Phd Candidate Sheffield Hallam University

Data Retention incompatible amongst European Union law: Victory? Victory y'all say?

*Photo credit: https://www.beencrypted.com/  

Matthew White, PhD candidate Sheffield Hallam University

Introduction

On 27 Apr 2018, the High Court inwards Liberty v Secretary of State for the Home Department too Others Phrom scandal where BT, TalkTalk too Virgin Media made a bargain amongst Phorm to covertly intercept traffic of their customers. Whether it does or does non permit Phorm-like activities, is non the pressing number at hand, it’s the allowance of intercepted information to locomote retained (para 125, p1104) which would constitute a lawful purpose nether s.87(4)(d) of the IPA 2016. This highlights that the High Court’s focus on s.87(1) blinds them to the realities of communications information beingness just as, if non to a greater extent than serious than content, too inwards whatsoever event, content could locomote retained.

Appropriate remedy too the potential chaos that could ensue?

The High Court highlighted the dispute betwixt the Defendants too the Claimants equally to the appropriate remedy, where the old felt no to a greater extent than declaratory relief was necessary [32] because it was already conceded that elements of Part four were inconsistent amongst European Union police delineate [31], [38]. There was likewise a dispute equally to the stream of suspension should the High Court disapply Part four [32]. Despite this acknowledgment of the Defendants, they were of the seat that Part four should dice on equally it currently is until it is amended yesteryear Parliament [40-1]. The Claimants advocated for a suspended disapplication, this for the High Court:

[W]as a realistic too fair acknowledgement that, inwards this context, it cannot reasonably locomote expected that in that place should, immediately, locomote no legislation at all inwards house allowing retentiveness of information that is needed to apprehend criminals or forbid terrorist attacks [42].

The High Court noted that whatever remedy it granted, it should non have got the outcome of ‘immediately disapplying Part four of the 2016 Act, amongst the resultant chaos too harm to the populace involvement which that would undoubtedly campaign inwards this country’ [46]. The work of ‘chaos’ was inwards reference to the Defendants who argued that disapplication was a recipe for chaos [75].

Influenza A virus subtype H5N1 ground why the High Court preferred non to disapply Part four instantly was because in that place would locomote no information retentiveness laws inwards house to assistance inwards the contend against law-breaking too terrorism. This is non truly true, the Budapest or Cybercrime Convention has had legal forcefulness inwards the United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland since 1 September 2011. This mainly concerns crimes committed via estimator networks, but Article 14(2)(c) allows the United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland to adopt measures to collect evidence inwards electronic shape of a criminal offence. This does non appear to bound offences to those described inwards Articles 2-11. Moreover, Article xvi provides for information preservation, which is the option to information retention. This is non the exclusively selection available to the United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland equally discussed below. The High Court’s seat is essentially a strawman because immediate disapplication was non argued, too inwards whatsoever event, would non locomote truthful if Part four were to locomote disapplied.  

The High Court refers to ‘chaos’ too ‘damage’ to the populace involvement without explaining why too inwards what ways this would locomote possible yesteryear disapplying Part 4. The linguistic communication used yesteryear the High Court needs to locomote critically analysed. Prior to the [2015] EWHC 2092 (Admin) dispplied indecent haste inwards 3 days (Niklas Vainio too Samuli Miettinen, ‘Telecommunications information retentiveness afterwards Digital Rights Ireland: legislative too judicial reactions inwards the Member States’ (2015) International Journal of Law too Information Technology 23:3 290, 304).

Finally, the High Court refers to the ‘public interest’ without mentioning what aspects they mean. Is it the populace involvement inwards fighting serious law-breaking too stopping terrorism? Even if this is what the High Court meant, they did so without acknowledging that privacy inwards too of itself is a populace interest. This is specifically mentioned inwards s.2(2)(d) of the IPA 2016. Regan regards privacy equally having populace value because it is necessary to the proper functioning of a democratic political organisation (Priscilla M. Regan, ‘Legislating Privacy, Technology, Social Values too Public Policy’ (The University of North Carolina Press 1995). The so Labour Government fifty-fifty underpins liberty of expression, religion, idea too witting too assembly/association. Furthermore, privacy is not just an private right nor does information retentiveness just affects individuals. In Riddick v Board Mills Ltd [1977] QB 881, Lord Denning succinctly lay it that:

The memorandum was obtained yesteryear compulsion. Compulsion is an invasion of the private right to hold one’s documents to oneself. The populace involvement inwards privacy too confidence demands that this compulsion should non locomote pressed farther than the course of teaching of justice requires [p896].   

