Data Retentivity Is Withal Hither To Stay, For Now…
May 19, 2018
Edit
Matthew White, Ph.D candidate, Sheffield Hallam University.
Introduction
On xxx Jan 2018, human rights NGO Liberty tweeted that the:
This was inward reference to the Court of Appeal’s (CoA) judgment inward Tom Watson too Others v Secretary of State for the Home Department [2018] EWCA Civ 70 alongside regards to access to communications information nether the here) invalidated Directive 2006/24/EC (the Data Retention Directive (DRD)) for its incompatibility alongside Articles vii (privacy) too 8 (data protection) of the Charter of Fundamental Rights (CFR). This led to the introduction of DRIPA 2014, too subsequent challenges inward the High Court (HC) too CoA on its compatibility alongside Digital Rights Ireland, which ultimately led to a preliminary reference (joined past times a reference inward Tele2 from a Swedish Court) to the CJEU for clarification (analysis here). In Joined Cases C-203/15 too C-698/15, Tele2 too Watson the CJEU ruled that Articles 7, 8, xi (freedom of expression) too 52(1) (limitations of rights) preclude Member U.S. of A. from adopting laws which permit the full general too indiscriminate retentiveness ‘of all traffic too location information of all subscribers too registered users relating to all agency of electronic communication’ [134(1)]. The CJEU also ruled that the access to retained communications information should live bailiwick to prior review past times a courtroom or an independent administrative trunk too entirely on the ground of fighting serious law-breaking [134(2)].
Court of Appeal’s judgment
In the leading judgment, Lord Lloyd-Jones summarises the background to this instance [1-3] (also come across above), too chop-chop distinguishes betwixt the Swedish reference too its ain inward highlighting that the CJEU’s answers inward paragraph 134(2) too (3) reverberate their reference. His Lordship does so past times highlighting the divergence betwixt U.K. too Swedish legislation [4]. His Lordship also highlighted several developments since Tele2 too Watson, namely that DRIPA 2014 had been repealed too replaced past times the here) too the UK Government seeking to ameliorate the IPA 2016 to adapt alongside the CJEU’s ruling alongside regards to serious law-breaking too prior review for access past times a court/independent administrative trunk [6].
The inquiry earlier the CoA was over again DRIPA 2014’s compatibility alongside the CJEU’s rulings on information retentiveness [7]. Both parties too the CoA agreed that the CJEU’s jurisprudence establishes access to retained communications information is restricted to the objective of fighting serious law-breaking too that access should live bailiwick to prior review past times a court/independent administrative trunk [9]. The CoA declined to grant whatever declaratory relief alongside regards the CJEU’s rulings inward the national safety context equally this was already bailiwick to a preliminary reference past times the Investigatory Powers Tribunal (IPT) [10-12]. The CoA, did however, grant declaratory relief alongside regards to DRIPA 2014 for beingness inconsistent alongside European Union (EU) police line alongside regards to serious law-breaking too access to communications information [13].
With regards to information beingness retained inside the EU, the CoA declined to brand a definitive declaration on the promise that the CJEU volition clarify the thing alongside regards to the IPT’s reference [14-19]. Watson et al urged the CoA to declare that DRIPA 2014 had failed to brand provisions for ex post facto notifications [20]. The CoA, however, declined for iii reasons: a) it was non previously an number inward the national proceedings; b) it was non inward the CJEU’s ratio inward Tele2 too Watson; too c) the CJEU volition inward whatever lawsuit consider this based on the IPT’s reference.
On the number of the human relationship betwixt information to live retained, too the threat to world security, Lord Lloyd-Jones initially intended to grant declaratory relief on the grounds that DRIPA 2014 did non incorporate whatever limitations to comply alongside the CJEU’s ruling, but declined to create so [22-24]. Lord Lloyd-Jones recalled iii reasons equally to why this was justified:
First, it was non argued that DRIPA 2014 was unlawful because it did non require at that topographic point to live an identifiable world whose information was probable to let on direct or indirect links to serious crimes. The CJEU’s ruling on full general information retentiveness was inward response to the Swedish legislation. The High Court inward Davis too Others v Secretary of State for the Home Department too Others [2015] EWHC 2092 felt that the CJEU (in Digital Rights Ireland) could non receive got meant full general information retentiveness was unlawful, entirely that adequate safeguards had to live inward house for access.
