An European court has ruled UK domestic surveillance illegal. The European Courts of Justice (ECJ) ruled “general and indiscriminate retention” of electronic communications is illegal.
The judgement concluded “that EU law precludes national legislation that prescribes general and indiscriminate retention of data.”
Legislation which calls for that kind of retention, the judgement added, “exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society.”
The ECJ claims that bulk collection clashes with the EU Charter of Fundamental Rights, a legal text which supersedes the laws and ruling of signatory states, the UK included.
The judgement spells trouble for the Investigatory Powers Bill, which was recently passed by UK Parliament. Often dubbed ‘the Snooper's Charter', the bill formalises the UK government's pre-existing surveillance practices and puts extremely controversial measures, like bulk collection of electronic communications, into realms of unambiguous legality.
Notwithstanding the problems this new ruling may cause for the Investigatory Powers Bill, this is by no means a coup de grace for electronic surveillance. The ECJ ruled that while it might not be legal to collection private communications data in bulk, targeted surveillance is. The judgement reads, “The Court makes clear however that the directive does not preclude national legislation from imposing a targeted retention of data for the purpose of fighting serious crime”. That data must also be “limited to what is strictly necessary”.
The judgement arises from a challenge brought to the European courts several years ago by Tom Watson MP David Davis MP, Secretary of State for exiting the European Union over the bill's predecessor, the Data Retention and Investigatory Powers Act 2014 (DRIPA). The challenge was raised with support by pressure groups such as Liberty and Privacy International.
The UK Court of Appeal will now look at the Court of Justice's judgement and integrate it into UK law, possibly ending with amendments to the Investigatory Powers Act.
The National Police Chiefs' Council lead for communications data, assistant chief constable Richard Berry said in a statement: “We need the ability to make specific, necessary and proportionate requests for communications data to trace missing people and prevent and investigate crime from burglary and domestic abuse to human trafficking and terrorism.”
“We will work within any authorisation and oversight regime deemed appropriate by Parliament and courts of law. But it is important for us to have a regime that is practical and dynamic”.
He added, “Any changes that impede our ability to access data quickly with appropriate safeguards will undermine our ability to keep people safe.”
As a member of the EU, the UK will have to abide by the ruling. What this will mean given the fact of the UK's exit from the European union in 2019 is not yet clear. Harmit Kambo, campaigns director at Privacy International shed some light on the matter for SC Media UK.
The UK government, no matter how hard that Brexit will be, may not be able to banish this ruling as swiftly as they like: “Post-Brexit, the UK will not be able to just ignore this judgment. If EU countries want to share any data with the UK, the UK would need to demonstrate that its data protection standards are adequate, and in effect the UK's standards will need to be as good as EU countries' own standards.Yesterday's judgement, added Kambo, “will continue to matter, and will continue to offer a level of protection to people's privacy in the UK, even after we leave the EU”.