DRIPA left out to dry
‘Partly cloudy with a chance of drip’, Flickr, Pekka Nikrus
The Court of Justice of the EU’s decision on 21 December in the case of Watson has potentially serious implications for UK surveillance law, writes Nicholas Griffin QC.
The case is about communications data – information about a communication rather than its content. It includes information about who is communicating with whom, when and where, and for how long. It includes the type of data that is held in telephone and email logs. A great deal can be revealed by such data. Indeed, the CJEU suggested that such information can establish a profile of the individuals concerned “that is no less sensitive … than the actual content of communications”.
Article 7 of the Charter of Fundamental Rights of the European Union guarantees the respect for private and family life, home and communications. Article 8 specifically covers the right to protection of personal data. EU Directives also cover this ground. The Charter and Directives permit derogation in specified circumstances, where necessary and proportionate. They had already been considered by the CJEU in the Digital Rights Ireland case, which held that the EU Data Retention Directive breached EU law and was invalid.
The Data Retention and Investigatory Powers Act 2014 was brought in by the UK government in place of the Directive. DRIPA includes a requirement for the mandatory retention of communications data by public telecommunications operators for up to a year on notice from the Home Secretary. This entails a blanket approach, scooping up all communications data regardless of whether there is a potential connection with a crime. Law enforcement organisations can then access that information.
MPs Tom Watson and David Davis challenged the data retention provisions of DRIPA by way of judicial review in the High Court in reliance on Digital Rights Ireland on the basis that they fell foul of EU law and the Charter. They succeeded. The government appealed and the case went to the Court of Appeal, which referred questions to the CJEU for a preliminary ruling.
The CJEU’s decision (in joined cases Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Tom Watson and others, 21 December 2016) holds that EU law precludes national legislation which entails the blanket retention of communications data for the purpose of fighting crime. EU law further precludes access to the retained data by national authorities where that access is not restricted to the purpose of fighting serious crime, is not subject to prior review by a court or independent authority (save in cases of urgency) and where there is no requirement to retain the data in the EU.
The case now goes back to the Court of Appeal, which will consider whether DRIPA meets the standards required by the CJEU. It may be found wanting. DRIPA contains a sunset clause. This means that the relevant provisions expired at the end of last year. The real significance of the CJEU decision may therefore be how the equivalent provisions in the Investigatory Powers Act 2016, replacing DRIPA, measure up.
