EU Court of Justice declares indiscriminate retention of the public’s data unlawful

21 Dec EU Court of Justice declares indiscriminate retention of the public’s data unlawful

Posted at 11:52h in Daniel Carey, Data protection, Information and privacy rights, International law & corporate accountability, Judicial review & public law, Privacy and surveillance, Security services and armed forces by Ali

The Grand Chamber of the EU Court of Justice today gave its judgment in the legal challenge to the UK Government’s 2014 data retention law (known as ‘DRIPA’), which required communications providers to retain, in bulk, records of the public’s communications. The Court has comprehensively rejected the law, whose provisions were recently re-enacted in the government’s flagship Investigatory Powers Act.

Deighton Pierce Glynn represent Open Rights Group and Privacy International, who are parties to the legal challenge brought by Tom Watson MP and others to the UK government’s data retention legislation: DRIPA 2014. DRIPA permitted the retention of all ‘metadata’ (data other than ‘content’ and including locational data generated by mobile phones) for a period of up to a year from its creation. On subscription services such as Facebook, subscriber data may be required to be held for the duration of a user’s use of a service. This makes the data available for public authorities to search. Over half a million such requests are made annually.

The Court gave judgment today following submissions at a hearing in April 2016. Vindicating our clients’ submissions, the Court held that laws which require telecoms companies to indiscriminately retain metadata for purposes other than serious crime, and without narrowing the scope of retention requests to a particular time period, geographical area or group of persons are unlawful. They fall outside what is permitted by longstanding EU legislation, which the UK played an important role in creating (the E-Privacy Directive and the Data Protection Directive).

The Court points out the chilling effect on freedom of speech that indiscriminate retention of users’ data has, and the likelihood that the public will “feel that their private lives are the subject of constant surveillance” [100].

It goes on to stipulate that national legislation needs to limit access to that data also: solely to combating serious crime [115]; and that access must be independently authorised [113] and not signed-off within government. Further, affected individuals should be notified that their data was accessed as soon as it is safe to do so [114].

The result is a clear vindication of Open Rights Group’s and Privacy International’s position in the litigation, which emphasised that indiscriminate retention of (as opposed to only access to) our data was unlawful, and in emphasising the primacy of the EU Directives, which are the foundation of the Court’s judgment.

The case will now return to the Court of Appeal in the UK, where the court will apply the Court of Justice’s ruling. It is clear that DRIPA 2014 was unlawful. It is also clear that the government’s Investigatory Powers Act 2016 is unlawful too as it replicated DRIPA and fails to comply with all of the above legal standards. Attention will now shift to the government and the decisions it takes about enacting that legislation, which was due to come into force at the end of 2016.

A copy of the Court’s press release can be found here.

A copy of the judgment can be found here.