Exactly a year after the UK Parliament approved the Data Retention and Investigatory Powers Act of 2014 (“DRIP”) the High Court of Justice has held that it is inconsistent with EU law. Nonetheless, the High Court will allow DRIP to remain in effect until March 31, 2016 to allow Parliament time to remedy the issues it identified (much like the Second Circuit stayed its injunction in ACLU v. Clapper).
Parliament enacted DRIP in response to a decision by the European Court of Justice which held that broad data retention mandates violate the European Convention on Human Rights (ECHR). The High Court here found that DRIP violates the ECHR as well as the EU Charter. The High Court wrote, “legislation establishing a general retention regime for communications data infringes rights under Articles 7 and 8 of the EU Charter unless it is accompanied by an access regime (laid down at national level) which provides adequate safeguards for those rights.” The High Court went on to explain that the access regime is lacking in two ways:
- It does not lay down clear and precise rules providing that access to and use of communications data retained pursuant to a retention notice must be strictly restricted to the purpose of preventing and detecting precisely defined serious offences or of conducting criminal prosecutions relating to such offences; and
- Access to the data is not made dependent on a prior review by a court or an independent administrative body. . .
Remedying these issues will require Parliament to amend both DRIP and the Regulation of Investigatory Powers Act (“RIPA”) since DRIP regulates data retention while RIPA regulates access to that retained data. The High Court did not suggest a specific system that would overcome these deficiencies, but did note that this type of law is the subject of political controversy in the UK and abroad, and quoted the Queen’s Speech opening Parliament on May 27, 2015 in which she said that “new legislation will modernize the law on communications data.” The High Court also referred to the USA FREEDOM Act, as well as opinions in the Constitutional Court of Slovenia, the Constitutional Court of Romania, the District Court of The Hague, and the Constitutional Court of Belgium which held their country’s communications data legislation invalid and said “the details of each country’s laws under scrutiny are of course not identical: but the general theme is clear.” This opinion should serve as a clear warning that legislatures of EU member countries will need to carefully craft any amendments or new surveillance laws to both satisfy national law and avoid infringing on EU law.
