Denmark’s teledata case: when a gap in the timeline is a processing gap

365 ALTERAM analysis

What does an empty interval actually establish?

A gap in a call timeline can become an important part of a prosecution or defence account: a person stopped communicating, a contact did not occur, or activity resumed after a particular event. Before interpreting that silence, an independent reviewer should ask whether the exhibit faithfully represents the records supplied. An empty interval is an observation about a dataset; explaining it requires additional evidence.

Denmark’s historical teledata case provides a concrete reason to examine that distinction. The focused forensic question is whether records survived each processing stage, from the provider’s delivery through conversion and analysis to the courtroom exhibit. This question concerns the integrity of a chronology, before any inference about a person’s intentions.

Public record

The processing failures documented by the regulator

On 19 July 2021, the Danish Data Protection Authority, Datatilsynet, issued serious criticism of Rigspolitiet’s processing of telecommunications data under the law governing law-enforcement data protection. Its decision relied on factual accounts supplied by police and prosecution authorities; it was not a criminal verdict against an individual. [1]

Those accounts described a timer releasing data before conversion was complete, with a software update also contributing to omitted records. Errors were identified in cases from 2012 to March 2019; police reported correcting the system error on 8 March 2019. Other failures affected particular event types and the analysis tool’s ingestion of records. The decision also addressed incomplete raw data from some providers for newer communications services. These were different points at which information could be absent. [1]

Public record

The case-review outcome limits the conclusion

On 3 February 2021, Denmark’s Ministry of Justice reported that review of approximately 5,000 prioritised criminal cases had identified no instance in which teledata errors provided grounds to seek reopening. Following the independent control and steering group’s recommendation, the minister stopped review of the remaining non-prioritised cases. The announcement therefore describes a defined review and its outcome, rather than examination of every potentially relevant case. [2]

365 ALTERAM analysis

Reconcile records before interpreting silence

For a new authorised review, obtain the provider’s original delivery, its covering explanation, the converted files, processing logs and the version of the analytical output actually relied upon. Preserve originals and record file hashes, receipt dates and subsequent replacements. A corrected export must remain distinguishable from the earlier version: otherwise a successful check today could be mistaken for validation of an exhibit used previously.

Build a comparison at each boundary. Count records by provider, requested period and event type, then reconcile individual events and the fields needed for the disputed inference. Explain legitimate transformations, such as several source rows becoming one analytical event. Equal totals alone are insufficient: a duplicated row can conceal a missing row, while changed timestamps can move an event outside the interval being discussed.

Trace every excluded or unmatched record to a reason. Was it rejected during import, omitted by an unsupported event mapping, removed by an analyst’s filter or excluded from the final display? Document the software version, configuration and selection criteria. Where available material cannot resolve the question, mark that boundary as unverified instead of treating the later output as a complete substitute for the source.

Then test the provider delivery itself. Confirm the requested identifiers, dates, service coverage and any stated retention or extraction limits. Agreement between raw and converted files demonstrates faithful transformation of the supplied material; it cannot establish that the supplied material captured every real-world communication. A specialist may need provider clarification before assessing an asserted period of inactivity.

365 ALTERAM analysis

Connect any discrepancy to the disputed proposition

A demonstrated processing defect does not by itself establish that a verdict was wrong. Reconstruct the disputed interval using the verified records, show which events changed and explain whether the original inference survives. Recovered activity may undermine a claimed silence, reinforce an existing chronology, or have no bearing on the issue. An unresolved gap also does not prove that a missing call occurred.

The useful deliverable is a comparison that counsel and another specialist can reproduce: the original proposition, the records supporting it, the transformation checks, any corrected chronology and the remaining limits. 365 ALTERAM’s forensic telecommunications review can organise this evidence and coordinate appropriate technical examination. Counsel retains legal strategy, including the significance of any discrepancy under the applicable rules. The objective is a traceable conclusion, including adverse or inconclusive results, without promising a litigation outcome.