U.K. Finalizes Fast-Track Data Retention Legislation to Enable Fight Against Terrorism

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Ali Qassim    

July 18 --U.K. Internet and telecommunications companies will be required to hold customers' noncontent communications data and provide the data to law enforcement agencies upon request following the July 17 approval of the Data Retention and Investigatory Powers Act.

The act received royal assent--the signature of Queen Elizabeth II--less than two days after the legislation was introduced in the House of Commons.

The Home Office, which is responsible for combating crime and terrorism, said in a July 17 statement that it fast-tracked the act in response to an April European Court of Justice ruling that struck down regulations enabling communications service providers to retain communications data for law enforcement purposes for up to 12 months.

The ECJ ruled that the European Union's Data Retention Directive (2006/24/EC) contravenes the privacy rights of individuals and is therefore invalid (Digital Rights Ireland Ltd v. Minister for Commc'ns, Marine & Natural Res., No. C-293/12 (E.C.J. Apr. 8, 2014)) .

“If we had not acted immediately, investigations could have suddenly gone dark overnight,” Home Secretary Theresa May said in the Home Office statement. “Criminals and terrorists would have been able to go about their work unimpeded, and innocent lives would have been lost.”

Despite receiving cross-party support, a civil liberties group criticized the act for contravening individual rights and plans to challenge the government in court. In addition, a House of Lords committee charged with examining the legislation in a July 16 statement said the fast-tracking of the bill “is a matter of concern.”

New Act Provides Clarity

The Home Office said the new legislation provides a “clear” basis in U.K. law for the retention of communications data, which it described as the “who, when, where and how” of a communication, such as a telephone call or an e-mail, but not its content.

The government department said the act also clarifies that these obligations apply to anyone providing communications services to customers in the U.K. under Part 1 of the Regulation of Investigatory Powers Act 2000, irrespective of where those companies are based.

The Home Office underlined that the Data Retention and Investigatory Powers Act, which comes into effect immediately, only maintains the existing regime that the ECJ ruling struck down and doesn't create any new powers, rights of access or obligations on companies.

“The threats faced by the UK from terrorism and organized crime remain considerable and the government would have been negligent if it had not made sure the people and the organizations that keep us safe have the powers and capabilities they need,” May said in the Home Office statement.

Introducing New Safeguards

To strengthen transparency and oversight, the government said that it has introduced a two-year sunset clause in the act to ensure the legal framework is kept under review into the next Parliament, which begins May 2015. Before 2016, it will also hold a full review of the Regulation of Investigatory Powers Act to see how it could be reformed and updated.

The Home Office said it will establish a Privacy and Civil Liberties Oversight Board, based on the U.S. model, to ensure that civil liberties are properly considered in the formulation of government policy on counterterrorism.

The Home Office will also appoint a senior diplomat to lead discussions with overseas governments and communication service providers to assess and develop formal arrangements for the accessing of data in different jurisdictions for law enforcement and intelligence purposes.

The government said it will also restrict the number of public bodies that are able to approach phone and Internet companies and ask for communications data, while some entities will lose their powers to access data altogether.

In addition, the Home Office will publish annual transparency reports, making public more information on the way that surveillance powers operate.

Group to Challenge Act

In a July 18 blog post, nonprofit digital rights organization Open Rights Group said it plans to take the government to court.

According to the Open Rights Group, the court “will have the final say” on whether the Data Retention and Investigatory Powers Act breaches the U.K.’s international obligations, including the European Convention on Human Rights and the European Charter of Fundamental Rights, as well as its own Human Rights Act.

The House of Lords Constitution Committee pointed out in a July 16 statement that the government has had since early April to respond to the judgment but didn't reveal plans to introduce fast-track legislation until July 10.

To contact the reporter on this story: Ali Qassim in London at correspondents@bna.com

To contact the editor responsible for this story: Katie W. Johnson at kjohnson@bna.com

The Data Retention and Investigatory Powers Act, as approved by Parliament, is available at http://www.legislation.gov.uk/ukpga/2014/27/pdfs/ukpga_20140027_en.pdf.

Request Bloomberg Law Privacy and Data Security