EU member states attempt to circumvent CJEU rulings on data retention

One of the things the UK government is going to miss desperately, once Brexit deal is done, is the monumental amount of policy washing they have been able to drive though the EU in the past four plus decades. Not that this will prevent future UK governments from blaming the EU for whatever their prevailing set of woes happens to be.

Case in point.

The Court of  Justice of the EU has repeatedly ruled that blanket data retention is a breach of the  Charter of Fundamental rights of the EU, most notably in the Digital Rights Ireland case in April 2014 and the Tele2 case in December 2016.

Ever since, EU member state governments and various branches of EU institutions have been furiously trying to find ways to circumvent the Court's judgments and continue and expand data retention practices. They are very happy, thank you very much, with their current illegal data retention regimes.

The contortionist wordplay at large in some of the forums considering the issue is bordering on awe inspiring.

The current great hope of those working to maintain, enhance and expand data retention practices is that the planned new e-Privacy directive can be constructed in such a way as to pretend that data retention is not really data retention. In diplomatese they are working towards a more “favourable” environment for data retention than the current ePrivacy Directive of 2002. Article 15(1) of that directive when read in conjunction with the EU Charter of Fundamental Rights, rather irritatingly, for its supporters and according to the CJEU, prohibits blanket data retention. It requires data retention to be

"a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system"

Thank you to the excellent crew at EDRi for the update on the ongoing shenanigans on this today.

Open Letter to MPs re DRIP from UK academics

Open letter to MPs on the emergency Data Retention and Investigatory Powers (DRIP) Bill being rushed through the House of Commons today. (Full disclosure - I'm a co-signatory)

"Tuesday 15^th July 2014 

To all Members of Parliament, 

Re: An open letter from UK internet law academic experts 

On Thursday 10 July the Coalition Government (with support from the Opposition) published draft emergency legislation, the Data Retention and Investigatory Powers Bill (“DRIP”). The Bill was posited as doing no more than extending the data retention powers already in force under the EU Data Retention Directive, which was recently ruled incompatible with European human rights law by the Grand Chamber of the Court of Justice of the European Union (CJEU) in the joined cases brought by Digital Rights Ireland (C-293/12) and Seitlinger and Others (C-594/12) handed down on 8 April 2014. 

In introducing the Bill to Parliament, the Home Secretary framed the legislation as a response to the CJEU’s decision on data retention, and as essential to preserve current levels of access to communications data by law enforcement and security services. The government has maintained that the Bill does not contain new powers. 

On our analysis, this position is false. In fact, the Bill proposes to extend investigatory powers considerably, increasing the British government’s capabilities to access both communications data and content. The Bill will increase surveillance powers by authorising the government to;

• compel any person or company – including internet services and telecommunications companies – outside the United Kingdom to execute an interception warrant (Clause 4(2));
• compel persons or companies outside the United Kingdom to execute an interception warrant relating to conduct outside of the UK (Clause 4(2));
• compel any person or company outside the UK to do anything, including complying with technical requirements, to ensure that the person or company is able, on a continuing basis, to assist the UK with interception at any time (Clause 4(6)).
• order any person or company outside the United Kingdom to obtain, retain and disclose communications data (Clause 4(8)); and
• order any person or company outside the United Kingdom to obtain, retain and disclose communications data relating to conduct outside the UK (Clause 4(8)).

The legislation goes far beyond simply authorising data retention in the UK. In fact, DRIP attempts to extend the territorial reach of the British interception powers, expanding the UK’s ability to mandate the interception of communications content across the globe. It introduces powers that are not only completely novel in the United Kingdom, they are some of the first of their kind globally. 

Moreover, since mass data retention by the UK falls within the scope of EU law, as it entails a derogation from the EU’s e-privacy Directive (Article 15, Directive 2002/58), the proposed Bill arguably breaches EU law to the extent that it falls within the scope of EU law, since such mass surveillance would still fall foul of the criteria set out by the Court of Justice of the EU in the Digital Rights and Seitlinger judgment. 

Further, the bill incorporates a number of changes to interception whilst the purported urgency relates only to the striking down of the Data Retention Directive. Even if there was a real emergency relating to data retention, there is no apparent reason for this haste to be extended to the area of interception. 

DRIP is far more than an administrative necessity; it is a serious expansion of the British surveillance state. We urge the British Government not to fast track this legislation and instead apply full and proper parliamentary scrutiny to ensure Parliamentarians are not mislead as to what powers this Bill truly contains. 

Signed,

Dr Subhajit Basu, University of Leeds
Dr Paul Bernal, University of East Anglia
Professor Ian Brown, Oxford University
Ray Corrigan, The Open University
Professor Lilian Edwards, University of Strathclyde
Dr Theodore Konstadinides, University of Surrey
Professor Chris Marsden, University of Sussex
Dr Karen Mc Cullagh, University of East Anglia
Dr. Daithí Mac Síthigh, Newcastle University
Professor David Mead, University of East Anglia
Professor Andrew Murray, London School of Economics
Professor Steve Peers, University of Essex
Julia Powles, University of Cambridge
Professor Burkhard Schafer, University of Edinburgh
Professor Lorna Woods, University of Essex

Update 17/7/'14: I'm pleased to say Dr Andres Guadamuz, University of Sussex and Professor Viktor Mayer-Schönberger, Oxford University have joined as signatories to the letter.