EUCourtOfJustice Says Data Retention Not Cool

[grarpamp]

http://curia.europa.eu/juris/document/document.jsf?docid=186492&doclang=EN

The European Union’s top court has severely undermined the British
government’s mass surveillance powers in a new ruling that could rein
in police and spy agency investigations.

In a judgment handed down in Luxembourg on Wednesday, the European
Court of Justice declared that the “general and indiscriminate
retention” of data about people’s communications and locations was
inconsistent with privacy rights. The court stated that the “highly
invasive” bulk storage of private data “exceeds the limits of what is
strictly necessary and cannot be considered to be justified, within a
democratic society.”

Camilla Graham Wood, legal officer with the London-based group Privacy
International, hailed the ruling as a victory for civil liberties
advocates. “Today’s judgment is a major blow against mass surveillance
and an important day for privacy,” she said. “It makes clear that
blanket and indiscriminate retention of our digital histories — who we
interact with, when and how and where – can be a very intrusive form
of surveillance that needs strict safeguards against abuse and mission
creep.”

The European court’s panel of 15 judges acknowledged in their ruling
that “modern investigative techniques” were necessary to combat
organized crime and terrorism, but said that this cannot justify “the
general and indiscriminate retention of all traffic and location
data.” Instead, the judges stated, it is acceptable for governments to
engage in the “targeted retention” of data in cases involving serious
crime, permitting that persons affected by any surveillance are
notified after investigations are completed, and that access to the
data is overseen by a judicial authority or an independent
administrative authority.

The case was originally brought in December 2014 by two British
members of parliament, who challenged the legality of the U.K.
government’s Data Retention and Investigatory Powers Act, which forced
telecommunications companies to store records on their customers’
communication for 12 months. That law has since been replaced by the
Investigatory Powers Act, which was recently approved by the British
parliament and is expected soon to come into force.

Though the U.K. voted to leave the European Union earlier this year,
Wednesday’s decision remains — at least in the short term — highly
significant, and will prove to be a severe headache for British
government officials. The ruling will now be forwarded to the U.K.’s
Court of Appeal, where judges there will consider how to apply it in
the context of national law. It may result in the government being
forced to make changes to controversial sections of the Investigatory
Powers Act, which enable police and spy agencies to access vast
amounts of data on people’s internet browsing, instant messages,
emails, phone calls, and social media conversations.

“This is the first serious post-referendum test for our government’s
commitment to protecting human rights and the rule of law,” said
Martha Spurrier, director of U.K. human rights group Liberty. “The
U.K. may have voted to leave the EU — but we didn’t vote to abandon
our rights and freedoms.” She added: “Today’s judgment upholds the
rights of ordinary British people not to have their personal lives
spied on without good reason or an independent warrant. The government
must now make urgent changes to the Investigatory Powers Act to comply
with this.”

A spokesperson for the British government’s Home Office said in a
statement: “We are disappointed with the judgment from the European
court of justice and will be considering its potential implications.
The government will be putting forward robust arguments to the court
of appeal about the strength of our existing regime for communications
data retention and access.”