The State has had a secret data retention regime for almost a year, after the Cabinet confidentially instructed telecommunications operators to store traffic information about every phone, fax and mobile call for three years.

The Data Protection Commissioner, Mr Joe Meade, revealed that the former minister for public enterprise, Ms O'Rourke, issued secret directions for data retention when a dispute arose between the operators and his office over how long they should hold such data.

A proposed Bill requiring operators to retain similar information about customer e-mails and Internet activities would cost at least €34 million over four years for each large computer handling such information, according to a representative from Esat/BT.

The details emerged during a consultation forum held by the Department of Justice yesterday to discuss the data retention Bill. The Minister for Justice, Mr McDowell, who chaired the event, said it was "the first stage in a broad process of consultation".

A Bill needed to be introduced because "at the moment we have largely unregulated access to this information", he said. "There are no checks and balances outside of good faith and the good will of the security forces."

Mr McDowell hoped to strike a balance between the need to protect personal privacy and ensure national security, he said.

The Garda increasingly needed data traffic information for criminal investigations, with mobile phone call details central to bringing prosecutions in the Veronica Guerin murder and the Omagh bombing cases, according to Assistant Garda Commissioner Joseph Egan, who spoke at the event.

Data retention was "a huge requirement" for gardaí, and criminal investigations would be "very much hindered" without adequate provisions for retaining traffic data, he said.

But Mr Meade said both the Guerin and Omagh cases used data that was requested within three to four days of each event. The cases did not indicate any need to allow data to be stored beyond the six-month period he and the other European data protection commissioners recommend as "adequate and proportionate".

Mr Meade said stored data could be used to make wrong assumptions about personal behaviour and as a means of surveillance on all citizens, "just in case they did wrong". The Garda had never indicated to him that an investigation had been hampered by inadequate access to data traffic information, he said.

Privacy was "one of the unenumerated rights of our Constitution", he said, and he remained unconvinced that three years of data retention, as proposed by Cabinet, was necessary. "Once privacy rights are surrendered, they are quite hard to recover."

Bar Council representative Mr Denis Kelleher said there was "a concern that this policy may well damage this country's attractiveness for e-business", because businesses would be concerned about having a third party storing sensitive data over such a long period. In the past, the Republic had been seen as "a jurisdiction with a very high regard for privacy".

"If we are going to relinquish some aspects of people's privacy, we do need to have some hard, solid evidence it is necessary," said Mr Malachy Murphy of the Irish Council for Civil Liberties.