Law proposal allows the police to retain social media posts for 15 years

The police have several arguments that substantiate their wish and need for an amendment to the law, the key rationale being that this is required for the police to be able to fulfil their mission of protecting their citizens. In this context, it is argued that the police need a clear legal basis to enable them to prevent and investigate terrorism activities online in an efficient manner.

There has been a huge development in how and where crimes are planned and committed, and some of the most important intelligence work of the authorities must be done on the internet. If the proposal is implemented, the police believe that they would be equipped with more efficient tools in the battle against terrorism. Further, it is stated that stronger police presence in digital networks in itself may be a deterrent for terrorism activities planned or conducted online.

It is acknowledged in the proposal that this amendment to the law may challenge some fundamental human rights, such as the right to privacy and to data protection. However, it is stressed that the police's powers under the new rules would only give authority to access and process publicly available information. Thus, after carefully balancing the competing interests, the Ministry and the police concluded that national security interests must outweigh the relevant individual interests.

The Norwegian Data Protection Authority ("NDPA") argues that the police would convert from a force that investigates and prevents crime to a service that gathers intelligence about citizens on a very large scale. In addition, the NDPA emphasises that the data collected from social media may include all types of information about a person such as political opinion, union membership, sexual preferences, health, friends and other networks, as well as statements and opinions. The NDPA states that the proposal has no restrictions regarding the number of data subjects, nationality, categories of data or scope. Further, according to the NDPA, the collection may include photos, videos and text.

In addition to the NDPA, a number of associations and organisations have raised their concerns. It has been argued that the proposed amendment will be privacy intrusive and entail mass surveillance of citizens. Some voices also claim that collecting all activity on social media, by using artificial intelligence and profiling, may result in Norway becoming a “police state”.

The police argue that their daily challenges and working methods have changed drastically over the last 25 years. Their main concern is that the divergent beliefs and opinions that may generate terrorism can usually be detected on the internet. Thus, it is argued that collecting and processing this data is crucial for the police in order to conduct their counter-terrorism work.

Needless to say, the law proposal may affect fundamental human rights if passed. It is not necessarily the retention period of 15 years that creates the largest privacy concern. In our opinion, the fact that an intelligence agency may collect and analyse a very large amount of information about an indefinite group of people could irreversibly change the limits for how Norwegian authorities are allowed to work with and process sensitive personal data of citizens.

Firstly, the proposal will affect the right to data protection. A massive collection of personal data may be non-compliant with the principles in article 5 of the GDPR. Furthermore, it is likely that it will be more difficult for individuals to assert their rights to e.g. information, access and correction.

Secondly, the amendment may have an impact on the freedom of speech. Internet users that normally express themselves freely, will feel reserved knowing the risk of intelligence agencies storing their opinions and statements for 15 years. This “cooling effect” is particularly relevant as the collected data may be used as evidence in future criminal cases against a data subject.

As the proposal only applies to the open internet, i.e. data that is publicly available, the internet service providers (ISPs) and social media platforms will not, in our view, have more obligations if the amendment is passed. The police will assumingly crawl the information through artificial intelligence, algorithms and customised software. However, the new rules would probably have some impact on how the platforms are being used by citizens and by whom. It is easy to foresee lower activity on the social media platforms including fewer user posts – perhaps also filtered opinions and statements. As providers of social media platforms have based their business models on steadily increasing number of users and high expectations to online interactions, it goes without saying that the amendment may constitute a threat to these business models.

A legal overhaul is deemed necessary to strengthen the police’s ability to collect intelligence via social media. Norway is one of the world's most digitized countries, and the digital domain may generate, and be used to plan and execute, terrorism. There is political agreement that Norway must strengthen its ability to detect and counteract these threats. The interests of the police may be found to outweigh individuals' right to privacy, which in essence was argued also for new rules (not yet in force) according to which the national intelligence services may conduct broad sweep monitoring of cross-border communications. It remains to be seen whether social media platforms will be the suffering party if the online tools are implemented by the police in the proposal's current shape.