Human Rights In Addition To National Information Retentivity Law: The Persuasion Inwards Tele Ii In Addition To Watson

Lorna Woods, Professor of Internet Law, University of Essex

Yesterday’s Advocate-General’s opinion concerns 2 references from national courts which both arose inwards the aftermath of the invalidation of the Data Retention Directive (Directive 2006/24) inwards Digital Rights Ireland dealing amongst whether the memory of communications information en masse complies amongst European Union law.  The inquiry is of import for the regimes that triggered the references, but inwards the background is a larger question: tin majority memory of information e'er existence human rights compliant. While the Advocate General clearly states this is possible, things may non live on that straightforward.

Background

Under the Privacy too Electronic Communications Directive (Directive 2002/58), European Union constabulary guarantees the confidentiality of communications transmitted via a world electronic communications network.  Article 1(3) of that Directive limits the plain of application of the directive to activities falling amongst the TFEU, thereby excluding matters covered past times Titles V too VI of the TEU at that fourth dimension (e.g. world security, defence, State security).  Even inside the reach of the directive, Article xv permits Member US to restrain the rights granted past times the directive

‘when such restriction constitutes a necessary, appropriate too proportionate mensurate inside a democratic guild to safeguard national security, defence, world security, too the prevention, investigation, detection too prosecution of criminal offences or of unauthorised exercise of the electronic system..’.

Specifically, Member US were permitted to legislate for the memory of communications information (ie details of communications but non the content of the communication) for the population generally. The subsequent Data Retention Directive specified mutual maximum periods of memory too safeguards, too was implemented (in certainly instances amongst approximately difficulty) past times the Member States.

Following the invalidation of the Data Retention Directive, the condition of Member State information memory laws was uncertain. This led both Tele2 too Watson (along amongst a Conservative MP, David Davis, who withdrew his yell when he became a cabinet minister) to challenge their respective national information memory regimes, essentially arguing that such regimes were incompatible amongst the standards fix downwards inwards Digital Rights Ireland. The Tele2 instance concerned the Swedish legislation which implemented the Data Retention Directive. The Watson instance concerned U.K. legislation which was implemented afterwards: the Data Retention too Investigatory Powers Act (DRIPA). Given this similarity, the cases were joined.

The Swedish reference asked whether traffic information memory laws that apply by too large are compatible amongst European Union law, too asked farther questions regarding the specifics of the Swedish regime. Watson et al asked 2 questions: whether the reasoning inwards Digital Rights Republic of Ireland laid downwards requirements that were applicable to a national regime; too whether Articles seven too 8 of the European Union Charter of Fundamental Rights (EUCFR) established stricter requirements than Article 8 of the European Convention on Human Rights (ECHR) – the right to private life. Although the latter instance concerns the UK, the Court’s volition soundless live on relevant if the U.K. leaves the European Union because the CJEU instance constabulary provides that non-Member States’ information protection constabulary must live on rattling similar to European Union information protection constabulary inwards monastic say to facilitate information flows (see Steve Peers’ give-and-take here).

Opinion of the Advocate General

The Advocate General dealt get-go amongst the inquiry close the reach of the protection nether the EUCFR.  This inquiry the Advocate General ruled as inadmissible because it was non relevant to resolving the dispute.  In so doing, he confirmed that the obligation inwards Article 52 EUCFR to read the rights granted past times the EUCFR inwards draw of piece of job amongst the interpretation of the ECHR provided a base of operations draw of piece of job too non a ceiling of protection.  The European Union could laissez passer on a higher degree of protection; indeed Article 52(3) EUCFR expressly allows for the possibility of ‘… Union constabulary providing to a greater extent than extensive protection’. 

Moreover, Article 8 EUCFR, inwards providing a specific right to information protection, is a right that has no direct equivalent inwards the ECHR; the Advocate General thence argued that the dominion of consistent interpretation inwards Article 52(3) EUCFR does non apply to Article 8 EUCFR (Opinion, para 79). Later inwards the Opinion, the Advocate General also dismissed the proffer that Digital Rights Ireland did non apply because the regime inwards number inwards Watson et al was a national regime too non i established past times the European Union legislature. Articles 7, 8 too 52 EUCFR were interpreted inwards Digital Rights Ireland too are i time again at number here: Digital Rights Ireland is thence relevant despite the dissimilar jurisdiction of the courtroom (paras 190-191).

The Advocate General too then went on to consider whether European Union constabulary permits Member US to constitute full general information memory regimes.  The get-go inquiry was whether Article 1(3) meant full general information memory regimes were excluded from the reach of Directive 2002/58 because the sole exercise of the information was for the purposes of national safety too other grounds mentioned inwards Art 1(3).  The Advocate General made iii points inwards response:

Given that Article 15(1) specifically envisaged information memory regimes, national laws establishing  such a regime were inwards fact implementing Article 15(1) (para 90).

