In Secretary of State
for the Home Department v Tom Watson MP and others
[2018] EWCA Civ 70 the
Court of Appeal was required to interpret the answers it had received from the CJEU
on its own reference, made in November 2015. The reference arose in the course
of proceedings concerning the legality of the data retention powers created by
the Data Retention and Investigatory Powers Act 2014 (DRIPA) and sought
clarification of the CJEU judgment in Case C-594/12 Digital Rights Ireland. The CJEU, in a judgment which also
concerned a reference on Swedish legislation of a broadly similar type, gave
its answers in December 2016 and that judgment stated that EU law precluded:
‘national legislation governing the protection and security
of traffic and location data and, in particular, access of the competent
national authorities to the retained data, where the objective pursued by that
access, in the context of fighting crime, is not restricted solely to fighting
serious crime, where access is not subject to prior review of a court or an independent
administrative authority, and where there is no requirement that the data
concerned should be retained within the European Union’.
DRIPA expired and was repealed in December 2016 but that
was not a reaction to the CJEU judgment. It was largely replaced by powers in
the Investigatory Powers Act 2016, which (though taking account of some aspects
of Digital Rights Ireland) are now
subject to further review proceedings and are the subject of a further
reference to the CJEU. The government is proposing amendments to the powers to fit with EU law.
As Lord Lloyd-Jones observed (at [9]):
It is common-ground amongst the parties before us that the judgment of the CJEU establishes, at the very least, that where the purpose is the prevention, investigation, detection and prosecution of criminal offences:-
(1) access to and use of retained communications data should be restricted to the objective of fighting serious crime; and
(2) access to retained data should be dependent on a prior review by a court or an independent administrative body.
The Court of Appeal, having wrestled with the fact that the
CJEU ruling was ‘lacking in clarity’ and having flirted with the idea of making
no ruling at all as things had moved on, made the following declaration:
Section 1 of the Data Retention and Investigatory Powers Act 2014 was
inconsistent with EU law to the extent that, for the purposes of the prevention,
investigation, detection and prosecution of criminal offences, it permitted
access to retained data:
(a) where the object pursued by that access was
not restricted solely to fighting serious crime; or
(b) where access was not subject to prior review
by a court or an independent administrative authority.
So, while this is undoubtedly a ‘win’ for Tom Watson MP, Peter
Brice, Geoffrey Lewis, Liberty, the Open Rights Group, Privacy International
and the Law Society (and, arguably, David Davis MP), it is mainly water under
the bridge. The judgment is of limited ongoing help to those seeking to
establish the legality of the data retention powers under the IPA 2016 – still less
the legality of those powers as they will
be once the government has tinkered with them following its recent
consultation.
The government is, not unfairly, described as seeking the
widest possible powers it can get away with under EU law and under the ECHR and
one can confidently expect a further challenge to the revised powers from those
seeking to narrow them.
You can connect to a pdf of the full judgment by clicking on
the link below.
