The English law over the last fifteen years on interception and investigatory powers has been dynamic. The Regulation of Investigatory Powers Act (‘RIPA’) was introduced in 2000, but in 2014, the CJEU judged that RIPA was not fully compatible with the EU Charter of Fundamental Rights and Liberties (the ‘Charter’). A series of secondary legislation and the Data Retention and Investigatory Powers Act (‘DRIPA’) 2014 was implemented by the government in response to this, but this itself has been subject to further judicial review and scrutiny. In December 2016, the CJEU again declared the UK law here was not compatible with the Charter.
This challenge was first brought by MPs Tom Watson and David Davis (prior to his now cabinet position responsible for exiting the EU), that DRIPA was not compatible with the Charter, and therefore should be repealed or amended to be in accordance with the Charter values. The Court of Appeal referred the matter to the CJEU which gave a clear declaration that DRIPA 2014 “exceeds the limit of what is strictly necessary and cannot be considered to be justified, within a democratic society” (para 107). The matter has been referred back to the Court of Appeal for a judgment based on that verdict.
At the heart of the matter is the DRIPA requirement for communications providers to retain call logs, traffic data and mobile phone locations data for up to 12 months. While a series of previous verdicts have interpreted this sort of law as only being able to be compatible with the Charter for specific purposes (serious crime), or with specific protections, this verdict went further. The CJEU’s verdict included its view on ‘general and indiscriminate retention’ (para 97): which it states is contrary to the Charter, regardless of protections in place.
The practical impact here is interesting. This is a verdict which the Court of Appeal will take into account in its subsequent verdict which will follow. In any case, the Government repealed the entire DRIPA law at the end of 2016, replacing it with the all new Investigatory Powers Act 2016 (‘IPA’), commencing at the start of 2017. With much the same data retention rights in place in IPA as were in DRIPA, the heart of the judgment CJEU judgement against DRIPA can be mapped by the Court of Appeal against the new provisions of IPA.
Of course, in response to any verdict which declares aspects of data retention under IPA as being incompatible with the Charter, the government could make tweaks to IPA. Those tweaks may well be subject to further challenge and litigation. As Tom Watson and David Davis first raised their concerns in July 2014, the High Court verdict was in July 2015, and the Court of Appeal is yet to implement the CJEU verdict as of 16 January 2017, we may not see a further appeal ever reach a European Court if Theresa May achieves her Brexit timetable.
This does not necessarily mean however that the UK Government can ignore the Charter or equivalent European concerns: for the lawful data export from the EU to the UK (as a third country), it is likely that the would require its laws to be reviewed by the European Commission, which would declare whether they are adequate to protect the rights of citizens, and therefore if data exports should be permitted prima facie. If the UK government adopts a contrary approach to the Charter prior to Brexit, this may colour the Commission’s analysis as to the rigour of UK law as it relates to the fundamental rights of EU citizens.
There will be plenty more turns as the legislation and litigation continue in this arena. For now, the CJEU has struck a significant theoretical blow to the UK’s data interception rights, but the practical matter of bulk data interception is likely to continue regardless.