Second, the CJEU’s reasoning on full general information retentiveness reflects Swedish law’s grab all (all services, information too users) information retention, too the analysis too conclusions cannot live automatically applied to DRIPA 2014. Third, this is a alive number which is pending for a Feb hearing.
Thus, the CoA unanimously held that DRIPA 2014 was inconsistent alongside European Union police line for non limiting information retentiveness for the purposes of fighting serious law-breaking too access to said information was non bailiwick to prior review past times an independent administrative trunk [27].
Was the Swedish Court’s inquiry on blanket indiscriminate information retentiveness non applicable inward the U.K. context?
This post has highlighted how throughout this judgment, the CoA consistently held that the prohibition of full general information retentiveness does non automatically apply to DRIPA 2014, because the reply from the CJEU was inward response to a reference from a Swedish courtroom bespeak well-nigh Swedish legislation. This premise acts on the supposition that DRIPA 2014 could non permit full general information retention. This requires closer scrutiny. It must commencement live noted, that when the CJEU made its ruling, it highlighted its ruling applied to national legislation, thus, reverse to what the CoA seem to suggest, this does non straight apply entirely to Sweden, but to all European Union Member U.S. of A. implementing information retentiveness legislation.
When the CJEU ruled that blanket indiscriminate information retentiveness of all services, all users too all information (catch all) was non permissible nether European Union law, I highlighted that this would receive got made a might found inside cl.1 of the draft Communications Data Bill (dCDB) unlawful (Matthew White, ‘Protection past times Judicial Oversight, or an Oversight inward Protection?’ (2017) Journal of Information Rights, Policy, too Practice 2:1, 24). This was due to the fact that cl.1 contained the same might that the Swedish reference was seeking to clarify, a grab all power.
Section 1(2)(a) too (b) of DRIPA 2014 too s.87(a) too (b) of the IPA 2016 must live considered together. Both sets of powers allowed or allows retentiveness notices to live issued on a (public) telecommunication operator or whatever description of operators to retain all information or whatever description of data. I had previously argued that Tele2 too Watson may show simple for such powers because at that topographic point was discretion on which telecommunication operators could live obligated to retain too what information they could retain (26). I farther pointed out, due to the CJEU’s insistence on geographical information retentiveness inward Tele2 too Watson [111] (which inward too of itself is problematic for human rights protection (36, 37)) it could live argued, the might to require retentiveness would non live based on operator, but past times location too therefore, could require a multifariousness of operators to retain inward a given expanse (26). These are the sorts of arguments I would assume could live invoked past times the Home Secretary if demand be.
However, I also noted that ‘it is soundless theoretically possible for all operators inward the U.K. to live required to retain all information of users too subscribers’ (26) because retentiveness notices apply to whatever description of operators to retain all or whatever description of data. This could live considered a full general obligation because it could impact all telecommunication operators too and so live classed equally a full general obligation. Lord Kerr inward his dissenting sentiment inward Beghal v Director of Public Prosecutions [2015] UKSC 49 noted that it ‘is the potential attain of the might rather than its actual utilisation past times which its legality must live judged [102].’ Instead of a grab all might similar cl.1 of the dCDB or Swedish law, the powers inward DRIPA 2014 too the IPA 2016 would be a might that tin grab all. When considering DRIPA 2014, the HC inward Davis too Others came to the same determination where they noted that:
Mr Eadie accepted that the final result of this policy opinion is that we should show the validity of DRIPA on the supposition that the retentiveness notices issued nether it may live equally wide inward range equally the statute permits, namely a direction to each CSP to retain all communications information for a menses of 12 months. The instance was argued on both sides on that basis. We shall refer inward this judgment to a organization nether which the State may require CSPs to retain all communications information for a menses equally a "general retentiveness regime" [65].
One could challenge this reasoning on concern human relationship of it matters non whether the contents of a retentiveness notice are known because it’s the might inward inquiry that is tested. This is exactly the seat of the European Court of Human Rights (ECtHR) alongside regards to cloak-and-dagger surveillance. In Roman Zakharov v Russia (ECHR, iv Dec 2015) the ECtHR’s Grand Chamber (GC) clarified its seat on when an private tin claim to live a victim of a violation nether Article 8 (private too theatre unit of measurement life, dwelling too correspondence) of the European Convention of Human Rights (ECHR). The GC maintained that an applicant tin claim to live a victim past times the mere existence of cloak-and-dagger surveillance measures for example, where ‘legislation straight affects all users of communication services past times instituting a organization where whatever somebody tin receive got his or her communications intercepted’ [171]. The GC continued that, when such surveillance cannot live verified, the menace of surveillance itself tin interfere alongside the Article 8 rights of all users too potential users [ibid]. In summary, the GC clarified its jurisprudence where it has been consistently ruled that it is what the police line permits that tin live bailiwick to challenge, non the actual utilisation of the police line (unless argued past times the applicants).
