Source: https://www.openrightsgroup.org/about/reports/open-rights-group-and-privacy-internationals-submission-in-dripa-case
Timestamp: 2019-04-21 14:59:28+00:00

Document:
Open Rights Group (ORG) and Privacy International (PI) have intervened in a judicial review of the Data Retention and Investigatory Powers Act (DRIPA). The case has been brought by Tom Watson MP and David Davis MP, represented by Liberty.
The Claimants have been granted permission to proceed to a substantive hearing and ORG and PI have been given permission to make a further written intervention.
Dan Carey, solicitor at Deighton Pierce Glynn, acting for ORG and PI, said: "It is unusual for an application to intervene to be granted prior to the grant of permission in a judicial review, but it was important in this case, as both Open Rights Group and Privacy International have a wealth of knowledge of how data retention works in practice and its implications for our privacy. The emphasis that we placed on the EU law context (the Data Protection Directive and the E-Privacy Directive) appears to have been material to the court’s decision to grant permission. I am pleased that we also have permission to make further submissions for the substantive hearing next year.
Contrary to what is said by Blake J. in paragraph 1 of his decision rejecting permission, the Claimants’ application for relief is not confined to a declaration of incompatibility; they seek an order disapplying section 1 of the Data Retention and Investigatory Powers Act 2014 (“the 2014 Act”). They are correct to do so because that section and the Data Retention Regulations 2014 (“the 2014 Regulations”) adopted thereunder (“the relevant provisions”) are contrary to EU law and in particular, in breach of the Directive on privacy and electronic communications 2002/58/EC (“PECD”).
a) ensure the confidentiality of such data through the adoption of national legislation prohibiting ‘storage’ or ‘other kinds of interception or surveillance’ without the user’s consent, save where legally authorised in accordance with Article 15(1): Article 5(1)-(3) PECD (recital (3) Data Retention Directive 2006/24/EC (“DRD”).
b) require electronic communications providers to erase traffic data relating to subscribers and users or make it anonymous when it is no longer needed for the purpose of the transmission of the communication, save where it is necessary to retain the data for billing purposes and/or where legally authorised under Article 15(1): Article 6 PECD (recital (3) DRD).
c) Require service providers to offer the possibility of non-identification for callers (Article 8).
The DRD was enacted under Article 95 EC Treaty (now 114 TFEU) to require Member States to oblige communications providers to retain data and provide state access to it. It did not purport to comply with the strict requirements of Article 15 of the PECD. Indeed, it was adopted to derogate from Articles 5, 6 and 9 of the PECD: (Article 3 DRD) and amended the PECD so as to disapply the strict exception requirements of Article 15 in relation to that data: Article 15(1)(a)- (b) PECD. As AG Cruz Villalón stated in his opinion of 12 December 2013 in Case C-293/12 Digital Rights Ireland Ltd it ”derogate[d] from the derogating rules which are laid down in Article 15(1) of [the PECD]”.
The Secretary of State accepts that the PECD applies to the communications data at issue but says that the relevant provisions comply with the strict requirements of Article 15: §26 Summary Grounds. The question for this court therefore, is whether that is so. The interveners submit that it is not and certainly, that the arguability threshold for permission purposes is met in relation to that question.
In construing Article 15 and deciding whether the relevant provisions comply with it, the Court must ensure protection for individual rights under Articles 7 and 8 of the Charter of Fundamental Rights (“the Charter”) and Article 8 of the European Convention on Human Rights (“ECHR”): Case C-390/12 Pfleger and ors 30 April 2014 at §36. Further, the Court must interpret the exceptions in Article 15 strictly: Case C-119/12 Josef Probst v mr.nexnet GmbH judgment 22 November 2012, at §23.
First, for inter alia all the reasons set out by the Claimants, the relevant provisions do not comply with Articles 7 and 8 of the Charter or Article 8 ECHR, which they must do in order to meet the requirements of Article 15 PECD and EU law generally.
