Saturday 12 April 2014

ECJ strikes down Data Retention Directive


[PREFACE - United States]

On December 16 2013 the Federal District Court of the District of Columbia Judge Richard Leon ruled that NSA spying was likely to be unconstitutional. He called it "almost Orwellian".

On December 28 2013 in ACLU v. James Clapper, US District Judge William Pauley diverged from a ruling by Judge Richard Leon that questioned the NSA's constitutionality. He called it a counter-punch to terrorism. He raising the prospect that the Supreme Court will need to resolve the issue.


Europe

Europe has struck down the Data Retention Directive (Directive 2006/24/EC). A European law, made in 2006, that required telecommunications firms to collect and store data (locations, calls, texts and emails.) for at least six months and up to two years. Europe's highest court, the ECJ, heard the case after requests from Irish and Austrian courts.

The ECJ declared the law "invalid" and in contravention of the EU Charter of Fundamental Rights. The law violated two basic rights:

One, respect for private life.

Two, protection of personal data.

The court said:
"It interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data."
The Luxembourg court said the law allowed for the collection of "very precise information on private lives." TJ McIntyre (@TJMcIntyre), chairman of Digital Rights Ireland, welcomed the judgement and said:
"This is the first assessment of mass surveillance by a supreme court since the Snowden revelations. The ECJ’s judgement finds that untargeted monitoring of the entire population is unacceptable in a democratic society."
To conform with the judgement the 28-nation EU is now drafting a new data protection legislation. The European Commission is now considering the issue and should publish guidance for Member States.

You would think laws would become invalid across the EU-28. However this is not an automatic effect from the annulment judgment. There is no clear guidance from the EC Treaties nor the precedent of the European court. According to Article 249 of the Treaty:
"A directive shall be binding, as to the result to be achieved, upon each Member State to which it is addressed, but shall leave to the national authorities the choice of form and methods”.
When it comes to the annulment of a directive, it is up to the Member State to formulate a the process. Since there is no automatic effect on national legislation, it is to be a case-by-case evaluation. According to the LSE Media Policy Project blog, in the present case Member States seem to havetwo choices:
  1. Abrogating the entire national data retention legislation
  2. Modify that legislation in order to meet the “proportionality concern” of the court.




Digital Rights Ireland can now continue its case against Ireland's data-retention legislation that requires phone companies and internet service providers to gather data.

The British government remains belligerent. A spokesman said: "We cannot be in a position where service providers are unable to retain this data."

The judgement has also hit UK plans for a "snooper's charter" that would allow the government to order internet service providers and phone companies to collect and store data for up to two years.

The judgement confirms the argument that mass data retention breaches our rights to privacy and protection of personal data. The judgements shows that we need, and urgently, and as I said previously here, an open and robust debate on where the balance should fall between privacy and national security. As David Allen Green said, the UK has become a national security and surveillance state.

The judgement also boads well for the ORG’s legal challenge to UK government surveillance at the European Court of Human Rights. Following this judgement any new government legislation must limit surveillance to what is necessary for investigation, rather than permit mass data collection across everyone’s communications.



- Judgement summary here.
- Original Directive 2006/24/EC here
- Digital Rights Ireland preface to judgement here. Digital Rights Ireland response to judgement here.
- Irish Times report here.
- BBC report here.
- Guardian here.

No comments:

Post a Comment