For the reasons highlighted above, it is argued that the CoA are playing semantics alongside the powers found inside Swedish legislation, too the powers found inside DRIPA 2014, equally they permit the same thing, namely all operators, information too users tin live affected past times information retention. Therefore, the CoA’s reliance on the CJEU’s seat on full general information retentiveness entirely applied to too reflected Swedish police line is untenable.
The CoA also relied upon the HC’s interpretation of Digital Rights Ireland inward Davis too Others that the CJEU ruled that full general information retentiveness would entirely live lawful if appropriate safeguards were inward place. This is ironic considering the CoA disagreed alongside this seat inward Secretary of State for the Home Department v Davis MP too Others [2015] EWCA Civ 1185 [90]. What is also striking, is that, unless the CoA receive got invented a TARDIS to preclude the CJEU’s judgment inward Tele2 too Watson from occurring, they seem to rely on the HC’s seat prior to Tele2 too Watson. Simply put, inward 2015, the HC did non believe the CJEU meant full general information retentiveness was unlawful inward too of itself, inward 2016, the CJEU said, ‘Yes, nosotros did, so nosotros shall say it again.’ Thus, for the CoA to rely on what is best described equally an outdated HC seat is at best, ignorant too at worst, disingenuous.
The terminal ground on role of the CoA is also unconvincing. They declined on the ground that Part iv of the IPA 2016 is nether challenge too thus would non live privy to evidence of both sides. This is despite the operational instance for information retentiveness beingness inward the public domain, too the counter arguments relatively slowly to find. The seat the CoA took allowed it to sidestep the existent issue, whether full general information retentiveness is compatible alongside human rights. General information retentiveness has never been compatible alongside human rights since at to the lowest degree 2008 when the ECtHR GC inward S too Marper App nos. 30562/04 too 30566/04 (ECHR, iv Dec 2008) ruled that full general information retention, fifty-fifty on a specific grouping of individuals (suspects too convicts) violated Article 8. Tele2 too Watson (despite its many flaws 24, 34-41) is just the side past times side logical pace alongside regards to communications data.
Prior Review past times a Court or Independent Administrative Body
The finding that DRIPA 2014 was inconsistent alongside European Union police line for non prescribing prior review past times a courtroom or an independent administrative trunk for access to communications information is to live welcomed. This is non a criticism of the CoA’s finding per se, but a criticism of the thought that this safeguard remedies the problems caused past times information retention. Part iv of the IPA 2016 allows retentiveness notices to live approved past times Judicial Commissioners (JC) nether s.89. This machinery has already been criticised because JC volition entirely deed based on the Secretary of State’s conclusions, at that topographic point is no obligation for the Secretary of State to brand a total too frank disclosure of their evidence for retentiveness (thus tin live misled), they tin entirely brand an assessment on judicial review principles (thus non a merit based or human rights review), nor are they institutionally independent from the Investigatory Powers Commission (IPC) (28-32).
Another work is that the JC tin authorise information retentiveness that tin grab all. As the GC inward Roman Zakharov noted:
[T]he implementation inward exercise of measures of cloak-and-dagger surveillance of communications is non opened upwards to scrutiny past times the individuals concerned or Earth at large, it would live reverse to the dominion of police line for the legal discretion granted to the executive or to a guess to live expressed inward price of an unfettered power [230].
The might to retain inward DRIPA 2014 too IPA 2016 are virtually unfettered, even if it applies to a unmarried telecommunication operator, too even if this might was authorised past times a guess (37-39). Essentially, giving a guess the might to authorise retentiveness or access would entirely live sufficient based on what they tin authorise to live retained or accessed. If this might is unfettered, it matters non if the guess increases the independence of the authorization process. Thus, despite the CoA’s finding, DRIPA 2014 would soundless live inward violation of fundamental rights.