The declaration the governments seat forwards was related to the access to the information past times world authorities, the national schemes concerned the acquisition too memory of that information past times private bodies – that the old mightiness prevarication exterior the directive did non imply that the latter also did (paras 92-94).

The approach of the Court inwards Ireland v Parliament too Council (Case C-301/06), which was a challenge to the Data Retention Directive as regards the Treaty provision on which it was enacted, meant that full general information memory obligations ‘do non autumn inside the sphere of criminal law’ (para 95).

The side past times side inquiry was whether Article xv of the Directive applied. The limited wording of Article 15, which refers to information retention, makes clear that information memory is non per se incompatible amongst Directive 2002/58. The intention was rather to brand whatever such measures dependent plain to certainly safeguards. This agency that information memory tin live on legal provided the scheme complies amongst the safeguards (para 108). Indeed, next his before reasoning, the Advocate General rejected the declaration that Article xv is a derogation too should thence live on read restrictively.

This brings us to the inquiry of whether sufficient safeguards are inwards place. Since the Advocate General took the see that inwards providing for full general information memory regimes the Member US are implementing Article 15, such measures autumn inside the reach of European Union constabulary too therefore, according to Article 51 EUCFR, the Charter applies, fifty-fifty if rules relating to access to the information past times the authorities prevarication exterior the reach of European Union constabulary (paras 122-23).  Nonetheless, given the unopen link betwixt access too retention, constraints on access are of significance inwards assessing the proportionality of the information memory regime.

Assessing compliance amongst the EUCFR requires as a get-go pace an interference amongst rights protected. The Advocate General referred to Digital Rights Ireland to pick out that ‘[g]eneral information memory obligations are inwards fact a serious interference’ amongst the rights to privacy (Art seven EUCFR) too to information protection (Art. 8 EUCFR) (para 128). Justification of whatever such interferences must satisfy both the requirements fix downwards inwards Article 15(1) Directive 2002/58 AND Article 52(1) EUCFR which sets out the circumstances inwards which a fellow member State may derogate from a right guaranteed past times the EUCFR (para 131). The Advocate General too then identified half dozen factors arising from these 2 obligations (para 132):

Legal ground for retention;

Observe the essence of the rights inwards the EUCFR (just Article 52 EUCFR, rather than Art xv of the directive);

Pursue an objective of full general interest;

Be appropriate for achieving that objective;

Be necessary to accomplish that objective; and

Be proportionate inside a democratic guild to the pursuit of the objective.

As regards the requirement for a legal ground the Advocate General argued that the ‘quality’ considerations that are found inwards the ECHR jurisprudence should live on expressly applied inside European Union constabulary too. They must conduct maintain the characteristics of accessibility, foreseeability too providing adequate protection against arbitrary interference, as good as existence binding on the relevant authorities (para 150). These factual assessments autumn to the national court. 

In the Opinion of the Advocate General, the ‘essence of the rights’ requirement – as understood inwards the low-cal of Digital Rights Ireland – was unproblematic. The information memory regime gave no access to the content of the communication too the information held was required to live on held securely. Influenza A virus subtype H5N1 full general involvement objective tin also easily live on shown: the struggle against serious criminal offence too protecting national security. The Advocate General, however, rejected the declaration that the struggle against non-serious criminal offence too the smoothen running of proceedings exterior the criminal context could constitute a world involvement objective. Likewise, information memory gives national authorities ‘an additional agency of investigation to forestall or shed low-cal on serious crime’ (para 177) too it is specifically useful inwards that full general measures laissez passer on the authorities the powerfulness to examine communications of persons of involvement which were carried out before they were so identified. They are thus appropriate.

A mensurate must live on necessary which agency that ‘no other mensurate exists that would live on as appropriate too less restrictive’ (Opinion, para 185). Further, according to Digital Rights Ireland, derogations too limitations on the right of privacy apply solely insofar as strictly necessary.  The get-go inquiry was whether a full general information memory regime tin e'er live on necessary. The Advocate General argued that Digital Rights Ireland solely ruled on a arrangement where insufficient safeguards were inwards place; at that topographic point is no actual declaration that a full general information memory scheme is non necessary. While the lack of differentiation was problematic inwards Digital Rights Ireland, the Court ‘did not, however, agree that that absence of differentiation meant that such obligations, inwards themselves, went beyond what was strictly necessary’ (Opinion, para 199).  The fact that the Court inwards Digital Rights Ireland examined the safeguards suggests that the Court did non see full general information memory regimes as per se unlawful. (see also Schrems (Case C-362/14), para 93, cited hither inwards para 203). On this ground the Advocate General opined:

a full general information memory obligation demand non invariably live on regarded as, inwards itself, going beyond the bounds of what is strictly necessary for the purposes of fighting serious crime. However, such an obligation volition invariably travel beyond the bounds of what is strictly necessary if it is non accompanied past times safeguards concerning access to the data, the memory menses too the protection too safety of the data. (para 205)

The comparing as to the effectiveness of this variety of mensurate amongst other measures must live on carried out inside the relevant national regime bearing inwards hear the possibility that generalised information memory gives of existence able to ‘examine the past’ (para 208). The essay to live on applied, however, is non i of utility but that no other mensurate or combination of measures tin live on as effective.