The Government’s position is that “the new regime contains a series of safeguards that were not present in the Directive”: §4 Summary Grounds. In reality those safeguards are neither ‘new’ nor come close to meeting the objections of the CJEU to the DRD. Most obviously, as stated above, existing retention notices, which provide for widespread and systematic retention as mandated by the DRD, continue in force. Indeed, following the judgment of the CJEU the Government advised communications providers to carry on retaining data as required by the 2009 Regulations.9 ‘New’ safeguards have no relevance to that position; the mandatory requirements of the DRD are given effect by notices issued under the 2009 Regulations.
a) to be person- or crime- specific. Indeed there is no obligation on the S/S to satisfy herself that there is any connection (even indirect) between the person whose data is being collected and a situation which is liable to give rise to criminal prosecutions. The data retention obligation in the notice not only can but, having regard to the stated purpose behind the legislation, is likely to capture the data of persons for whom there is no evidence capable of suggesting their conduct might have a link, even an indirect or remote one, with a serious crime, which the Court explicitly criticised: §58 – 59 Digital Rights Ireland.
d) to ensure that the data is retained within the EU: §68 ibid.
11. Finally, rules governing restrictions on access to retained data are insufficient. Under Part II of RIPA a wide range of public authorities can obtain access and do so for purposes not confined to safeguarding national security or the prevention, detection or prosecution of defined, sufficiently serious crimes: §§60-62 ibid.
12. The S/S’s response is to say “[...] that having one’s communications retained by a telecommunications operator [...] is relatively minor.” The CJEU in Digital Rights Ireland took the opposite stance, the AG considering that the interference was “particularly serious”: §70 and the CJEU considering it potentially so great that it could in fact have an effect on the use of communications and consequently on freedom of expression: §§27-28 judgment, creating as it does a ‘vague sense of surveillance’: Opinion AG Cruz Villalón §§52, 72.
13. For the reasons stated above, the Claimants’ challenge is clearly arguable such that permission should be granted.
1 ‘Traffic data’ is defined in Article 2(b) PECD as data processed for the purpose of the conveyance of a communication on an electronic communications network or for the purposes of billing. ‘Electronic communications network’ is defined in Directive 2002/21 as a common regulatory framework for electronic communications, networks and services: see Article 2 PECD.
2 These provisions are implemented by the Privacy Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426). However, Regulation 28 exempts communications providers from the requirements of these Regulations where exemption is required for the purpose of safeguarding national security, which is determined by the issue of a certificate signed by a Minister of the Crown, which “shall be conclusive evidence of that fact”. It also provides for certain questions relating to such certificates to be determined by the Information Tribunal referred to in section 6 of the Data Protection Act 1998.
3 Article 29 of Directive 95/46 provided for the establishment of this Working Group.
4 Concerning the precursor to the DRD (Draft Council Framework Decision, Doc 8958/04).
5 The DRD was first implemented by The Data Retention (EC Directive) Regulations 2007 (revoked and superseded by the 2009 Regulations) with respect to fixed network and mobile telephony. Pursuant to Article 15.3 of the DRD the UK had postponed its application to the retention of communications data relating to internet access, internet telephony and internet e-mail (these in fact being covered by the Retention of Communications Data (Code of Practice) Order 2003 (adopted under Part 11 of the Anti-Terrorism, Crime and Security Act 2001). The 2009 Regulations covered all these data forms.
6 They are set out by the Government in notes published by the Home Office on its website https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/330510/Factsheet_Data_Retention.pdf.
7 Even if such notices expire on 1/1/2015 (see r.14(4)), r.14(6) appears to envisage their re-issue on the same terms.
8 It is understood this is subject to legal challenge in R (Cosgrove) v S/S for the Home Department CO 7701/2011.
9 HC Deb June 2014 c445W.

References: §26
 §36
 §23
 §4
 CJEU 
 CJEU 
 §58
 §68
 CJEU 
 §70
 CJEU