General data retention unlawful, EU court rules
European Union law precludes national legislation that prescribes general and indiscriminate retention of data, the EU Court of Justice ruled today.
Judges gave the ruling in two cases referred to the court, one from Sweden and one initially brought by the now Brexit secretary, David Davis, when he was a backbench MP, and Tom Watson, Labour’s deputy leader, over the legality of GCHQ’s bulk interception of call records and online messages. Mr Davis withdrew from the case following his appointment as a minister.
Both cases were brought in the wake of the court's Digital Rights Ireland judgment of 2014, when the court declared invalid the directive on the retention of data as in breach of fundamental rights to respect for privacy and the protection of personal data, since the obligation to retain data was not limited to what was strictly necessary. They challenged Swedish and UK legislation reflecting the directive – in the UK, s 1 of the Data Retention and Investigatory Powers Act 2014 – imposing obligations on providers of electronic communications services to retain data relating to those communications.
The UK Government maintained that intercepted communications were a vital part of the fight against terrorism.
In its ruling the court said that while member states could restrict the scope of the obligation to ensure the confidentiality of communications and related traffic data, the exception to the obligation could not become the general rule.
It was settled in the court's case law that protection of the fundamental right to respect for private life required that derogations from the protection of personal data should apply only in so far as was strictly necessary.
In the present cases the retained data, taken as a whole, were liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained. Such interference with rights "must therefore be considered to be particularly serious". The fact that the data were retained without the users of electronic communications services being informed was "likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance". Consequently, only the objective of fighting serious crime was capable of justifying such interference.
National legislation could impose a targeted retention of data for the purpose of fighting serious crime, provided the categories of data, the means of communication, the persons concerned and the retention period adopted, were all limited to what is strictly necessary. Any legislation to that effect had to be clear and precise, and provide for sufficient guarantees of the protection of data against risks of misuse.
It was necessary also to lay down the substantive and procedural conditions governing the access of the competent national authorities to the retained data, based on objective criteria in order to define the circumstances and conditions under which the authorities were to be granted access to the data.
And it was "essential" that access to retained data should, except in cases of urgency, be subject to prior review carried out by either a court or an independent body. In addition, the competent national authorities to whom access to retained data was granted had to notify the persons concerned of that fact.
Following the decision Mr Watson commented: “Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the Government the power to arbitrarily seize our phone records or emails to use as they see fit. It’s for judges, not ministers, to oversee these powers. I’m pleased the court has upheld the earlier decision of the UK courts.”
Campaigners said the the Government would have to rethink the recently passed "snoopers’ charter" legislation or face a further legal challenge.
A Home Office spokesperson said: “We are disappointed with the judgment from the European Court of Justice and will be considering its potential implications.
“It will now be for the Court of Appeal to determine the case. The Government will be putting forward robust arguments to the Court of Appeal about the strength of our existing regime for communications data retention and access.
“Given the importance of communications data to preventing and detecting crime, we will ensure plans are in place so that the police and other public authorities can continue to acquire such data in a way that is consistent with EU law and our obligation to protect the public.”