Data Retentivity As Well As National Law: The Ecj Ruling Inwards Joined Cases C-203/15 As Well As C-698/15 Tele2 As Well As Watson (Grand Chamber)

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

Today's judgment in these of import cases concerns the acceptability from a human rights perspective of national information retentiveness legislation maintained fifty-fifty afterwards the hitting downwardly of the Data Retention Directive inwards Digital Rights Ireland (Case C-293/12 as well as 594/12) (“DRI”) for beingness a disproportionate interference amongst the rights contained inwards Articles vii as well as 8 European Union Charter of Fundamental Rights (EUCFR).  While situated inwards the context of the Privacy as well as Electronic Communications Directive (Directive 2002/58), the judgment sets downwardly principles regarding the interpretation of Articles vii as well as 8 EUCFR which volition hold out applicable to a greater extent than ofttimes than non inside the ambit of European Union law. It also has possible implications for the UK’s post-Brexit human relationship amongst the EU.

Background as well as Facts

The Privacy as well as Electronic Communications Directive requires the confidentiality of communications, including the information almost communications to hold out ensured through national law. As an exception it permits, nether Article 15, Member United States of America to convey measures for sure world involvement objectives such every bit the contend against terrorism as well as crime, which include requiring world electronic communications service providers to retain information almost communications activity. Member United States of America took real different approaches, which led to the enactment of the Data Retention Directive (Directive 2006/24) inside the infinite for Member State activity envisaged past times Article 15.  With that directive struck down, Article xv remained the governing provision for exceptions to communications confidentiality inside the land harmonised past times the Privacy as well as Electronic Communications Directive.  This left questions every bit to what activity inwards honour of requiring the retentiveness of information could hold out permissible nether Article 15, every bit understood inwards the low-cal of the EUCFR.

The cases inwards today’s judgment derive from 2 split national regimes. The first, concerning Tele2, arose when – next the DRI judgment – Tele2 proposed to halt retaining the information specified nether Swedish implementing legislation inwards relation to the Data Retention Directive. The minute arose from a challenge to the Zakharov, the Court specified:

access can, every bit a full general rule, hold out granted, inwards relation to the objective of fighting crime, only to the information of individuals suspected of planning, committing or having committed a serious criminal offence or of beingness implicated inwards i means or some other inwards such a criminal offence [para 119].

It as well as so distinguished the full general contend against criminal offence from the contend against terrorism to suggest that inwards the latter case:

access to the information of other persons mightiness also hold out granted where in that place is objective bear witness from which it tin hold out deduced that that information might, inwards a specific case, brand an effective contribution to combating such activities [para 119].

The atmospheric condition laid downwardly must hold out respected. The Court hence held that, relieve inwards cases of genuine emergency, prior review past times an independent torso must hold out carried out on the ground of a reasoned asking past times the investigating bodies. In making this point, the Court referred to the ECtHR judgment inwards Szabó as well as Vissy v. Hungary, every bit good every bit its ain previous ruling inwards DRI. Furthermore, in i lawsuit in that place was no danger to the investigation past times so doing, individuals affected should hold out notified, so every bit to those affected people the possibility to practise their correct to a remedy every bit specified inwards Article 15(2) read amongst Article 22 of the Data Protection Directive (Directive 95/46).

Article 15(1) permits derogation only inwards relation to specified provisions inwards the directive; it does non allow derogation amongst regard to the safety obligations contained inwards Article 4(1) as well as 4(1a). the Court noted the quantity of information every bit good every bit its sensitivity to suggest that a high degree of safety measures would hold out required on the business office of the electronic communications providers. Following this, the Court as well as so stated:

…, the national legislation must brand provision for the information to hold out retained inside the European Union as well as for the irreversible devastation of the information at the halt of the information retentiveness menstruum (see, past times analogy, inwards relation to Directive 2006/24, the Digital Rights judgment, paragraphs 66 to 68) [para 122].

