Data Retention Rights: Clarity Remains Elusive

The Court of Appeal has given judgment on the Home Secretary’s appeal against the High Court judgment ruling that the data retention powers in the Data Retention and Investigatory Powers Act 2014. The extent of the ongoing rights to retain data for ‘security’ and related purposes remain distressingly unclear.

In Secretary of State for the Home Department v Tom Watson MP and others [2018] EWCA Civ 70 the Court of Appeal was required to interpret the answers it had received from the CJEU on its own reference, made in November 2015. The reference arose in the course of proceedings concerning the legality of the data retention powers created by the Data Retention and Investigatory Powers Act 2014 (DRIPA) and sought clarification of the CJEU judgment in Case C-594/12 Digital Rights Ireland. The CJEU, in a judgment which also concerned a reference on Swedish legislation of a broadly similar type, gave its answers in December 2016 and that judgment stated that EU law precluded:

‘national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review of a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union’.

DRIPA expired and was repealed in December 2016 but that was not a reaction to the CJEU judgment. It was largely replaced by powers in the Investigatory Powers Act 2016, which (though taking account of some aspects of Digital Rights Ireland) are now subject to further review proceedings and are the subject of a further reference to the CJEU. The government is proposing amendments to the powers to fit with EU law.

As Lord Lloyd-Jones observed (at [9]):

It is common-ground amongst the parties before us that the judgment of the CJEU establishes, at the very least, that where the purpose is the prevention, investigation, detection and prosecution of criminal offences:-

(1) access to and use of retained communications data should be restricted to the objective of fighting serious crime; and

(2) access to retained data should be dependent on a prior review by a court or an independent administrative body.

The Court of Appeal, having wrestled with the fact that the CJEU ruling was ‘lacking in clarity’ and having flirted with the idea of making no ruling at all as things had moved on, made the following declaration:

Section 1 of the Data Retention and Investigatory Powers Act 2014 was inconsistent with EU law to the extent that, for the purposes of the prevention, investigation, detection and prosecution of criminal offences, it permitted access to retained data:

(a)    where the object pursued by that access was not restricted solely to fighting serious crime; or

(b)    where access was not subject to prior review by a court or an independent administrative authority.

So, while this is undoubtedly a ‘win’ for Tom Watson MP, Peter Brice, Geoffrey Lewis, Liberty, the Open Rights Group, Privacy International and the Law Society (and, arguably, David Davis MP), it is mainly water under the bridge. The judgment is of limited ongoing help to those seeking to establish the legality of the data retention powers under the IPA 2016 – still less the legality of those powers as they will be once the government has tinkered with them following its recent consultation.

The government is, not unfairly, described as seeking the widest possible powers it can get away with under EU law and under the ECHR and one can confidently expect a further challenge to the revised powers from those seeking to narrow them.

You can connect to a pdf of the full judgment by clicking on the link below.

Published: 2018-01-30T13:00:00

0 comments

    This site uses cookies. By using the site you agree to our use of cookies as set out in our Privacy Policy.

    Please wait...