Forcing telecoms companies to participate in bulk indiscriminate data collection and retention is unlawful under European Union law, according the European Court of Justice’s (CJEU) Advocate General. Manuel Campos Sánchez-Bordona, whose job is to provide legal opinions in order to assist the EUCJ with its deliberations, published his legal opinion on 15 January.
Sánchez-Bordona makes clear that the EU Directive on privacy and electronic communications applies even to activities relating to national security and combating terrorism.
Following @policescotland’s announcement that they will begin roll-out of cyber kiosks @OpenRightsGroup and @privacyint released a joint statement: https://t.co/kYqOltdf47 pic.twitter.com/r495WhFOHM
— ORG Scotland (@ORGScotland) January 16, 2020
"The opinion is a win for privacy" civil liberties group Privacy International said in a statement. "If the [CJEU] agrees with the AG’s opinion, then unlawful bulk surveillance schemes, including one operated by the UK, will be reined in", they added.
The Advocate General said that he recognises the usefulness of an obligation to keep certain information to safeguard national security and combat crime. He recommends that “limited and discriminate retention” of information could satisfy that need. But it should have to be established that it is “absolutely essential” to achieve such ends which could not be satisfied by other, less intrusive means.
Sánchez-Bordona’s legal opinion exists to assist the CJEU and is not legally binding, though is likely to be persuasive. The CJEU will be considering four legal challenges later this year, two from France, one from Belgium, and one from the UK, all of which deal with the respective states forcing telecoms companies to assist in mass indiscriminate collection, and retention, of millions of people’s data. It is important to note that the Advocate General’s legal opinion only applies to situations where private companies are compelled to engage in mass surveillance by the state and then forced to provide that information to governmental authorities. The EU Directive does not apply in circumstances where mass surveillance is engaged directly by public authorities, “without requiring the cooperation of private parties”.
