On Wednesday, the European Court of Justice ruled that the UK’s Data Retention and Investigatory Powers Act 2014 (DRIPA), which expires on 31 December 2016, was unlawful because it allowed for the general and indiscriminate retention of our data. The ruling could be problematic for the Investigatory Powers Act 2016, which replaces DRIPA and largely replicates the contested laws in question.
The Background
The case was originally brought before the British courts by Labour Party politician Tom Watson and Conservative MP David Davis (now Brexit Secretary and withdrawn from the case) and members of the public, supported by human rights campaigning organisation Liberty. They challenged a law called the Data Retention and Investigatory Powers Act 2014 (DRIPA), which had been enacted by Parliament in July 2014, after only three days’ scrutiny, which itself followed a declaration by the European Court of Justice (ECJ) that an EU data retention law was invalid.
What happened in the case?
DRIPA gives the government the power to require a telecoms company to retain ‘communications data’ for up to twelve months.‘Communications data’ is information such as the time and date an email was sent or a phone call was made – but not its contents. It also includes ‘user location data’, which is the geographic location of a user’s device.
Because DRIPA falls within the remit of an EU law known as the e-Privacy Directive, it has to comply with that law, and also with the European Charter of Fundamental Rights (the Charter). The Charter is a set of human rights standards that must be upheld by national governments when applying EU law. The claimants (those bringing the case) argued that the bulk retention of data under DRIPA violated the right to private life and the right to the protection of personal data.
The (then) Home Secretary Theresa May appealed to the Court of Appeal when the claimants were initially successful in the UK High Court.
Where it assists in resolving a case, UK courts have the power to ask the ECJ for help interpreting EU laws. The Court of Appeal used this power in the case to ask the ECJ whether there were any particular EU law requirements on the bulk retention of people’s data.
What did the court say?
In relation to the retention of data, the court said:
- Generally, under the e-Privacy directive, national governments have a duty to ensure communications data is kept confidential. They must create laws prohibiting the listening, tapping, or storage of communications data without the user’s consent.
- This strict requirement can only be ‘derogated from’ (that is, disapplied) for the purposes of safeguarding national security and for the prevention, investigation, detection and prosecution of criminal offences.
- Given that the data retention in question is a very serious interference with fundamental rights, which allows ‘very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained’, it can only be lawfully achieved for the objective of fighting serious crime.
- National laws should lay down the precise conditions under which the authorities can access this data.
- As a general rule, access can only be granted to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime.
- A court or other independent administrative body should review the request to access any retained data.
- Finally, national laws providing for the general and indiscriminate retention of communications data of all registered users and subscribers is unlawful.
What does this mean for the Investigatory Powers Act 2016?
The Investigatory Powers Act 2016 (IPA 2016), which became law on 29 November 2016, replicates DRIPA in so far as it allows public authorities to request companies to retain communications data for a number of purposes including for the UK’s economic well-being and tax collection. Under the ECJ’s ruling, any request to retain data for any purpose other than fighting serious crime is unlawful. The judgment could therefore mean several parts of the IPA 2016 are in breach of EU law, and puts pressure on the government to repeal these parts of the legislation.
However, given the impending political event of Brexit, it is unclear whether Parliament will seek to amend the legislation at all. It is reported that the government will not make any changes to the legislation until the Court of Appeal completes its ruling on the case.
This judgment shows that fighting serious crime is an important objective of the European Union, and that data can be retained and accessed in order to fight terrorism and other criminal offences. However, the bulk retention of people’s data is also a serious infringement of our rights to privacy, and cannot be interfered with lightly.
- You can read the Court’s decision in full here
- Read about the new Investigatory Powers Act in plain English
- Learn about criticisms of the Snoopers Charter as it passed through Parliament
- Read about the human right to respect for privacy with our infographic poster
