The Article 29 Working Party has published its views on practices to adopt following the CJEU judgment on the Data Retention Directive (see Dr Julia Hörnle’s coverage of the judgment on the SCL site here). That judgment declared the Directive to be invalid. The ‘Statement on the ruling of the Court of Justice of the European Union which invalidates the Data Retention Directive‘ from the Working Party, which was adopted on 1 August, welcomes the ruling and urges Member States and competent EU institutions to ‘draw the consequences from the ruling which sets a new standard for national data retention legislations’.
Two things stand out on an initial reading of the Working Party’s statement. First, the statement suggests that national measures based on the invalidated Directive are not directly affected by the ruling. That brings into question the ’emergency’ that justified the extraordinarily speedy passage of the Data Retention and Investigatory Powers Act 2014.
Secondly, in suggesting that national legislatures reconsider their legislation in light of the ruling, the Working Party go on to say:
national data retention laws and practices should ensure that there is no bulk retention of all kinds of data and that, instead, data are subject to appropriate differentiation, limitation or exception. Also, access and use by national competent authorities should be limited to what is strictly necessary in terms of categories of data and persons concerned, and subject to substantive and procedural conditions. Moreover, national laws should provide for effective protection against the risk of unlawful access and any other abuse, including the requirement that the storage of the data is subject to the control of an independent authority ensuring compliance with EU data protection law.
The Working Party calls on the Commission to provide ‘without further delay’ clear guidance on the consequences of the judgment and offers its expertise to those conducting the assessment of national legislations. Both any guidance and the offer of expertise will come a little too late for Theresa May – perhaps the fear of such assistance created the true emergency.
The Working Party asks that it be consulted ‘should a new instrument be envisaged at the European level on these matters’.
One thought that does arise is that those (few) bodies that are EU based but now subject to the DRIP powers, as extended beyond the normal UK jurisdiction, may be somewhat confused by a statement from such an authoritative EU body which, at least in part, seems to conflict with the sort of powers that DRIP enables. They may ask: ‘is it safe to comply?’