Lack of notification was already incompatible alongside the European Convention on Human Rights
In declining to grant declaratory relief alongside regards to notification, it tin live argued that the CoA receive got failed nether their obligations nether s.6 of the Association for European Integration too Human Rights too Ekimdzhiev v Bulgaria App no. 62540/00 (ECHR, 28 June 2007) found that Bulgarian police line violated Article 8 too thirteen (effective remedy) for non having a notification system. The ECtHR noted that ‘as before long equally notification tin live made without jeopardising the purpose of the surveillance subsequently its termination, information should live provided to the persons concerned’ [90]. Boeham too de Hert annotation that the ‘clear recognition of an (active) notification duty subsequently surveillance measures receive got ended inward the Ekimdzhiev v. Bulgaria instance constitutes a remarkable evolution inward the framework of the safeguards against abuse which are necessary inward surveillance cases’ (Franziska Boehm too Paul de Hert, ‘Notification, an of import safeguard against the improper utilisation of surveillance - lastly recognized inward instance police line too European Union law’ (2012) 3:3 European Journal of Law too Technology).
The seat of the ECtHR was reaffirmed inward Roman Zakharov [287], but reference was made to U.K. police line inward that at that topographic point is an option to notification i.e. IPT jurisdiction [234, 288], however, I receive got previously referred to doubts raised past times Boehm too de Hert which is worth quoting inward full. Boehm too de Hert questioned whether U.K. police line was ‘capable of responding to the challenges arising out of the utilisation of novel surveillance techniques’ (Franziska Boehm too Paul de Hert, The rights of notification subsequently surveillance is over: ready for recognition? (Yearbook of the Digital Enlightenment Forum, IOS Press 2012), pp. 19-39, 37).
Boehm too de Hert travel along that inward calorie-free of powers such equally information retentiveness too ‘fishing expeditions’ that target a greater number of people without suspicion, a notification duty appears to live an effective tool to preclude abuse (ibid, 37-8). Finally, Boehm too de Hert annotation that the Belgian Constitutional Court has straightaway adopted the notification regulation equally a requirement to comply alongside Article 8 (ibid, 38).
Thus, whether or non CJEU requires notification, this justification tin live found inside the jurisprudence of the ECHR. Boehm too de Hert’s approach would live consistent alongside this jurisprudence of the ECHR inward price of it beingness a living musical instrument ‘which must live interpreted inward the calorie-free of present-day weather too of the ideas prevailing inward democratic [73]’ inward that volume surveillance would deprive the:
The IPA 2016 does incorporate a notification procedure nether s.231, but this is wholly inadequate equally it quite obviously admits, that a violation of the ECHR is non sufficient inward too of itself to justify a notification. This could live any ECHR right, non just a breach of privacy, information protection or liberty of expression, but the correct to life (Article 2), liberty from torture (Article 3) etc. This would homecoming s.231 at the really least, inward violation of Article 8 too 13 (39-40). Granted, this was non argued earlier the CoA, it remains that this was an chance where the CoA could receive got used existing instance police line to discovery that DRIPA 2014 had inward fact breached human rights, alongside or without whatever consideration for European Union police line too the principles laid out inward Tele2 too Watson.
Conclusions
In an amazing display of legal gymnastics, the CoA avoided the most cardinal number inward the information retentiveness debate, the compatibility of full general information retentiveness alongside fundamental rights. The CoA did so past times non acknowledging that DRIPA 2014 did too the IPA 2016 straightaway allows full general information retention. Instead, the CoA relied upon the semantics of distinguishing a grab all power, too a might that tin grab all, which of course, inward whatever event, amount to the same thing. In finding that DRIPA 2014 was entirely unlawful insofar equally it lacked prior review past times a court/independent administrative trunk to access communications information too that this was non restricted to serious law-breaking overlooks the cardinal number of this information beingness retained the commencement place. It is 1 thing the ensure greater independence alongside regards to the authorization of surveillance measures, but is just about other thing to overlook what those authorisations allow, whether it live the retentiveness or access of communications data. To create so would only smooth a turd, rather than even it, equally full general information retentiveness has ever been a turd that has needed flushing since at to the lowest degree 2008. Although the inquiry of information retentiveness inside the IPA 2016 is bailiwick to judicial review earlier the HC, the CoA had the chance to faithfully apply Tele2 too Watson to DRIPA 2014, but instead of addressing the issue, it acted equally though the number did non exist.
Barnard & Peers: chapter II:7
Art credit: Lightning Broadband