The Court noted that every bit a split obligation from the approving of access to data, that United States of America should ensure that independent review of compliance amongst the required regulatory framework was carried out past times an independent body. In the sentiment of the Court, this followed from Article 8(3) EUCFR. This is an essential chemical factor of individuals’ powerfulness to brand claims inwards honour of infringements of their information protection rights, every bit noted previously inwards DRI as well as Schrems. 

The Court as well as so summarised the final result of this reasoning, that Article xv as well as the EUCFR:

must hold out interpreted every bit precluding national legislation governing the protection as well as safety of traffic as well as place information and, inwards particular, access of the competent national regime to the retained data, where the objective pursued past times that access, inwards the context of fighting crime, is non restricted entirely to fighting serious crime, where access is non land of written report to prior review past times a courtroom or an independent administrative authority, as well as where in that place is no requirement that the information concerned should hold out retained inside the European Union. [para 125]

Relationship betwixt the EUCFR, European Union constabulary as well as the ECHR

The English linguistic communication Court of Appeal had referred a enquiry almost the impact of the ECHR on the ambit of the EUCFR inwards the low-cal of Article 52 EUCFR. While the Court declared the enquiry inadmissible, it –like the Advocate General – took the fourth dimension to indicate out that the ECHR is non business office of European Union law, so the key number is the ambit of the EUCFR; as well as inwards whatsoever lawsuit Article 52(3) does non prevent Union constabulary from providing protection that is to a greater extent than extensive than the ECHR. As a farther point, the Court added that Article 8 EUCFR, which provides a split correct to information protection, does non receive got an exact equivalent inwards the ECHR as well as that in that place is hence a divergence betwixt the 2 regimes.

Comment

Given the tendency of recent representative law, the final result inwards this representative is non surprising.  There are some points that are worth emphasising.

The starting fourth dimension relates to the ambit of European Union law, which is a threshold barrier to whatsoever claim based on the EUCFR.  The Advocate General seemed prepared to convey a distinction betwixt the retentiveness of information as well as the access thereto (although atmospheric condition relating to the latter could demeanour on the proportionality of the former).  The Court took a different approach as well as held that the access also roughshod inside the ambit of the Directive/EU law, because the national regime imposed an obligation on the communications service provider to render access to the relevant authorities. Given this was an obligation on the service provider, it roughshod inside the regulatory schema.  This approach thus avoids the slightly unconvincing reasoning which the Advocate General adopted.  It also perhaps enlarges the ambit of European Union law.

In full general terms, the Court’s reasoning looks at sure provisions of the Privacy as well as Electronic Communications Directive.  While the reasoning is laid inwards that context, it does non hateful that the Court’s interpretation of the requirements deriving from the EUCFR is limited only to this laid of surveillance measures.  The rules of interpretation of peculiarly Articles vii as well as 8 could apply to a greater extent than to a greater extent ofttimes than non – perhaps to PNR information (another shape of majority surveillance) - as well as beyond.  It is also worth noting that according to a leaked Commission document, it is proposed to extend the ambit of the Privacy as well as Electronic Communications Directive to other communications service providers non currently regulated past times the directive, but who may hold out land of written report to some information retentiveness requirements already.

Whilst the Court makes the indicate that Articles vii as well as 8 EUCFR are split as well as different, as well as that information retentiveness implicates also Article eleven EUCFR, inwards its analysis of the impact of national measures providing for retentiveness it does non bargain amongst Articles vii as well as 8 separately (contrast DRI where a limited consideration was given to this). Having flagged Article eleven EUCFR, it takes that analysis no further.  This is the leaves questions every bit to the ambit of the rights, as well as peculiarly how Article eleven issues play out.

