02 Feb Court of Appeal rules UK data retention law unlawful

Following a hearing in December 2017, the Court of Appeal has declared the data retention provision of the Data Retention and Investigatory Powers Act 2014 (“DRIPA”) to be unlawful, following the landmark judgment of the Grand Chamber of the Court of Justice of the EU in December 2016.  This has an immediate impact on the same power in the government’s flagship Investigatory Powers Act, which will now be amended.

Deighton Pierce Glynn represent Open Rights Group and Privacy International, who are parties to the legal challenge brought by Tom Watson MP and others to the UK government’s data retention legislation: DRIPA 2014. DRIPA permitted the retention of all users’ ‘metadata’ (data other than ‘content’ and including locational data generated by mobile phones) for a period of up to a year from its creation. On subscription services such as Facebook, subscriber data may be required to be held for the duration of a user’s use of a service. This makes everyone’s data available for public authorities to search. Over half a million such requests are made annually.

Following December 2016’s landmark EU Court of Justice ruling, the Court of Appeal has ruled that the power was unlawful.  The Court of Appeal has declared DRIPA to be unlawful as it permitted public authorities to access data for the investigation of crime without it subject to prior review by a court or other independent administrative authority.  It also said that such requests should be limited to the investigation of “serious crime” only.  However, the Court declined to rule the power to be unlawful in relation to the other aspects of the December 2016 EU Court of Justice ruling, mainly in deference to other legal challenges underway in relation to comparable powers.

Daniel Carey, who represented Open Rights Group and Privacy International commented as follows:

“The Court of Appeal’s ruling is a welcome recognition that the UK government’s powers for retaining and accessing the metadata of all telecommunications service users were unlawful and in breach of EU data protection and e-privacy laws.  This has a big impact on the data retention powers in the Investigatory Powers Act, which the government has already consulted on replacing as a result.  However, it is disappointing that the Court limited its ruling to the criminal investigation basis for accessing data only and didn’t seek to restrict the many other bases for accessing and retaining data in the legislation.  It will now be for other legal challenges to seek orders (i) restricting the bases for exercising these broad retention and access powers to serious crime investigations and national security only; (ii) to require notification to persons whose data is accessed once it is safe to do so; and (iii) to implement the EU Court of Justice’s ruling that indiscriminate retention was impermissible. That Court has made clear that the exercise of retention powers need to be the exception and not the rule, and that needs to be made clear in the law itself.”

A copy of the Court of Appeal’s judgment can be found here

A copy of the EU Court of Justice’s 2016 press release can be found here

A copy of the EU Court of Justice’s 2016 judgment can be found here

Share this story