This acknowledges the populace involvement privacy serves, too to assume this exclusively applies to the objectives such equally fighting serious law-breaking too terrorism is to underestimate the primal nature too importance of privacy.

Not full general too indiscriminate information retention?

The High Court when considering whether Part four of the IPA 2016 permitted full general too indiscriminate information retentiveness referred to the Court of Appeal’s refusal inwards to apply Tom Watson too Others v Secretary of State for the Home Department [2018] EWCA Civ 70 [22-6]. The Court of Appeal’s reasoning remains unconvincing too their semantic reasoning indicates what they would have got held. The Claimants before the High Court argued that Part four permitted full general too indiscriminate information retention, too thus should locomote referred to the CJEU, notwithstanding the Defendants argued that reading the IPA 2016 equally a whole, this is non the instance [120].

The High Court towed the same line equally the Court of Appeal inwards Tom Watson too Others where they noted that the CJEU were specifically referring to Swedish police delineate [121]. The High Court so summarises their catch of the CJEU’s ruling noting that Member States:

[M]ay adopt legislation which permits decisions to locomote taken for the targeted retentiveness of information which is (a) sufficiently connected amongst the objective beingness pursued, (b) is strictly necessary too (c) proportionate [124].

The High Court were of the sentiment that CJEU’s judgment did non require to a greater extent than detailed factors which may locomote relevant equally to the application of those tests [124]. For the High Court, it would locomote impracticable too unnecessary to laid out inwards item inwards legislation the make of factors to locomote applied amongst matters such equally national security, populace security too serious law-breaking [124]. It must locomote noted that the number of national security is a affair that volition locomote dealt amongst yesteryear the CJEU based upon the Investigatory Powers Tribunal’s preliminary reference (analysis here).

Public safety, however, is non an objective that CJEU’s considers to locomote capable of justifying information retention, exclusively serious law-breaking [102], so it is unclear why the High Court fifty-fifty mentions this. The CJEU does refer to serious threats to populace security, but this is inwards regards to the links betwixt the stair out too objective evidence [111]. The High Court likewise does non explicate why it would locomote impracticable too unnecessary to laid out inwards item the make of factors to locomote applied, when the CJEU themselves observed that national police delineate must locomote clear too precise [109]. Not exclusively does this heighten issues amongst the European Union law, because the Part four does non render clear too precise rules (Jennifer Cobbe, ‘Casting the dragnet- communications information retentiveness nether the Investigatory Powers Act’ (2018) Public Law 10, 19), but likewise amongst the ECHR. The ECtHR have got ruled that it is essential to have got clear, binding [60] too detailed rules, peculiarly equally the technology scientific discipline available for work is continually becoming to a greater extent than sophisticated [229]. The ground for the ECtHR’s seat is explained inwards Szabo too Vissy v Hungary [2016] ECHR 579:

Given the technological advances since the Klass too Others case, the potential interferences amongst email, cellular telephone too Internet services equally good equally those of mass surveillance attract the Convention protection of private life fifty-fifty to a greater extent than acutely [53].

What the High Court regards equally unnecessary too impracticable are truly requirements of both European Courts, amongst the ECtHR taking that pace furthering inwards explaining why.

The High Court so notes that the combination of the compass too application of information retentiveness measures too the minimum safeguards are designed to attain effective protection against the opportunity of misuse of personal information [125]. Granted, the High Court are repeating points made yesteryear the CJEU [109], this approach overlooks what the ECtHR have got held:

The mere storing of information relating to the private life of an private amounts to an interference inside the pregnant of Article 8…The subsequent work of the stored information has no bearing on that finding [67].

