ref: session 2:

Simon Milner: Yes. In our case, we were asking questions in particular about the data retention proposals and what the Home Office had in mind on what that might mean for Facebook. It explained that to us that the Home Office envisaged that there would be a retention order on Facebook to retain all communications data in respect of Facebook users in the UK for a year. That gave us grave cause for concern about such a blanket retention requirement being placed on us. We also talked about the access process, but we were particularly focused on the retention regime in that conversation

…

Colin Crowell: Yes, our conversation with the Home Office was similar in that it largely focused on asking questions about the intent of aspects of the legislation as we read it. The legislation is largely enabling, with lots of the implementing regulations and orders to come. Subsequently, sir, we were curious as to how they saw it working in practice. We also had questions about the assertion of authority to a company such as Twitter, which is subject to US laws, and the relationship that we might have with a communications carrier here in the UK and the acquisition of our users’ data and the retention of that data here.

…

Simon Milner: As regards the UK, it might be worth the Committee understanding our user base here. We have around 30 million active users in the UK and around half of them will log on to Facebook every single day. All our data are held in data centres in the US, and therefore I envisage that we were subject to an order that these data would be retained in a data centre in the US. That is what the Home Office envisages as well.

…

Q612 The Chairman: Do you have concerns about that or are you relaxed about it, irrespective of the cost?

Simon Milner: We are very concerned about it.

Q613 The Chairman: What would the concerns be?

Simon Milner: In respect of the cost benefit of such a measure, we would be asked to retain enormous amounts of data which we would ordinarily delete if the customers asked us to do so. For 30 million users, only a tiny fraction might be subject to a request as part of a law enforcement investigation, but the data set would be there and it would be known that it existed. Law enforcement agencies in other countries might also seek access to those data via the US courts. We think that that should be a real concern for the UK citizens and for Members of this Committee.

Q614 The Chairman: Mr Crowell, is that a similar concern?

Colin Crowell: Yes, it is similar. Our servers are also in the United States, and one of our concerns would be about a UK-based carrier ordered to collect Twitter data here in the sense that our user data would be retained by a UK carrier. That would therefore pose problems to us in terms of our terms of service and privacy policies. If such an order were to come to a domestic carrier here, that would collect and warehouse our data. We would also have issues with respect to not knowing when an access request for such user information was served on the company that was UK based and collecting our data. Finally, it is not clear how the filtering regime that is outlined in the Bill would work in practice, even from a technological standpoint.