European Court Hears Challenge to UK Bulk Data Collection Law

The judges will be asked to clarify whether blanket retention of and self-authorized access to communications data — records of emails, calls, texts and web activity — by police and other authorities breaches people's fundamental right to privacy and protection of personal data.

Davis and Watson launched a legal challenge to the Data Retention and Investigatory Powers Act (DRIPA) — the Government's current surveillance law — in 2014. The DRIPA was rushed through Parliament and onto the statute books in July 2014 by Ministers claiming "emergency" legislation was necessary, following a ruling by the European Court of Justice that the existing EU Directive on data retention invalid because it was so sweeping in its interference with individual privacy rights. 

The judgment made clear that existing UK legislation, including the access regime under the Regulation of Investigatory Powers Act 2000 (RIPA), required urgent review. The DRIPA Bill was privately agreed following discussions between the then three main party leaders. It became law within just three days — denying time for proper parliamentary scrutiny, amendment or even debate.

Privileged Data

DRIPA allows the Home Secretary to order communications companies to retain data for 12 months. It catches the records of communications of everyone in the UK, including the emails, calls, texts and web activity of MPs, journalists, lawyers, doctors and other correspondence that may be confidential or privileged.

In July 2015, the High Court found key parts of it breached fundamental rights because they do not include rules to ensure data is only accessed to help prevent and detect serious offences, and because access is not authorized by a court or independent body. The Government appealed, and Court of Appeal judges sought clarification from the CJEU in December.

James Welch, human rights group Liberty's Legal Director, said:

"Liberty strongly supports the use of surveillance in fighting crime, but only if it's targeted. The Government's approach of sweeping up and storing everybody's data with no effective safeguards is excessive. This case could stop the fatally flawed Investigatory Powers Bill in its tracks and mark a sea change in the fight for an effective, targeted system of surveillance that keeps us safe and protects our rights."

Liberty says the Investigatory Powers Bill — currently being rushed through Parliament — not only seeks to re-legislate for DRIPA, but goes much further. It would dramatically expand the mass data-gathering powers challenged in this case, with no attempt to remedy the lack of safeguards raised by the High Court.

The Bill would force service providers to generate and retain every person's Internet connection records (ICRs) — details of every website visited, communication software, desktop widget and application used, system update downloaded and device used to connect to the web.

It also seeks to put several other bulk powers — including hacking, interception and acquisition of vast databases containing sensitive information of millions of innocent people — on a statutory footing.

If the CJEU finds the scheme of bulk retention and self-authorized access breaches human rights law, whole sections of the Investigatory Powers Bill will be called into question. Such a ruling would make it extremely unlikely that proposals for other even more intrusive bulk measures in the Bill would comply.