Source: https://www.openrightsgroup.org/blog/2016/eu-court-slams-uk-data-retention-surveillance-regime
Timestamp: 2019-04-21 15:15:25+00:00

Document:
Here’s our quick overview of what the CJEU has told the UK and Sweden they must do to fix requirements for data retention.
The CJEU has repeated arguments, made previously in the Digital Rights Ireland case, to rule that generalised data retention is disproportionate and unlawful.
Unfortunately for the UK government, ORG and PI were there to argue the opposite, alongside the joined Swedish case brought by Tele2 Sverige AB, a telecoms company challenging the compatibility of generalised data retention orders in that country.
This will come as a shocker to the UK government, which could be forgiven for safely assuming that at least the basic principles of retention would be accepted by the CJEU, given the opinion of the Advocate General and the views of UK courts.
The UK has pioneered population level data retention and drove the adoption of the original EU Data Retention Directive after the London bombings in 2005. It will now be forced to rethink its approach.
The Court accepts that some data retention can be necessary and acceptable, as it had previously said in the Digital Rights Ireland case, but only for very limited purposes defined in the e-privacy directive. Within this narrower retention regime, access should be even more restricted.
The CJEU fully supports the ruling by the UK High Court, which triggered the case, that only serious crime is an acceptable purpose for accessing retained data.
Union or Member State law may restrict by way of a législative measure the scope of the obligations and rights provided for in Articles 5, 6, 7, and 8 of this Régulation when such a restriction respects the essence of the fundamental rights and is a necessary, appropriate and proportionate measure in a démocratie society to safeguard national security (i.e. State security), defence, public security, and the prévention, investigation, détection- or prosecution of criminal offences or the exécution of criminal penalties, or of unauthorised use of electronic communications systems. Any législative measure refeiïed to in paragraph l shall be in accordance with the Charter of Fundamental Rights of the European Union, in particular with Articles 7, 8, 10 and 52 thereof.
The IPA contains a much broader set of purposes for access to communications data by some 48 public authorities that include NHS trusts and the Gambling Commission. It is very hard to see how this can be squared with the ruling.
120 In order to ensure, in practice, that those conditions are fully respected, it is essential that access of the competent national authorities to retained data should, as a general rule, except in cases of validly established urgency, be subject to a prior review carried out either by a court or by an independent administrative body, and that the decision of that court or body should be made following a reasoned request by those authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime.
This is a blow to the UK legal system, where authorisation is performed by a 'Designated Senior Officer', who is part of the same organisation that requests the data.
The CJEU judgment also raises a few other issues that were not explicitly raised by the UK Court of Appeal. However, they will be very important for any future legislation in this area.
The Court reiterates the points previously made in the Digital Rights Ireland case that data retention engages not just privacy but also freedom of expression, “one of the essential foundations of a pluralist, democratic society”.
93 Accordingly, the importance both of the right to privacy, guaranteed in Article 7 of the Charter, and of the right to protection of personal data, guaranteed in Article 8 of the Charter, as derived from the Court’s case-law (see, to that effect, judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 39 and the case-law cited), must be taken into consideration in interpreting Article 15(1) of Directive 2002/58. The same is true of the right to freedom of expression in the light of the particular importance accorded to that freedom in any democratic society. That fundamental right, guaranteed in Article 11 of the Charter, constitutes one of the essential foundations of a pluralist, democratic society, and is one of the values on which, under Article 2 TEU, the Union is founded.
This is important because it could make it harder to justify the blanket retention of Internet Connection Records, which could be deemed a 'reading list'. Measures that made ordinary citizens refrain from accessing materials or expressing opinions online this could well impinge the “essence of the right”. This would move the argument away from safeguards on access to the records towards the broader direct impact of the measures, in a way that an analysis purely focused on individual privacy may not.
Open Rights Group and other human rights groups have long argued that people whose data is accessed should be notified, once this will not impact on investigations. Our calls have always been rejected on the grounds that investigations can go cold and be revived later on, and this would give too much information to suspects.
121 Likewise, the competent national authorities to whom access to the retained data has been granted must notify the persons affected, under the applicable national procedures, as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities. That notification is, in fact, necessary to enable the persons affected to exercise, inter alia, their right to a legal remedy, expressly provided for in Article 15(2) of Directive 2002/58, read together with Article 22 of Directive 95/46, where their rights have been infringed.
This would shake the secretive UK surveillance regime to its core, almost more than introducing independent authorisation, as it might be feasible to maintain the current black box model with the use of secret court orders or extending the role - and resources - of the Judicial Commissioners in the IPA. Having to notify discarded suspects would be a crack through which light may reach the darker corners of the current regime.
Given that there are over half a million requests a year for communications data, notification was perceived as introducing a huge administrative burden. It would also give visibility and raise social awareness of the extent of surveillance.
In addition to rejecting generalised retention and narrowing down access to serious crime with independent authorisation, the CJEU has further established that as a rule only the data of people suspected of direct involvement in those crimes can be accessed. Accessing other people’s data must be an exception and also based on specific evidence of how this may help investigations.
119 Accordingly, and since general access to all retained data, regardless of whether there is any link, at least indirect, with the intended purpose, cannot be regarded as limited to what is strictly necessary, the national legislation concerned must be based on objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data of subscribers or registered users. In that regard, access can, as a general rule, be granted, in relation to the objective of fighting crime, only to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime (see, by analogy, ECtHR, 4 December 2015, Zakharov v. Russia, CE:ECHR:2015:1204JUD004714306, § 260). However, in particular situations, where for example vital national security, defence or public security interests are threatened by terrorist activities, access to the data of other persons might also be granted where there is objective evidence from which it can be deduced that that data might, in a specific case, make an effective contributionto combating such activities.
The IPA contains powers for the bulk acquisition of communications data by the Security and Intelligence Agencies, which had been in place through secretive interpretations of previous legislation. MI5 has been getting a copy of all of the country’s phone calls, texts and possibly other data for decades. Clearly, this would not fit the criteria set out by the CJEU and we expect these practices to be challenged in court.
This was a point raised in the original UK ruling and unsurprisingly it was ratified by the CJEU. It is worth repeating as a reminder of the dire consequences that leaving the EU data protection regime, including data retention, would have for the UK digital economy.
If you want to support our work in future cases, and help to ensure that this ruling is enforced, please join ORG today.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 v. 
 § 260
 CJEU