The English High Court has held that Part 4 of the Investigatory Powers Act 2016 (the “IPA 2016”) is incompatible with EU law in the area of criminal justice. Dubbed the “snooper’s charter” by its critics, the IPA 2016 has faced heavy opposition from both inside and outside Parliament. Indeed, it was following a case initiated by members of Parliament (Brexit Secretary, David Davis, and Deputy Labour Leader, Tom Watson) that the European Court of Justice declared that the powers afforded to the UK government under the IPA 2016 to order “general and indiscriminate retention” of emails were illegal in December 2016, less than a month after the IPA 2016 passed into law. Since then, human rights and privacy groups have waged war against the IPA 2016, describing it as “a surveillance law that is more suited to a dictatorship than a democracy” and calling on the public to donate to a crowdfunding campaign to bring the judicial review claim.
Last month’s case is the first part of the legal challenge brought by the human rights group, Liberty, which argues that indiscriminately retaining data under the IPA 2016 violates the UK public’s right to privacy. The case focused on Part 4 which allows the UK government to order private communications companies to store data relating to who their customers call, text, and email, from where, when, and how often, and their internet browsing history. The information can then be accessed by public bodies, such as the police and regulators.
The Court held that, in the area of criminal justice, Part 4 was incompatible with EU law because: (1) it authorises the UK government to issue retention notices with no prior independent checks, such as review by a court or other body, and for the purpose of investigating crime that is not “serious crime”; and (2) subsequent access to any retained data was similarly not subject to any independent authorisation and not limited to the purpose of combating “serious crime.” The Court decided not to make an order for disapplication, but instead granted a declaration that the relevant sections of the IPA 2016 must be amended by 1 November 2018. The Court declined to rule on whether retaining data for the purposes of protecting health, in tax matters, the regulation of financial services and markets, and for financial stability were lawful, on the grounds that the UK government has already announced plans to amend this part of the legislation. Other parts of Liberty’s challenge which concern provisions of the IPA 2016 relating to hacking, bulk warrants, and bulk personal data, remain to be determined at a later date.
The judgment can be found here.
