In yet another key case dealing with the balance between citizens’ privacy and the ability of the state to intrude into it, the Court of Justice of the European Union (CJEU) has ruled on the compatibility with European Union law of legislation that authorises the retention of communications data, which includes personal data. The reference from the UK Court of Appeal resulted from a challenge to the Data Retention and Investigatory Powers Act 2014 (DRIPA) brought by individuals that include Tom Watson, deputy leader of the Labour Party and represented by Liberty. Interveners include the Law Society of England and Wales, the Open Rights Group, and Privacy International.

The CJEU considered the compatibility of such legislation with the e-Privacy Directive, Articles 7 and 8 of the Charter of Fundamental Rights of the European Union—which protect private and family life and personal data respectively—and its previous decision in C-293/12 Digital Rights Ireland—which invalidated the Data Retention Directive.

The ruling

The CJEU ruled that:

• General and indiscriminate retention of personal data is contrary to EU law.
• Personal data may only be retained where strictly necessary for the purposes of combatting serious crime.
• Access to retained personal data must be confined to what is strictly necessary and subject to appropriate privacy safeguards, including prior authorisation by a judge or other independent body.

It is now for the UK national court to determine whether the domestic law is in conformity with the CJEU’s guidelines. The powers conferred by DRIPA certainly exceed the boundaries of EU law, but DRIPA remains in force only until the end of 2016 under a “sunset clause”. Much more problematic is the Investigatory Powers Act 2016 (IPA), which has recently obtained royal assent and extends DRIPA’s powers.

Since the powers conferred by the IPA are wider and more intrusive than those under DRIPA, as it stands, the IPA is likely to be unlawful according to the law of the European Union. However, it is possible that once the UK leaves the EU, this issue will be moot, since the UK will no longer be subject to the CJEU’s jurisprudence. Therefore, it may be tempting for the UK government to ignore the CJEU’s Watson decision for the time being on the basis that the CJEU will eventually become irrelevant from a UK law perspective, especially given that the IPA was subject to much parliamentary debate and scrutiny.

Effect despite Brexit

That being said, although the decision’s impact in the UK is uncertain, dataflows between jurisdictions are essential to business today, particularly in industries such as science, technology, and financial services which are crucial to the UK’s economy. It is thus equally crucial that arrangements be put in place to allow data transfers from the EU to continue post-Brexit. In practice, this means that the UK will need to seek an “adequacy decision” from the European Commission confirming that it is a safe place for data originating from the EU.

Following Schrems, surveillance laws like the IPA must be taken into account when adequacy is assessed, and the CJEU’s decision in Watson provides a clear indication that the IPA would likely prevent UK law from reaching the standard of adequacy.

Therefore, the UK government now faces a dilemma: reopening the debate on the IPA with a view to addressing the incompatibility with EU law identified by the CJEU and ensuring adequacy for cross-border dataflows, or ignoring the CJEU’s decision and risking not being able to meet the adequacy standards sought by the European Commission. This will be a difficult decision to make.

Elizabeth Campion, a paralegal in our London office, contributed to this entry.