Theresa May was interior minister when the controversial Snoopers' Charter was introduced into parliament and faced heavy criticism over its powers of 'bulk collection' of communications data — people's email, Internet browsing, social media and telephone data — over claims it was a 'catch-all' scattergun approach which wrongly targeted innocent people.
#ECJ: Member States may not impose a general obligation to retain data on e-comms providers https://t.co/B0sMPtNgss
— EU Court of Justice (@EUCourtPress) December 21, 2016
The ECJ has Wednesday (December 21) ruled that the UK Government "may not impose a general obligation to retain data on providers of electronic communications services" because the practice is "general and indiscriminate."
#IPAct needs rewriting!—UK loses case comprehensively at CJEU—independent authorisation needed, *blanket retention not allowed* pic.twitter.com/69qfnOq0zz
— Open Rights Group (@OpenRightsGroup) 21 December 2016
The ruling is the culmination of a case brought by UK MPs Tom Watson and David Davis, who launched a legal challenge to the Data Retention and Investigatory Powers Act (DRIPA) surveillance law — in 2014.
@tom_watson Brilliant news!
— Simon (@HungryHatter) December 21, 2016
The DRIPA was rushed through Parliament and onto the statute books in July 2014 by ministers claiming "emergency" legislation was necessary, following a ruling by the European Court of Justice that the existing EU Directive on data retention invalid because it was so sweeping in its interference with individual privacy rights.
The intrusive nature of #commsdata confirmed in #CJEU judgment. It’s as sensitive as content #watson #SnoopersCharter #dataretention pic.twitter.com/NGmyEUxAM2
— PrivacyInternational (@privacyint) December 21, 2016
The judgment made clear that existing UK legislation, including the access regime under the Regulation of Investigatory Powers Act 2000 (RIPA), required urgent review. The DRIP Bill was privately agreed following discussions between the then three main party leaders. It became law within just three days — denying time for proper parliamentary scrutiny, amendment or even debate.
DRIPA allowed the Home Secretary to order communications companies to retain communications data for 12 months. It caught the records of communications of everyone in the UK, including the emails, calls, texts and web activity of MPs, journalists, lawyers, doctors and other correspondence that may be confidential or privileged.
Bulk Collection
In July 2015, the UK High Court found key parts of it breached fundamental rights because they do not include rules to ensure data is only accessed to help prevent and detect serious offenses, and because access is not authorized by a court or independent body. The Government appealed, and Court of Appeal judges sought clarification from the ECJ.
The DRIPA has since been overtaken by new legislation — the Investigatory Powers Act 2016, aka the Snoopers' Charter — which also allows for the bulk collection of data. The latest ECJ ruling will now have serious consequences for the imposition of that legislation.
However, the ECJ ruled that bulk collection could be used in the pursuance of serious crimes where the collection of that data was "targeted" and "strictly necessary."
"The Court makes clear however that the directive does not preclude national legislation from imposing a targeted retention of data for the purpose of fighting serious crime, provided that such retention of data is, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, limited to what is strictly necessary," the ruling said.
