UK Government Data Retention: Important Advocate General Opinion

19 Jul UK Government Data Retention: Important Advocate General Opinion

Posted at 15:43h in Daniel Carey, Information and privacy rights, International law & corporate accountability, Judicial review & public law by Ali

The Advocate General today gave his opinion in the legal challenge to the UK Government’s data retention law, which requires communications providers to retain, in bulk, records of the public’s communications. In his opinion, the UK’s law falls far short of EU law data privacy protections.

Deighton Pierce Glynn represent Open Rights Group and Privacy International, who are parties to the legal challenge brought by Tom Watson MP to the UK government’s data retention legislation: DRIPA 2014. David Davis MP was previously also a claimant in the case, but yesterday withdrew due to his new role as Minister for Brexit.

DRIPA permits the retention of all ‘metadata’ (data other than ‘content’ and including locational data generated by mobile phones) for a period of up to a year from its creation. On subscription services such as Facebook, subscriber data may be required to be held for the duration of a user’s use of a service. This makes the data available for public authorities to search. In 2013 over half a million such requests were made. The law was passed by parliament on an emergency basis in July 2014 with little informed debate.

The Court of Justice of the EU heard the case on 12 April 2016. Today’s Advocate General opinion is advisory to the Court, whose judgment will now follow. However, it is a helpful indication of the issues the Court will confront. Helpfully, it rejected the UK government arguments in the following areas and found that:

EU Law does apply to data retention and access laws.
Data retention and access arrangements must be in binding laws and not merely Codes of Practice and policies.
Data retention is only permissible to prevent serious crime, and not the many other bases DRIPA currently permits (taxation, public health etc.).
All of the safeguards set out in the previous case known as Digital Rights Ireland are mandatory, meaning that prior independent authorisation is required to access retained data. This cannot simply be signed off by the same authority which wishes to access the data.

The Court’s judgment is now awaited with interest. However, the UK government and the House of Lords would be well advised to take account of the Advocate General’s opinion in relation to the Investigatory Powers Bill currently before Parliament. In its current form it fails to comply with all of the above requirements.

A copy of the opinion can be found here.