The inquiry is too then of safeguards too inwards exceptional whether the safeguards identified inwards paras 60-68 of Digital Rights Ireland are mandatory for all regimes. These rules concern:

Access to too exercise of retained information past times the relevant authorities;

The menses of information retention; and

The safety too protection of the information piece retained.

Contrary to the arguments seat forwards past times diverse governments, the Advocate General argued that ‘all the safeguards described past times the Court inwards paragraphs 60 to 68 of Digital Rights Ireland must live on regarded as mandatory’ (para 221, italics inwards original). Firstly, the Court made no lift of the possibility of compensating for a weakness inwards observe of i safeguard past times strengthening another. Further, such an approach would no longer laissez passer on guarantees to individuals to protect them from unauthorised access to too abuse of that data: each of the aspects identified needs to live on protected. Strict access controls too brusk memory periods are of niggling value if the safety pertaining to retained information is weak too that information is exposed. The Advocate General noted that the European Court of Human Rights inwards Szabo v Hungary emphasised the importance of these safeguards, citing Digital Rights Ireland.

While the Advocate General emphasised that it is for the national courts to brand that assessment, the next points were noted:

In observe of the purposes for which information is accessed, the national regimes are non sufficiently restricted (only the struggle against serious crime, non criminal offence inwards general, is a full general objective) (para 231)

There is no prior independent review (as required past times para 62 Digital Rights Ireland) which is needed because of the severity of the interference too the demand to bargain amongst sensitive cases (such as the legal profession) on a instance past times instance basis. The Advocate General did pick out that inwards approximately cases emergency procedures may live on acceptable (para 237).

The memory criteria must live on determined past times reference to objective criteria too limited to what is strictly necessary. In Zacharov, the European Court of Human Rights accepted half dozen months as existence reasonable but required that information live on deleted as shortly as it was non needed. This obligation to delete should live on found inwards national regimes too apply to the safety services as good as the service providers (para 243).

The in conclusion inquiry relates to proportionality, an appear which was non considered inwards Digital Rights Ireland.  The essay is:

‘a mensurate which interferes amongst primal rights may live on regarded as proportionate solely if the disadvantages caused are non disproportionate to the aims pursued’ (para 247).

This opens a debate close the importance of the values protected. In damage of the advantages of the system, these had been rehearsed inwards the give-and-take close necessity. As regards the disadvantages, the Advocate General referred to the Opinion inwards Digital Rights Ireland, paras 72-74 too noted that

‘in an private context, a full general information memory obligation volition facilitate as serious interference as targeted surveillance measures, including those which intercept the content of communications’ (para 254)

and it has the capacity to ship upon a large number of people. Given the number of requests for access received, the conduct chances of abuse is non theoretical.  While it falls to the national courts to residue the advantages too disadvantages, the Advocate General emphasised that fifty-fifty if a regime includes all the safeguards inwards Digital Rights Ireland, which should live on seen as the minimum, that regime could soundless live on found to live on disproportionate (para 262).

Comment

It is interesting that the Court of Appeal’s reference did non enquire the Court whether DRIPA was compliant amongst primal rights inwards the EUCFR. Rather, the questions sought to unopen off that possibility – firstly past times limiting the reach of the EUCFR to a exceptional invention of Article 8 ECHR too secondly past times seeking to process Digital Rights Republic of Ireland as a challenge to the validity of a directive as non relevant inside the national field.  Although the Advocate General did non response the get-go question, the reasons given for dismissing it brand clear that the Court of Appeal’s approach was wrong. Indeed, it is hard to encounter how Art 52(3) when read inwards its entirety could back upwards the declaration that the EUCFR should live on ‘read down’ to the degree of the ECHR. The entire text of Article 52(3) follows:

In so far as this Charter contains rights which lucifer to rights guaranteed past times the Convention for the Protection of Human Rights too Fundamental Freedoms, the important too reach of those rights shall live on the same as those set downwards past times the said Convention. This provision shall non forestall Union constabulary providing to a greater extent than extensive protection.

