February 12, 2018

This case concerned the judicial review proceedings brought by British MPs Tom Watson and David Davis, challenging the validity of data retention powers under s 1 of the Data Retention and Investigatory Powers Act 2014, which allowed the Home Secretary to require public telecommunications operators to retain communications data (other than the actual content of any communication) for a maximum period of 12 months. That legislation has now expired and has been replaced by the Investigatory Powers Act 2016, which contains a similar requirement.

In its judgment of 20 November 2015, the Court of Appeal referred two questions to the Court of Justice of the European Union seeking clarification of the judgment in Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources.

Responding to the Court of Appeal’s questions, the CJEU said that EU law precluded national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication.

It also found that EU law precluded national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review of a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the EU.

Back in the Court of Appeal, it was common ground amongst the parties that the judgment of the CJEU established, at the very least, that where the purpose is the prevention, investigation, detection and prosecution of criminal offences:

• access to and use of retained communications data should be restricted to the objective of fighting serious crime; and
• access to retained data should be dependent on a prior review by a court or an independent administrative body.

Accordingly, the Court of Appeal held that it was appropriate to grant declaratory relief, limited to the context of the prevention, investigation, detection and prosecution of criminal offences, to the effect that DRIPA was inconsistent with EU law to the extent that it permitted access to retained data, where the objective pursued by that access was not restricted solely to fighting serious crime, or where access was not subject to prior review by a court or an independent administrative authority.

The judgment will be relevant to the Investigatory Powers Act 2016, Part 4 of which is itself the subject of a judicial review claim brought by Liberty. In addition, in proceedings brought by Privacy International against the Secretary of State for Foreign and Commonwealth Affairs, the Investigatory Powers Tribunal has made a further reference to the CJEU seeking to clarify the extent to which, if at all, the requirements set out in the CJEU’s judgment in Tom Watson’s and David Davis’s case apply in a national security context. (Secretary of State for the Home Department v Tom Watson MP [2018] EWCA Civ 70 (30 January 2018) — to read the judgment in full, click here).