EU Quietly Ramps Up Preparations To Re-introduce Blanket Data Retention After Top Court Threw It Out In 2014

from the let's-protect-article-13-while-we-are-at-it dept

One of the biggest wins for the general public in recent years was when the Court of Justice of the EU (CJEU), the region's highest court, ruled in 2014 that the 2006 Data Retention Directive was "invalid". That naturally didn't go down too well with many of the governments in the EU, who were keen to keep it for surveillance of their populations. Almost immediately, the European Commission began to "examine the best options for the way forward as regards the retention of telecommunications data", as Erich Möchel reported in 2015. More recently, Statewatch published a draft of an internal document from the Council of the EU (pdf), outlining the EU's plans to re-instate obligatory data retention, while an updated version was obtained and released by ORF.at (pdf). The differences between the two versions give a hint of how the EU might try to play this. The earlier one says:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. It should also be noted that it has been argued that the findings of the Court in those cases apply only to traffic and location data, and not to subscriber data.

In the second version, the Council of the EU is much more assertive:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. In this context, Member States expressed their view that the findings of the European Court of Justice in Digital Rights Ireland and Tele 2 do not apply to subscriber data, but only to traffic and location data.

So maybe the line will be that the big 2014 defeat in the courts only applied to "traffic and location data", not to subscriber data. The hope seems to be that new legislation might specify that only data about the latter should be retained, thus avoiding the EU court's restriction.

The document also provides important information about another key piece of proposed EU legislation. The e-Privacy Regulation is designed to complement the General Data Protection Regulation. Where the latter essentially protects personal data at rest -- in databases, for example -- the e-Privacy Regulation will restrict how personal data can be transferred. Even though it is close to completion, the e-Privacy Regulation has essentially been put on the back burner, with no prospect of it being passed soon. Thanks to the latest document leak, now we know at least one reason why:

Legislative reforms at national or European level, including the new e-Privacy Regulation, should maintain the legal possibility for schemes for retention of data at EU and national level that take into account future developments and that are compliant with the requirements set out by the European Court of Justice.

This exposes a fear on the part of the EU politicians that the e-Privacy Regulation might place new obstacles in the way of a re-vamped Data Retention Directive. The comment above is a reflection of the fact that the e-Privacy Regulation will only be set on the path to final approval if it allows governments to collect and store personal data as they wish.

Finally, Erich Möchel's analysis of the latest version of the document from the Council of the EU notes a troubling possibility. While the EU is smoothing the way for data retention to return, it might get rid of another pesky directive that tries to limit surveillance of online users. Article 15 of the EU's e-Commerce Directive, passed in 2000, says:

Member States shall not impose a general obligation on providers ... to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.

Techdirt pointed out recently that Article 13 (now renumbered as Article 17) of the EU's Copyright Directive imposes exactly this kind of general obligation. It is therefore quite possible that the CJEU could rule that Article 13/17 of the Copyright Directive is invalid, just as it did for general data retention. Möchel suggests that as the EU tries to bring back data retention, it might also take the opportunity to get rid of that ban on general monitoring to head off any legal challenges to Article 13/17 as well.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, data privacy, data protection, data retention, data retention directive, eu, general monitoring, privacy, surveillance

European Parliament Study Likely To Boost Legal Challenges To Blanket Data Retention In Europe

from the principles-of-proportionality-and-necessity dept

Back in April last year, we wrote about a surprising and hugely important ruling by Europe's top court that the framework for data retention in Europe -- the Data Retention Directive -- was "invalid". That was largely because it allowed data retention on a scale that was disproportionate. But an interesting question that arises from that decision is: if the Directive itself is invalid, where does that leave all the EU agreements and laws that require data to be retained? What exactly is their legal status now that the Directive has been struck down? Are they invalid too?

