European governments must not oblige network operators to indiscriminately retain bulk customer communications data, the European Union’s top court has reaffirmed.
The ruling by the Court of Justice of the EU came in response to a question from the UK’s Court of Appeal, which is examining the legality of the UK’s 2014 Data Retention and Investigatory Powers Act, and a similar question from the Swedish telecommunications regulator. But the ruling also calls into question the validity of the UK’s more recent Investigatory Powers Act, which received royal assent last month.
That law requires telecommunications companies to retain communications data, including calls made and lists of websites visited, and make it available to tens of thousands of government employees, including tax inspectors and food safety regulators.
Court of Appeal
“It will now be for the Court of Appeal to determine the case,” said a Home Office spokesman, referring to the challenge to the 2014 act. “The government will be putting forward robust arguments to the Court of Appeal about the strength of our existing regime for communications data retention and access.”
Meanwhile, he said, “Given the importance of communications data to preventing and detecting crime, we will ensure plans are in place so that the police and other public authorities can continue to acquire such data in a way that is consistent with EU law and our obligation to protect the public.”
The Court of Justice of the EU ruled that EU law forbids the general and indiscriminate retention of traffic data and location data. That ruling calls into question the UK’s 2014 and 2016 acts.
However, the Court of Justice of the EU gave the UK government some leeway, saying the law does allow targeted retention of certain data for the purpose of fighting serious crime, provided that governments limit the data retained to what is strictly necessary. In all cases, the retained data must stay within the EU and an independent authority must review all requests to access the data, it said.
Necessary safeguards
Lobby group Privacy International’s legal officer, Camilla Graham Wood, said that, like its predecessor, the new Investigatory Powers Act did not contain the necessary safeguards, and she called on the UK government to urgently fix it so that access to data is properly authorised.
“The court has rightly recognised that our communications data is no less sensitive than the content of our communications. This is something that the UK Government has wilfully ignored, allowing a large number of public bodies to access our personal data without a warrant,” she said.
The Court of Justice of the EU’s position on data retention is relatively recent. EU law used to allow — and even require — much greater retention of communications data, until a challenge from Digital Rights Ireland in 2014 prompted the Court of Justice of the EU to declare the 2006 Data Retention Directive invalid because of its interference with the fundamental rights to respect for privacy and the protection of personal data.
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers