The North Carolina Chapter of the ACLU recently obtained through a Freedom of Information Act request a U.S. Department of Justice document that described the length of time mobile phone service providers archive consumers calling and location information. The duration varies by both the type of information, and by the service provider (e.g., AT&T, Sprint, Verizon).
The types of information archived:
- Subscriber information (e.g., name, address, SS#, etc.)
- Call detail records (e.g., phone number dialed, duration, time)
- Cellular towers used by the caller (e.g., date, time, duration)
- Text message detail
- Text message content
- Pictures and photos
- IP session information
- IP destination information
- Copies of subscribers' monthly mobile statements/bills
- Payment history: amounts, dates, payment method
- Store surveillance videos
- Service applications
Sprint, Nextel, and Virgin Mobile keep subscriber information forever. Most service providers keep both call detail records and cellular tower location data for one to two years. While most providers don't store "text message content," Virgin Mobile retains "text message details" as briefly as 60 to 90 days, while AT&T keeps it for five to seven years. I not sure what the difference is as both text-message categories sound very similar.
When you enter a retail store, mobile service providers retain that information ranging from two weeks to two months. You can browse the DOJ chart here.
This is important for several reasons. First, should any of the mobile service providers suffer a data breach this document highlights the amount of information that could be lost or stolen. Second, the document outlines the type of information mobile service providers can provide government law enforcement when requested.
In my opinion, companies should disclose these data retention policies in their website policies. Why the secrecy? We consumers know you are collecting and archiving the data.
What is your opinion of these companies' data retention policies?
Comments