The Information Retentivity Judgment: The Cjeu Prohibits Volume Surveillance

Steve Peers

On July 7, 2005 a relative of mine started her journeying to run on a London subway train. Within one-half an hour, bombs on that develop left yesteryear terrorists exploded, inwards conjunction amongst 3 other bombs across London. Dozens of people died (although my relative was non injured).

Understandably, world concern nearly terrorist incidents, next on from the before outrages of 9/11 together with the Madrid bombings, led to farther European Union anti-terrorist legislation. In particular, the British Presidency of the European Union Council made it a move yesteryear priority to adopt legislation providing for memory of a large amount of communications data. But according to the Court of Justice of the European Union (CJEU), inwards a crucial judgment today, that legislation was essentially an over-reaction to these terrorist atrocities. The Court has effectively prohibited volume surveillance inwards the EU, together with thus taken pregnant steps to entrench itself every bit the EU’s constitutional court.

Summary of the judgment

As discussed inwards item yesteryear Chris Jones’ post on this blog, the Directive requires Member States to demand telecommunication service providers to retain pregnant amounts of information on the utilization of all forms of telecommunication yesteryear all individuals inside the EU, for a menses of betwixt six months together with 2 years. This information is collected for the utilization of constabulary enforcement agencies every bit regards investigations into serious law-breaking or terrorism, but at that topographic point are no detailed rules inwards the Directive governing the access to together with utilization of the information yesteryear those authorities. The CJEU only found it necessary to address the inquiry of the validity on the Directive inwards calorie-free of the Charter rights to privacy together with information protection (Articles vii together with 8 of the Charter).

First of all, the Court unsurprisingly had no difficulty finding that the Directive interfered amongst the protection of those ii rights. Its analysis focussed instead on whether such an interference could hold upwardly justified.

The rules on justifying interferences amongst Charter rights are lay out inwards Article 52 of the Charter. Any limitation upon Charter rights must hold upwardly lay downward yesteryear law, honour the essence of the right, together with dependent area to the regulation of proportionality, bound rights together with freedoms only if it is necessary together with really meets world involvement objectives together with the rights together with freedoms of others. The Court easily found that at that topographic point was a world involvement justification (public safety) for the restriction of the Charter rights at issue. It also found that the ‘essence’ of the rights was non affected, because (as regards the correct to privacy) the content of communications was non recorded, together with (as regards the correct to information protection) sure information processing together with information security rules had to hold upwardly respected.

Therefore the key issues inwards the Court’s ruling were the proportionality of the interference amongst Charter rights. The Court indicated that judicial review of the European Union legislature’s discretion should hold upwardly ‘strict’ inwards this case, applying factors such every bit the surface area of constabulary concerned, the nature of the right, the nature together with seriousness of the infringement together with the objective pursued. Here, it followed from the nature of the correct together with the nature together with seriousness of the infringement that the European Union legislature’s discretion was reduced; the CJEU took no job organization human relationship expressly of the objective beingness pursued.

The start facial expression of proportionality (the appropriateness of the interference amongst the correct for obtaining the objective) was fulfilled, because the information concerned mightiness hold upwardly useful to investigations. However, the CJEU found that the Directive was problematic every bit regards the minute facet: the necessity of the mensurate inwards question. Crucially the Court ruled that the of import objective of investigating serious law-breaking together with terrorism did ‘not, inwards itself’ justify information retention. So for the CJEU, the security of the people is non the supreme law.

Its analysis proceeded yesteryear setting out the full general importance of safeguards every bit regards the protection of privacy together with information protection rights (building upon the illustration constabulary of the European Court of Human Rights). These safeguards are fifty-fifty to a greater extent than necessary when information is processed automatically, amongst a risk of unlawful access.

 Applying this test, the Court gave 3 reasons why the rules on information memory inwards the Directive were non strictly necessary. First of all, the Directive had an extremely broad scope, given that it applied to all agency of electronic communication, which receive got ‘widespread together with growing importance’ inwards everyday life, without beingness sufficiently targeted. Indeed, it ‘entails an interference amongst the primal rights of practically the entire European population’. In other words (the Court does non utilization the term), it amounts to volume surveillance.

Secondly, too the ‘general absence of limits’ inwards the Directive, it failed to bound access to the information concerned yesteryear constabulary enforcement authorities, together with the subsequent utilization of that data, sufficiently precisely. In particular: it referred to a greater extent than oft than non to ‘serious crime’ every bit defined inwards national law; it did non bound the role of subsequent access to that data; it did non bound the number of persons who could access the data; together with it did non command access to the information yesteryear agency of a courtroom or other independent administrative authority.

Thirdly, the Directive did non lay out sufficient safeguards, every bit regards: the information memory period, for illustration every bit regards the categories of information to hold upwardly retained for the whole period; the protection of the information from unlawful access together with utilization (here the CJEU criticises the possible limits on protection measures due to reasons of cost); the absence of an obligation to destroy the data; together with the omission of a requirement to retain the information inside the European Union only.

Comments

The CJEU reached the same determination every bit the Advocate-General’s opinion, but for dissimilar reasons. In the Advocate-General’s view, the Directive was invalid because it breached the ‘quality of law’ requirement applicable to interferences amongst Charter rights, having failed to constitute sufficient safeguards relating to access to together with utilization of the data. It also was disproportionate for failing to explicate why storage periods of upwardly to ii years were necessary. The Court’s ruling appears to larn further, yesteryear ruling out volume surveillance inwards principle.

