Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...
A soon-to-be-released data retention ruling from the European Union’s top court may have major implications for U.K. law in the context of Brexit, privacy analysts told Bloomberg BNA.
Telecommunications and internet service providers (ISPs) required to retain certain data to answer law enforcement and national security requests are particularly interested in how the court rules.
The European Court of Justice (ECJ) is scheduled to release Dec. 21 the data retention ruling on two joined cases relating to the data retention regimes in Sweden and the U.K. The cases concern the impact on national laws of the ECJ’s April 2014 invalidation of the EU Data Retention Directive (2006/24/EC).
The Data Retention Directive required telecoms and ISPs to retain certain customer personal data and communications data for up to two years and provide it to law enforcement agencies on request. The ECJ invalidated the law on the basis that it contained insufficient safeguards against indiscriminate bulk data collection.
The U.K. case before the ECJ concerns the predecessor to the Investigatory Powers Act, the U.K. Data Retention and Investigatory Powers Act 2014 (DRIPA), which is subject to a sunset clause and expires Dec. 31.
Lorna Woods, a professor in the U.K.’s University of Essex School of Law, told Bloomberg BNA that the repercussions of the case may be “far-reaching” for the U.K.’s Investigatory Powers Act. The law, finalized by the U.K. Nov. 29, permits the U.K. government to issue notices requiring telecommunications operators to retain user data, including their web browsing histories, and to disclose it to law enforcement agencies.
In the light of the invalidation of the EU Data Retention Directive, the U.K. High Court in July 2015 found that DRIPA was out of step with privacy protections in EU law, in particular by failing to provide “clear and precise rules” on when internet and telecommunications data could be accessed by law enforcement agencies.
The British government appealed the ruling and the case was referred to the ECJ for a judgment on whether DRIPA is consistent with EU privacy rights.
In parallel, the Stockholm Administrative Appeals Court in Sweden asked the ECJ in May 2015 for a preliminary ruling in a case concerning Stockholm-based telecommunications carrier Tele2 Sverige AB, which said it would delete customer data it had been required to retain under the Swedish law implementing the EU Data Retention Directive.
In a July advisory opinion on the DRIPA/Tele2 cases, ECJ Advocate General Henrik Saugmandsgaardoe said that despite the invalidation of the Data Retention Directive, EU countries could in principle adopt data retention laws, as long as they are in line with data protection and privacy rights.
This would mean that retained data should only be accessed to combat serious crime, that it should only be used when strictly necessary and when other measures had proved ineffective. In addition, use of data should be proportionate and respect privacy safeguards on retention periods and access rules, according to the advisory ruling.
The ECJ isn’t bound to follow the advisory opinion, although in most cases ECJ judgments echo Advocate General opinions.
Woods said that an ECJ judgment that broadly follows the advisory opinion might “mean someone might have grounds for a judicial review action” against the U.K. Investigatory Powers Act.
Although it is the act’s predecessor, DRIPA, which is the subject of the case, the Investigatory Powers Act “bears a remarkable similarity to DRIPA,” Woods said. It could “subsequently be hard for a court to distinguish arguments undermining the validity of DRIPA from those relating to at least part” of the Investigatory Powers Act, she said.
Andrew Murray, a law professor at the London School of Economics, told Bloomberg BNA Dec. 15 that the ECJ ruling would likely emphasize that access to retained data should be proportionate and it was “hard to see” how the Investigatory Powers Act “would withstand a proportionality challenge.”
Graham Smith, a partner with Bird & Bird LLP in London, told Bloomberg BNA Dec. 15 that a ECJ ruling that follows the Advocate General’s advice could, in particular, push the U.K. government to review the Investigatory Powers Act in terms of the grounds on which data access requests would be allowed, and the procedures on independent prior authorization for access to retained data.
The court should clarify the framework within which EU countries can adopt data retention laws while respecting privacy rights, and “hopefully the ECJ will bring more certainty rather than creating more uncertainty,” Smith said.
Murray said that “there’s a Brexit framework in the background as well.”
If the U.K. “were to continue to apply the provisions of the Investigatory Powers Act against a negative judgment” from the ECJ, the U.K. could be in “exactly the same position” post-Brexit as the U.S. was over the invalidated EU-U.S. Safe Harbor data transfer framework, Murray said.
In a case brought by Austrian privacy activist Max Schrems, the ECJ in October 2015 annulled the Safe Harbor, in part on the grounds that the personal data of EU citizens transferred to the U.S. wasn’t sufficiently safeguarded against government access requests. Safe Harbor has since been replaced by the EU-U.S. Privacy Shield, which itself is the subject of challenges before the ECJ.
The U.K. has said it will implement in full the new EU privacy regime, the EU General Data Protection Regulation, which takes full effect in May 2018—likely well ahead of the U.K.'s actual departure from the EU. But Murray said that a legal challenge could arise quickly questioning data transfers to the U.K. from remaining EU countries if the Investigatory Powers Act in its current form continues to be applied.
To contact the reporter on this story: Stephen Gardner in Brussels at firstname.lastname@example.org
To contact the editor responsible for this story: Donald Aplin at email@example.com
Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.
All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to firstname.lastname@example.org.
Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)
Notify me when updates are available (No standing order will be created).
This Bloomberg BNA report is available on standing order, which ensures you will all receive the latest edition. This report is updated annually and we will send you the latest edition once it has been published. By signing up for standing order you will never have to worry about the timeliness of the information you need. And, you may discontinue standing orders at any time by contacting us at 1.800.372.1033, option 5, or by sending us an email to email@example.com.
Put me on standing order
Notify me when new releases are available (no standing order will be created)