system of legal and political oversight: the Home Office might like more powers, but the European court of justice ruled in December 2016 that independent judicial authorisation was needed for the “general and indiscriminate retention” of personal data. All that fuss over a year’s worth of websites, when it turns out that Facebook has been storing all the contact details, the instant messages, and the phone calls of millions of its users for as long as 10 years without anyone outside the firm realising what their apparently innocuous consent implied.