Note that the Court does non nation that information retentiveness itself is impermissible; indeed, it specifies circumstances when information retentiveness would hold out acceptable. It challenges the compatibility of majority information retentiveness amongst Articles vii as well as 8 EUCFR, however, fifty-fifty inwards the context of the contend against terrorism.  In this, it is arguable that the Court has taken a tougher opinion than its Advocate General on this indicate of principle.  In this nosotros meet a mirror of the approach inwards DRI, when the Court took a different approach to its Advocate General.  In that representative too, the Advocate General focussed on safeguards as well as the character of law, every bit has the Advocate General here. For the Court here, differentiation – betwixt people as well as betwixt types of offences as well as threats – based on objective, evidenced grounds is primal to showing that national measures are proportionate as well as no to a greater extent than than – inwards the damage of the directive – strictly necessary. This seems to become about disagreeing amongst the Opinion of the Advocate General that inwards DRI, the Court ‘did not, however, handgrip that that absence of differentiation meant that such obligations, inwards themselves, went beyond what was strictly necessary’ (Opinion, para 199). The Advocate General used this indicate to debate that DRI did non suggest that majority surveillance was per se unlawful (see Opinion, para 205). Certainly, inwards neither representative did the Court expressly handgrip that majority surveillance was per so unlawful, so the enquiry soundless remains. What is clear, however, is that the Court supports the retentiveness of information next justified suspicion – fifty-fifty perhaps generalised suspicion – rather than using the analysis of retained information to justify suspicion.

In its reasoning, the Court did non –unlike the Advocate General – specifically brand a ruling on whether or non the safeguards laid downwardly inwards DRI, paras 60-68, should hold out seen every bit mandatory – inwards upshot creating a half-dozen indicate depository fiscal establishment jibe list. Nonetheless, it repeatedly cited DRI approvingly. Within this framework, it highlighted specific aspects – such every bit the need for prior approval; the need for safety as well as command over data; a prohibition on transferring information exterior the EU; the need for subjects to hold out able to practise their correct to a remedy. Some of these points volition hold out hard to reconcile amongst the electrical flow regime inwards the United Kingdom regarding communications data.

It did not, however, touching on acceptable periods for retentiveness (even though it – similar its Advocate General – referred to Zakharov). More generally, the Court’s analysis – past times comparing amongst that of the Advocate General – was less detailed as well as structured, peculiarly almost the pregnant of necessity as well as proportionality. It did non straight address the points the Advocate General made almost lawfulness, amongst specific reference to reliance on codes (an essential characteristic of the United Kingdom arrangements); it did inwards passing depository fiscal establishment complaint that the atmospheric condition for access to information should hold out binding inside the domestic legal system. Is this implicit understanding amongst the Advocate General on this point? It sure enough agreed amongst him that the seriousness of the interference meant that information retentiveness of communications information should hold out restricted to ‘serious crime’ as well as non simply whatsoever crime.

One terminal number relates to the judicial human relationship betwixt Strasbourg as well as Luxembourg.  Despite emphasising that the ECHR is non business office of European Union law, the Court relies on 2 recent cases from the ECtHR, perhaps seeking to emphasis the consistency inwards this expanse betwixt the 2 courts – or perhaps seeking to seat line per unit of measurement area on Strasbourg to handgrip the business every bit it faces a number of nation surveillance cases on its ain docket, many against the UK. The seat of Strasbourg is important for the UK. While many assume that the United Kingdom volition keep the GDPR afterwards Brexit inwards the interests of ensuring equivalence, it could hold out that the EUCFR volition no longer hold out applicable inwards the United Kingdom post-Brexit. For United Kingdom citizens, the ECHR as well as so is the only road to challenge nation intrusion into privacy. For those inwards the EU, information transfers to the United Kingdom post-Brexit could hold out challenged on the ground that the UK’s constabulary is non sufficiently adequate compared to European Union standards. Today’s ruling – as well as the UK’s reply to it, if whatsoever – could hold out a important chemical factor inwards contention that issue.

Barnard & Peers: chapter 9

Photo credit: www.cio.com.au

Share this post