A few months ago, we reported on the leak of a document from a closed meeting of EU Justice and Home Affairs ministers, which suggested that "general and blanket data retention" is no longer possible in the EU, because of the top court's ruling. Independently of that legal opinion, one of the key EU committees -- that dealing with civil liberties -- asked the European Parliament's internal Legal Services for a formal study on the question. That report has now been completed (pdf), and the digital rights organisation Access has obtained a copy. It has also put together an accessible post explaining the key points:

the European Parliament legal services indicates that these agreements [involving data retention], while controversial, are still valid as they benefit from "presumption of legality". However, the report then adds "That said, the 'presumption' of legality of EU acts can also be rebutted and so it cannot be excluded, at this stage, that any other EU act could suffer the same fate as the data retention Directive". Therefore, all existing agreements currently in place remains valid, however, citizens can request the Commission to look into the validity of these agreements, or they can choose to take legal action to test their validity.

In other words, it is the view of the European Parliament's Legal Services that citizens can challenge any EU agreement or law involving data retention so that its validity is examined in the light of the court's ruling. There are two main classes affected.

The first is agreements that the EU has made with other nations. These include the Passenger Name Records agreements (PNR) and the Terrorist Finance Tracking Programme (TFTP). The former allows details of EU air passengers to be passed to other countries (notably the US), while the TFTP allows financial information to be shared (again, mostly with the US.) Successful legal challenges to these would cause huge problems for EU-US co-operation in the realms of counter-terrorism and beyond.

The second class potentially affected by the latest opinion is the national laws passed by EU Member States to implement the Data Retention Directive. It is the EU Legal Service's view that these national laws are also covered by the European court's decision, and that they too may be invalid if disproportionate. As Access explains:

Concerning member states' existing legislation on data retention, the EP legal services clarifies that, while the ruling does not outlaw these national laws, it does created a "twofold effect". First, since member states are no longer obliged by law to retain communication data, they can then decide to repeal their related laws -- as several countries such as Austria or Romania have done since the ruling. Second, if member states were to decide to keep measures for the retention of communication data, such rules would fall under EU legislation from 2002, the so-called E-privacy Directive.

Therefore, member states must ensure that their national laws on data retention comply with the EU Charter of Fundamental Rights and fulfill the requirements laid down in the E-privacy Directive regarding the principles of proportionality and necessity. And perhaps, most importantly, the report then adds that all the criteria set out by the Court in its ruling on the need for safeguards, proportionality and the "existence of clear and precise rules" must be included in these national laws. As a result all existing national acts on data retention should be examined on a case-by-case basis to check their compliance with those criteria.

As Access goes on to point out, it seems extremely unlikely the UK's new Data Retention and Investigatory Powers Act (DRIP), rushed through as result of the European court's ruling, would be in compliance. The latest study from the European Parliament's Legal Services is therefore likely to encourage digital rights organizations to add yet another challenge to DRIP, making it even more likely that it, too, will be struck down for being disproportionate, just as the Data Retention Directive was.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, data retention directive, eu, eu parliament

UK Government Ignores European Court Ruling On Data Retention: Tells Telecom Companies To Carry On Spying

from the who-needs-laws?-just-do-as-we-say dept

One of the interesting issues arising out of the important ruling from the European Union Court of Justice that the EU's Data Retention Directive was invalid, is what the member states will now do as a result. The UK government, one of the principal cheerleaders for storing all this data in the first place, has no doubts about what it should do - it will completely ignore that judgment for the moment, as the Guardian reports:

despite the fact that the directive which mandated the creation of the [Data Retention (EC Direction) Act of 2009] was struck down, the UK government has not yet moved to invalidate the Act. Answering a parliamentary question from Liberal Democrat MP Julian Huppert the Home Office minister James Brokenshire revealed last week that the government had explicitly notified telecoms providers that "they should continue to observe their obligations as outlined in any notice", despite the ruling.

Here's why the UK government has told them to do that:

The Home Office added that "the retention of communications data is absolutely fundamental to ensure law enforcement have the powers they need to investigate crime, protect the public and ensure national security".

Of course, it offers absolutely zero evidence that this is true, and also ignores admissions by the Danish police that it is not. But then, the UK government always was a big fan of dogma-based policy, as the awful Digital Economy Act made so painfully clear.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, data retention directive, eu court of justice, spying, surveillance, uk