The misuse of personal information is secondary to it truly beingness retained (and generated, reckon s.87(9)(b) of the IPA 2016). The High Court so distinguishes Swedish police delineate from the IPA 2016 inwards that it does non require a blanket requirement requiring the full general retentiveness of communications data, because it relies upon the discretion of the Secretary of State [127]. This has already been argued to locomote a semantic argument ‘of distinguishing a grab all power, too a ability that tin sack grab all, which of course, inwards whatsoever event, amount to the same thing.’ The High Court likewise relies on the description that the Secretary of State volition exclusively exercise this ability if it is considered necessary too proportionate, which for them, is inwards line amongst European Union police delineate [128]. But this seat betrays their previous reasoning on DRIPA 2014, which had the same requirements of necessity too proportionality [47], amongst both parties too the High Court accepting this permitted a ‘general retentiveness regime [65].’ Influenza A virus subtype H5N1 ground for this seat was because the contents of a retentiveness notice cannot locomote verified due to disclosure non beingness permitted, unless the Secretary of State permits it (see s.95(2)-(4) of the IPA 2016).

The High Court so argues that it would locomote hard to conceive how the tests of necessity too proportionality could require the retentiveness of all communications information due to the wording of ‘all data’ inwards the IPA 2016 [129]. This reasoning is problematic, because it relies upon the ‘surely the United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland would not?’ position. As Lord Kerr observed inwards Beghal v Director of Public Prosecutions [2015] UKSC 49 that ‘is the potential make of the ability rather than its actual work yesteryear which its legality must locomote judged [102].’ This is just why Cobbe argues:

Retention notices may locomote tailored to an extent, including yesteryear requiring that exclusively information which meets a sure description or is from a sure fourth dimension stream is retained. But s.87 does permit for ISPs to locomote required to retain "all data" indiscriminately, without differentiation, limitation, or exception, too without clear safeguards for information dependent area to professional person confidentiality (Jennifer Cobbe, reckon above, 19).

As others too myself have got argued, s.87(2)(a) too (b) theoretically allows for the possibility ‘all operators inwards the United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland to locomote required to retain all information of users too subscribers’ (Matthew White, ‘Protection yesteryear Judicial Oversight, or an Oversight inwards Protection?’ (2017) Journal of Information Rights, Policy, too Practice 2:1, 26) too should locomote treated equally a blanket too indiscriminate ability (Matthew White, reckon above, 25; Jennifer Cobbe, reckon above, 18; ; Andrew D. Murray, ‘Data transfers betwixt the European Union too United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland post Brexit?’ (2017) International Data Privacy Law 7:3 149, 161).

In Liberty v United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland [2008] ECHR 568 the so United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland Government accepted that s.3(2) of the Interception of Communications Act 1985 allowed:

[I]n principle, whatsoever mortal who sent or received whatsoever shape of telecommunication exterior the British Islands during the stream inwards query could have got had such a communication intercepted [64].

For the ECtHR, such a ability was almost unfettered [64], too violated Article 8 for non beingness inwards accordance amongst the police delineate [70]. Furthermore, the High Court’s reasoning acts on the supposition that the exclusively way Part four could locomote unlawful is if it did permit or made it possible for the retentiveness of all communications data. This is just non truthful equally seen inwards the instance of Liberty above, where this did non fifty-fifty concern communications inside the UK, moreover inwards due south too Marper [2008] ECHR 1581 the GC ‘ruled that full general information retention, fifty-fifty on a specific grouping of individuals (suspects too convicts) violated Article 8.’

The High Court so likewise incorrectly claims that s.87(2)(b) of the IPA 2016 relates to a ‘description of data’ too non just to ‘all data’ [129] when the actual words are ‘any description of data’ which just agency whatsoever and/or all information could locomote retained. The High Court makes the same error amongst regards to telecommunication operators inwards that a retentiveness notice may relate to a particular operator or to a description of operators [129] when, in i lawsuit again the operative give-and-take inwards s.87(2)(a) is whatsoever description of operators. The proposition hither is that if a retentiveness notice is issued on i telecommunication operator (because s.87(2) ‘list[s] the elements which may locomote used when delineating the content too compass of a retentiveness notice so equally to satisfy the necessity too proportionality tests inwards whatsoever particular instance [129]’, this would locomote alright. If i uses BT equally an example, amongst over nine 1000000 broadband subscribers, would a retentiveness notice on BT to retain all this communications information sit down good amongst the High Court? After all, BT is but i telecommunication operator, has a large subscriber base, but crucially non all of them, too the subscriber’s communications information does non amount to all the communications information that could locomote retained inwards the UK. In fairness, this is equally much of the CJEU’s job equally it is the High Court’s, equally this is where S too Marper makes a crucial distinction, that being, information retentiveness measures that are full general too indiscriminate inside a grouping tin sack silent locomote unlawful.

