State agencies have made more than 1,250 disclosure requests to access people’s private online information from internet companies over the last five years, new figures show.

An Irish Examiner investigation into what continues to be a highly secretive and controversial spying power also reveals:

16,500 requests for personal phone data have been disclosed by the country’s largest mobile phone operator, Vodafone, over a three-year period;

The Garda Síochána Ombudsman Commission (GSOC) was granted almost 100 requests to access personal data from telecos and internet firms between 2012 and 2017.

GSOC is thought to be the first State agency, with power to access communication data, to voluntarily and publicly provide figures. This followed repeated requests from this newspaper.

The Garda Ombudsman’s position stands in contrast to the other three agencies that utilise the power — An Garda Síochána (by far the greatest user), the Defence Forces, and Revenue, all of which have repeatedly refused to publicly release any statistics.

This is despite EU court rulings and a judicial inquiry here, which undermined the legal basis behind the widespread and indiscriminate retention of this data and the ability of State agencies to access it through an internal process, without first seeking external authorisation from the courts or an expert tribunal.

The Irish Examiner investigation found:

1,259 disclosure requests were made to four major internet service providers (Google, Facebook, Microsoft, and Twitter) between 2012 and June 2018 involving 14,000 users or accounts;

Just over 60% of these requests (768) were granted, with the rest either rejected or no data/information found;

Facebook received 537 disclosure requests, Microsoft 482, Google 217 (with an additional 13 emergency disclosure requests), and Twitter 23;

Microsoft figures show that of the 316 disclosure requests granted, 58 disclosed the content of data and 258 were non-content or communication data;

In addition to providing 10 disclosures, Twitter also complied with 30 removal requests from gardaí and three from the courts;

16,490 requests for communication data were disclosed by Vodafone (which controls 45% of the mobile phone market) between April 2013 and April 2016;

Three other major telecommunication companies (Three, Eir, and Virgin) do not publish any data and declined to do so on request, although Three (which owns 39% of the mobile market) said it planned to publish data in the coming months;

GSOC was approved 95 of its disclosure requests between 2012 and 2017.

Draft legislation to address legal concerns was published over a year ago, following the publication of the Murray report, which examined the law on this area — but the final legislation, the Communications (Retention of Data) Bill 2017, is still awaited.

Last month, the judge tasked with monitoring the use of the provisions, Ms Justice Marie Baker, said there was an “urgency” to the legislation.

State agencies use the power to access communication data for the investigation of serious crime, saving of human life, and protection of national security.

It is thought that the last published figures on communication data related to 2014 or the 2008-2012 period.

Communication data has been described as a “vast store of private information” regarding people’s use of their phones and digital devices.

This includes their network and history of phone contacts and their activities online — everything other than the actual content of communications.

A Department of Justice spokesman said the amending legislation was “well advanced” with amendments to give effect to recommendations of the committee.