U.K. Data Retention Facing EU Ruling, Brexit Impact

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Stephen Gardner

A soon-to-be-released data retention ruling from the European Union’s top court may have major implications for U.K. law in the context of Brexit, privacy analysts told Bloomberg BNA.

Telecommunications and internet service providers (ISPs) required to retain certain data to answer law enforcement and national security requests are particularly interested in how the court rules.

The European Court of Justice (ECJ) is scheduled to release Dec. 21 the data retention ruling on two joined cases relating to the data retention regimes in Sweden and the U.K. The cases concern the impact on national laws of the ECJ’s April 2014 invalidation of the EU Data Retention Directive (2006/24/EC).

The Data Retention Directive required telecoms and ISPs to retain certain customer personal data and communications data for up to two years and provide it to law enforcement agencies on request. The ECJ invalidated the law on the basis that it contained insufficient safeguards against indiscriminate bulk data collection.

The U.K. case before the ECJ concerns the predecessor to the Investigatory Powers Act, the U.K. Data Retention and Investigatory Powers Act 2014 (DRIPA), which is subject to a sunset clause and expires Dec. 31.

Lorna Woods, a professor in the U.K.’s University of Essex School of Law, told Bloomberg BNA that the repercussions of the case may be “far-reaching” for the U.K.’s Investigatory Powers Act. The law, finalized by the U.K. Nov. 29, permits the U.K. government to issue notices requiring telecommunications operators to retain user data, including their web browsing histories, and to disclose it to law enforcement agencies.

Data Retention Dilemmas

In the light of the invalidation of the EU Data Retention Directive, the U.K. High Court in July 2015 found that DRIPA was out of step with privacy protections in EU law, in particular by failing to provide “clear and precise rules” on when internet and telecommunications data could be accessed by law enforcement agencies.

The British government appealed the ruling and the case was referred to the ECJ for a judgment on whether DRIPA is consistent with EU privacy rights.

In parallel, the Stockholm Administrative Appeals Court in Sweden asked the ECJ in May 2015 for a preliminary ruling in a case concerning Stockholm-based telecommunications carrier Tele2 Sverige AB, which said it would delete customer data it had been required to retain under the Swedish law implementing the EU Data Retention Directive.

Preliminary Opinion

In a July advisory opinion on the DRIPA/Tele2 cases, ECJ Advocate General Henrik Saugmandsgaardoe said that despite the invalidation of the Data Retention Directive, EU countries could in principle adopt data retention laws, as long as they are in line with data protection and privacy rights.

This would mean that retained data should only be accessed to combat serious crime, that it should only be used when strictly necessary and when other measures had proved ineffective. In addition, use of data should be proportionate and respect privacy safeguards on retention periods and access rules, according to the advisory ruling.

The ECJ isn’t bound to follow the advisory opinion, although in most cases ECJ judgments echo Advocate General opinions.

U.K. Revision of Retention Law?

Woods said that an ECJ judgment that broadly follows the advisory opinion might “mean someone might have grounds for a judicial review action” against the U.K. Investigatory Powers Act.

Although it is the act’s predecessor, DRIPA, which is the subject of the case, the Investigatory Powers Act “bears a remarkable similarity to DRIPA,” Woods said. It could “subsequently be hard for a court to distinguish arguments undermining the validity of DRIPA from those relating to at least part” of the Investigatory Powers Act, she said.

Andrew Murray, a law professor at the London School of Economics, told Bloomberg BNA Dec. 15 that the ECJ ruling would likely emphasize that access to retained data should be proportionate and it was “hard to see” how the Investigatory Powers Act “would withstand a proportionality challenge.”

Graham Smith, a partner with Bird & Bird LLP in London, told Bloomberg BNA Dec. 15 that a ECJ ruling that follows the Advocate General’s advice could, in particular, push the U.K. government to review the Investigatory Powers Act in terms of the grounds on which data access requests would be allowed, and the procedures on independent prior authorization for access to retained data.

The court should clarify the framework within which EU countries can adopt data retention laws while respecting privacy rights, and “hopefully the ECJ will bring more certainty rather than creating more uncertainty,” Smith said.

Brexit Looms

Murray said that “there’s a Brexit framework in the background as well.”

If the U.K. “were to continue to apply the provisions of the Investigatory Powers Act against a negative judgment” from the ECJ, the U.K. could be in “exactly the same position” post-Brexit as the U.S. was over the invalidated EU-U.S. Safe Harbor data transfer framework, Murray said.

In a case brought by Austrian privacy activist Max Schrems, the ECJ in October 2015 annulled the Safe Harbor, in part on the grounds that the personal data of EU citizens transferred to the U.S. wasn’t sufficiently safeguarded against government access requests. Safe Harbor has since been replaced by the EU-U.S. Privacy Shield, which itself is the subject of challenges before the ECJ.

The U.K. has said it will implement in full the new EU privacy regime, the EU General Data Protection Regulation, which takes full effect in May 2018—likely well ahead of the U.K.'s actual departure from the EU. But Murray said that a legal challenge could arise quickly questioning data transfers to the U.K. from remaining EU countries if the Investigatory Powers Act in its current form continues to be applied.

To contact the reporter on this story: Stephen Gardner in Brussels at correspondents@bna.com

To contact the editor responsible for this story: Donald Aplin at daplin@bna.com

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law Privacy and Data Security