The High Court so refers to the 12-month retentiveness bound [130], but this exclusively serves to highlight the constant interference amongst primal rights equally retentiveness notices volition locomote renewed on a yearly basis. The High Court likewise refers to matters to which the Secretary of State must have got regard to inwards s.88(1) of the IPA 2016 such equally the benefits of the notice, number of users affected, costs etc too must likewise convey reasonable steps to consult the relevant telecommunication operator (see s.88(2)). Regarding the former, the Secretary of State could still number the intended retentiveness notice irrespective of what has been regarded, too amongst the latter, in that place is no obligation to truly consult a telecommunication operator.    

The High Court so refers to the Judicial Commissioner’s (JC) role inwards the approving of retentiveness notices based on the Secretary of State’s conclusions [133]. This is problematic because in that place ‘is no obligation on the Secretary of State to brand a total too frank disclosure too therefore, the JC too IPC could locomote misled (accidently or deliberately) (30)’ too could ‘be given a summary a summary of a summary of a summary of a summary of the master intelligence instance (30-1).’ The GC have got noted that it is essential that the supervisory trunk has ‘access to all relevant documents, including unopen materials too that all those involved inwards interception activities have got a duty to expose to it whatsoever textile it required [281].’ This is currently non possible nether the IPA 2016. The High Court so refers to the JC’s applying principles of judicial review to authorisations [133]. The query equally to whether the Wednesbury principles would apply has been dependent area to debate (29), but the Investigatory Powers Commissioner (IPC) themselves have got noted that when human rights issues arise, the necessity too proportionality tests of the ECHR too European Union police delineate volition locomote applied instead of Wednesbury (para 17, 19). However, this declaration is exclusively advisory too admits it is non binding (para 1), thus is non a existent safeguard.

The High Court so refers to the JC’s full general duties nether s.2 of the IPA 2016 [133]. The showtime of which concerns the JC having regard to whether in that place are less intrusive measures to attain the objective. There is, information preservation, but this isn’t inwards the IPA 2016 (unless i considers s.61 to locomote shape of information preservation). The minute concerns the grade of protection to sensitive information, which is much narrower than sensitive personal information inwards information projection instruments equally it exclusively includes legally privileged material, journalistic sources, communications amongst Members of Parliament etc. The JC’s cannot have got regard to sensitive information because equally the Bar Council too Law Society have got highlighted that the job mass communications information retentiveness is that it does non forbid legally privileged information from entering the ‘pool’ inwards the showtime house (para 32). With regards to journalistic sources, United Nations Educational, Scientific too Cultural Organization (UNESCO) noted that fifty-fifty when journalists encrypt the content, they may fail to encrypt the communications information which agency they silent leave of absence behind a digital trail when they communicate amongst their sources, making them identifiable (26).

The High Court so refers to the fact that a telecommunication operator tin sack refer a retentiveness notice dorsum to the Secretary of State, which in i lawsuit again would require approving yesteryear the IPC [134]. And if the IPC approves a notice on BT to retain all the communications information of their subscribers, so what? The High Court summarises Part four yesteryear noting that they ‘do non call upward it could perchance locomote said that the legislation requires, or fifty-fifty permits, a’ full general retentiveness regime [135]. However, it was never the declaration that the IPA 2016 requires a full general retentiveness regime, but that it permits the Secretary of State too JC to require a full general retentiveness regime. As the ECtHR have got maintained ‘it would locomote opposite to the dominion of police delineate for the discretion granted to the executive or to a judge to locomote expressed inwards price of an unfettered ability [230].’ The query is non ‘will they’ but ‘can they.’

