EU Court rules IP Act data retention illegal

The Court of Justice of the European Union (CURIA) has ruled that mass collection of electronic communications data, such as that codified in the recently passed Investigatory Powers Act, is against EU law and must not be enforced by member states.

Formerly known as the Draft Communications Bill and killed by the coalition government of the day, the legislation called by critics a 'snooper's charter' was reintroduced last year as the Investigatory Powers Bill, calling for an effective ban on functional encryption and retention of all citizen's browsing histories among other things. Despite considerable objections, the government forged ahead with the IP Bill: In mid-November, the House of Lords passed the Bill with only one minor modification - the specific exemption of Members of Parliament and Peers from monitoring under the Bill. Later that month, the Bill became an Act following the granting of royal assent.

Now, though, the EU has weighed in on the matter - and it's not best pleased. The Court of Justice of the European Union (CURIA) has issued a judgement in a pair of cases, one brought by a Swedish telecommunications firm and the other by Labour MP Tom Watson and others, against the Secretary of State for the Home Department regarding the IP Act. Its message is clear: 'Member States may not impose a general obligation to retain data on providers of electronic communications services.'

The ruling, on its face, completely guts the IP Act. 'In today’s judgement, the Court’s answer is that EU law precludes national legislation that prescribes general and indiscriminate retention of data. The Court confirms first that the national measures at issue fall within the scope of the directive,' the ruling reads. 'The interference by national legislation that provides for the retention of traffic data and location data with that right must therefore be considered to be particularly serious. The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance. Consequently, only the objective of fighting serious crime is capable of justifying such interference.

'The Court states that legislation prescribing a general and indiscriminate retention of data does not require there to be any relationship between the data which must be retained and a threat to public security and is not restricted to, inter alia, providing for retention of data pertaining to a particular time period and/or geographical area and/or a group of persons likely to be involved in a serious crime. Such national legislation therefore exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society, as required by the directive, read in the light of the Charter.'

While the ruling allows for 'a targeted retention of data for the purpose of fighting serious crime,' it effectively forms a ban on laws like the IP Act as created and enforced by EU member states. That, however, is unlikely to save the UK: Following the referendum on EU membership earlier this year, the UK is hurtling headlong into rescinding its membership, meaning the protections to privacy and related human rights enforced by CURIA, including this latest ruling, will no longer apply and the UK will be free to ignore the ruling and continue to enforce blanket data collection on all non-MP citizens of the UK regardless. With the UK still officially a member of the EU at present, though, it will be hard-pushed to enforce the IP Act as it is written following the ruling.

Jim Killock, executive director of privacy advocacy organisation the Open Rights Group (ORG) has welcomed CURIA's ruling. '[CURIA] has sent a clear message to the UK government: blanket surveillance of our communications is intrusive and unacceptable in a democracy,' he wrote in a statement to press this morning. 'The government knew this judgement was coming but Theresa May was determined to push through her snoopers’ charter regardless. The Government must act quickly to re-write the IPA or be prepared to go to court again.'

The UK government has not yet responded to the CURIA ruling, which can be read in summary on the official website (PDF warning). The IP Act is scheduled to be enforced from December 30th this year.