The sentiment discussed about interesting together with of import issues that the Court does non straight address, inwards particular: the existence of a ‘quality of law’ requirement every bit regards breaches of the Charter; whether the European Union or the Member States receive got responsibleness for ensuring the satisfaction of that requirement inwards this case; together with the complications of the ‘legal base’ issue, ie the awkward dot that inserting safeguards relating to constabulary enforcement regime mightiness larn beyond the ‘internal market’ legal base of operations of the legislation. It mightiness hold upwardly deduced that the CJEU has a catch on these issues: at that topographic point is a ‘quality of law’ rule; the European Union is responsible for upholding that requirement inwards this case; together with the ‘legal base’ dot is non a barrier to the European Union adoption of rules regulating constabulary enforcement authorities. But unfortunately, the Court did non expressly land out its reasoning on these issues. It is sure peculiar that, having ruled previously that the Directive was validly based on European Union internal marketplace powers, the CJEU rules hither that its interference amongst Charter rights is justified yesteryear the objective of world safety.

As for the reasoning which the Court did provide, every bit park it was slow to observe world involvement objectives for the interference amongst rights. The most of import business office of the reasoning is thence the analysis of the interference amongst the ‘essence’ of the right, together with of proportionality. It is really pregnant that the Court makes clear that these are ii dissimilar issues: fifty-fifty if the essence of a correct is respected, legislation tin hold upwardly disproportionate. Earlier illustration constabulary on restriction of rights oft seemed to advise that respecting the essence of rights was sufficient.

Another of import facial expression of the judgment is the evolution of a doctrine indicating when strict scrutiny of the European Union legislature’s interference amongst primal rights should apply. This is based upon Strasbourg illustration law, non the standards of national constitutional courts, which receive got of course of report addressed this number inwards their ain way. Obvious questions arise every bit to whether the same standards should apply to national implementation of European Union law, or to Charter rights non based upon the ECHR.

While many information protection specialists fighting that at that topographic point is a primal distinction betwixt the correct to privacy together with the correct to information protection, the Court’s judgment only reflects that distinction to a limited degree. It assesses separately whether at that topographic point is an interference amongst Articles vii together with 8 of the Charter, together with whether the essence of each correct has been affected. However, it made no distinction betwixt the rights when assessing the required intensity of judicial review, together with linked the ii rights together when assessing the proportionality of the interference amongst them.

Consequences of the judgment

First together with foremost, the information memory Directive is solely invalid. The Court did non inwards whatever way dominion that it could move on inwards force. So the immediate resultant is that nosotros render to the condition quo before 2005. This agency that Member States receive got an option, non an obligation, to retain information pursuant to the e-privacy Directive (see farther Chris Jones’ post on the background to the information memory Directive). However, Member States’ do of this selection volition all the same hold upwardly dependent area to the requirements lay out inwards this judgment, since their actions volition autumn inside the orbit of the Charter, given that the e-privacy Directive regulates the number of interference amongst telecommunications.

Would it hold upwardly possible for the European Union to adopt a novel Directive on mandatory information retention? In other words, tin the Directive inwards about way hold upwardly ‘fixed’?

First of all, since the 2006 Directive is solely invalid, the European Union legislature has to start from scratch, rather than better it. Secondly, it is clear from the Court’s judgment that about shape of mandatory information memory inwards companionship to combat serious law-breaking together with terrorism is acceptable from the perspective of the European Union Charter.

How would such a novel Directive differ from the mensurate the Court has just struck down? The Court sets out unusually detailed guidelines for the legislature (and, inwards the meantime, for national legislature) inwards its judgment. First of all, whatever novel Directive would receive got to hold upwardly inwards about feel targeted upon communication which has a special link amongst serious law-breaking together with terrorism. Very simply, volume surveillance is an unjustifiable infringement of Charter rights.

Secondly, a novel Directive would receive got to incorporate rules on: the Definition of ‘serious crime’; the role of subsequent access to the data; limits on the number of persons who could access the data; together with command of access to the information yesteryear agency of a courtroom or other independent administrative authority.

Thirdly, the novel Directive would receive got to include stronger rules on the information memory period, for illustration every bit regards the categories of information to hold upwardly retained for the whole period, every bit good every bit the protection of the information from unlawful access together with use. It would also receive got to incorporate rules on the absence of an obligation to destroy the data, together with demand that information hold upwardly retained inside the European Union only. The Court did non dominion on whether subsequent processing of the information inwards tertiary States would hold upwardly acceptable, but logically at that topographic point must hold upwardly about rules on this number too. Probably it would hold upwardly simplest to extend the external processing rules inwards the principal European Union information protection legislation to this issue.

Depending on the timing of a proposal for a novel Directive (assuming that at that topographic point is one), it mightiness peradventure larn mixed upwardly amongst the determination of negotiations over principal the principal information protection packet beingness negotiated yesteryear the European Union institutions. Alternatively, if those negotiations receive got concluded, they volition constitute a template that the negotiation of the novel Directive tin bring job organization human relationship of.

Final comments

The Court’s judgment tin hold upwardly seen inwards the broader context of continued revelations nearly volume surveillance. Its reference to the memory of information yesteryear tertiary States is a thinly-disguised allusion to the spying scandals emanating from the United States. It also responds, sotto voce, to the really non bad concerns of national constitutional courts nearly this Directive, discussed inwards item inwards Chris Jones’ post on this issue.

More broadly, the CJEU has seized the risk to give an ‘iconic’ judgment on the protection of human rights inwards the European Union legal order. Time volition bargain whether the Digital Rights judgment is seen every bit the EU’s equivalent of classic civil rights judgments of the US Supreme Court, on the desegregation of schools (Brown) or criminal suspects’ rights (Miranda). If the Charter ultimately contributes to the evolution of a ‘constitutional patriotism’ inwards the European Union, this judgment volition hold upwardly ane of its foundations.


Barnard & Peers: chapter 9, chapter 25

Share this post