The High Court continues that Part four too s.2 requires a make of factors to locomote taken into line of piece of work concern human relationship before a retentiveness notice is issued [135]. Although it was already argued that ‘catch all’ ability is non necessary for Part four to locomote deemed unlawful, it is useful to play Devil’s Advocate. Can the Secretary of State number a retentiveness notice on all telecommunication operators to retain all communications information if they deem it necessary too proportionate? Can a JC approve this? Can this silent locomote the instance if the telecommunication operator refers this dorsum to the Secretary of State dependent area to approving yesteryear the IPC? If the answer is yes, so this highlights that all the factors that the High Court refers to does non modify the functioning of the ability itself. If the answer is no, so the High Court is ignoring the glaringly obvious implications of a ability that tin sack locomote applied to all or whatsoever telecommunication operator to retain whatsoever or all communications data.

The High Court so puts its previous judgment to i side (where they agreed DRIPA 2014 permitted a full general retentiveness regime) yesteryear arguing that:

Even if that supposition were to locomote applied inwards this case, it is evidently from the analysis laid out above, that the 2016 Act does non permit the full general too indiscriminate retentiveness of communications data. In whatsoever event, nosotros would add together that the number of whether a United Kingdom of Great Britain too Northern Ireland of Britain too Northern Republic of Ireland enactment is inconsistent amongst European Union legislation is non to locomote determined yesteryear evidence from either political party equally to how the domestic scheme is operated inwards exercise or mightiness locomote operated. Instead, the number is an objective query of police delineate which turns on the proper interpretation of the 2 pieces of legislation [136]. 

Essentially, the High Court are saying, fifty-fifty if the previous judgment was correct, IPA 2016 is somehow different, despite the wording of the ability inwards DRIPA 2014 beingness identical. In amazing fashion, the High Court decided that it does non truly affair how the police delineate is or mightiness locomote operated, but relies upon the notion of an ‘objection query of law’ too how it is interpreted. And this is why ignoring the ECHR, if it was non made clear inwards a higher house is problematic because the ECtHR have got consistently held that:

[T]hat the mere existence of laws too practices which permitted too established a organisation for effecting hugger-mugger surveillance of communications entailed a threat of surveillance for all those to whom the legislation mightiness locomote applied. This threat necessarily affected liberty of communication betwixt users of the telecommunication services too thereby amounted inwards itself to an interference amongst the exercise of the applicants’ rights nether Article 8, irrespective of whatsoever measures truly taken against them [168].

The High Court’s seat is inwards contrast to the seat of the ECtHR inwards that hugger-mugger surveillance tin sack locomote judged in abstracto or where an private tin sack claim to truly locomote dependent area of a surveillance measure. All that is required is that i is able to show that they are ‘potentially at opportunity of beingness subjected to such measures [171].’ Whether retentiveness notices apply to all telecommunication operators to retain all communications data, or to i telecommunication operator to retain all (or fifty-fifty some) communications data, this allows for the ‘automatic storage for six months of clearly irrelevant data’ too ‘ cannot locomote considered justified nether Article 8 [255].’ Even 6 months is unacceptable to the ECtHR (which raises serious questions equally to the 12-month retentiveness limit), this seat is strengthened yesteryear Advocate General Øe, who noted that:

The disadvantages of full general information retentiveness obligations arise from the fact that the vast bulk of the information retained volition relate to persons who volition never locomote connected inwards whatsoever way amongst serious law-breaking [252].

Conclusion

This weblog post has highlighted many flaws inwards the approach of the High Court amongst regards information retention. Part four of the IPA 2016 is neither consistent amongst the ECHR or European Union law. The High Court have got fallen into the same trap equally the Court of Appeal did before this yr when distinguishing a grab all power, too a ability that tin sack grab all. This post exclusively partially deals amongst the judgment equally the aspects of entity information too serious law-breaking deserve posts of their own. What is just equally disappointing equally this judgment is the claim that it was a landmark victory, when inwards actual fact, the rulings against the Defendants were concessions they already made, leaving the crucial aspect of Part four unscathed. Influenza A virus subtype H5N1 wise trivial dark-green human mightiness say ‘Victory? Victory y'all say? Master Liberty, non victory. The enshroud of information retentiveness persists. Continue the mass surveillance will.’

Share this post