The focus of the minute inquiry was likewise misguided. As the Advocate General pointed out, Digital Rights Ireland was based on the interpretation of the important of 2 provisions of the EUCFR, Articles seven too 8.  They should conduct maintain the same important wherever they are applied.

Quite clearly, the Advocate General aims to avoid proverb that majority surveillance – hither inwards the shape of full general information protection rules – is per se incompatible amongst human rights. Indeed, i of the headline statements inwards the Opinion is that ‘a full general information memory obligation imposed past times a Member State may live on compatible amongst the primal rights enshrined inwards European Union law’ (para 7). The inquiry too then becomes close reviewing safeguards rather than proverb at that topographic point are approximately activities a fellow member State cannot ship out.  This debate is mutual inwards this area, as the instance constabulary of the European Court of Human Rights illustrates (see Szabo, peculiarly the dissenting opinion).

Fine distinction abound. For example, where the Advocate General relies on the distinction betwixt meta information too content to reaffirm that the essence of Article seven too 8 has non been undermined.  Yet piece the Advocate General tries hard to agree that full general information memory may live on possible, tensions creep in.  The betoken the Advocate General made inwards relation to the ‘essence of the right’ was based on the supposition that meta information collection is less intrusive than intercepting content.  In assessing the impact of a full general information protection regime, the Advocate General too then implies the contrary (paras 254-5). Indeed, the Advocate General quotes Advocate General Cruz Villalon inwards Digital Rights Ireland that such surveillance techniques allow the creation of:

‘a both faithful too exhaustive map of a large share of a person’s demeanour strictly forming purpose of his private life, or fifty-fifty a consummate too accurate motion painting of his private identity’.

The Advocate General hither concludes that:

‘the risks associated amongst access to communications information (or ‘metadata’) may live on as slap-up or fifty-fifty greater than those arising from access to the content of communications’ (para 259).

Another illustration relates to the reach of European Union law. The Advocate General separates access to the collected information (which is close policing too security) too the acquisition too storage of information which concerns the activities of private entities. The information memory regime concerns this latter grouping too their activities which autumn inside the reach of European Union law. In this the Advocate General is next the Court inwards the Irish Gaelic judicial review activeness challenging the legal ground of the Data Retention Directive (the resultant of which was that it was correctly based on Article 114 TFEU).  The Advocate General having separated these 2 aspects at the inquiry of reach of European Union law, too then glues them dorsum together to assess the acceptability of the safeguards.

In damage of safeguards, the Advocate General resoundingly reaffirms the requirements inwards Digital Rights Ireland.  All of the safeguards mentioned are mandatory minima, too weakness inwards i surface area of safeguards cannot live on offset past times strength inwards approximately other area. If the Court takes a similar line, this may conduct maintain repercussions for the relevant national regimes, for illustration as regards the demand for prior independent review (save inwards emergencies). Indeed, inwards this regard the Advocate General mightiness live on seen to going farther than either European Court has.  Further, the Advocate General restricts the purposes for which full general information memory may live on permitted to serious criminal offence solely (contrast here, for example, the approach to Internet connect records inwards the Investigatory Powers Bill currently before the U.K. Parliament). 

Another novelty is the give-and-take of lawfulness. As the Advocate General noted, at that topographic point has non been much limited give-and-take of this number past times the Court of Justice, though the requirement of lawfulness is good developed inwards the Strasbourg instance law. While this too then mightiness live on seen non to live on peculiarly novel or noteworthy, the Advocate General pointed out that the constabulary must live on binding too that therefore:

‘[i]t would non live on sufficient, for example, if the safeguards surrounding access to information were provided for inwards codes of do or internal guidelines having no binding effect’ (para 150)

Typically, much of the exceptional of surveillance do inwards the U.K. has been found inwards codes; as the safety forces’ diverse practices became world many of these conduct maintain been formalised as codes nether the relevant legislation (see e.g. s. 71 Regulation of Investigatory Powers Act; codes available here). Historically, however, non all were publicly available, binding documents.

While the headlines may focus on the fact that full general information memory may live on acceptable, too the in conclusion assessment of compliance amongst the half dozen requirements falls to the national courts, it seems that this is to a greater extent than a theoretical possibility than slowly reality. The Advocate General goes beyond endorsing the principles inwards Digital Rights Ireland: fifty-fifty regimes which satisfy the safeguards fix out inwards Digital Rights Ireland may soundless live on found to live on disproportionate. While Member US may non conduct maintain wanted to conduct maintain a checklist of safeguards imposed on them, hither fifty-fifty next that checklist may non suffice. Of course, this see is non binding; piece it is designed to inform the Court, the Court may come upwards to a dissimilar conclusion. The appointment of the judgment has non yet been scheduled.

Photo credit: choice.com.au

Barnard & Peers: chapter 9

JHA4: chapter II:7

Share this post