Home Office: EU court data ruling will not impact UK surveillance laws
The government says UK Court of Appeal will have final verdict next year on legality of powers to collect and store bulk information on UK citizens in recently passed IP Act
The Home Office has said there will be no immediate impact or changes to bulk data collection powers outlined in the recently passed Investigatory Powers (IP) Act, which were deemed illegal by the European Court of Justice (ECJ) today, until an appeal process is concluded in the UK next year.
The controversial IP Act, which has faced ongoing calls to be further amended to ensure greater clarity around its powers in areas such as the collection and storage of communications data from all UK citizens up to a period of a year, received Royal Assent late last month. It formalises several existing pieces of legislation around encryption and collecting bulk personal communications data into a single law, attracting significant controversy and criticism from rights groups, as well as MPs and peers.
A spokesperson for the Home Office said that the ECJ’s decision to deem bulk collection of communications data illegal would now be returned to the UK’s own Court of Appeal, which is expected to potentially rule on how UK laws may be affected around February time.
With the Court of Appeal going into recess this week, no changes to the IP ACT and how relevant public sector organisations can access the communications data will be made until the court comes to a decision.
The Court of Appeal had referred the issue of whether EU member states could impose a general obligation to retain data on providers of electronic communications services to the ECJ.
Providing a formal judgement today, the European court concluded that powers passed in the IP Act formalising the mass collection of details about citizen’s e-mails and online communications were against EU law.
While allowing for the targeted retention of data on the grounds of combating serious crime, the ECJ said that information obtained, persons concerned and the period of time data can be stored must be limited to what is “strictly necessary”.
“The court states that any national legislation to that effect must be clear and precise and must provide for sufficient guarantees of the protection of data against risks of misuse,” added the ruling.
In a statement, the Home Office said it was disappointed with the ECJ judgment, but would wait for the Court of Appeal to determine the case and what it may mean for the bulk data collection powers carried in the act.
“The government will be putting forward robust arguments to the Court of Appeal about the strength of our existing regime for communications data retention and access,” said the department.
“Given the importance of communications data to preventing and detecting crime, we will ensure plans are in place so that the police and other public authorities can continue to acquire such data in a way that is consistent with EU law and our obligation to protect the public.”
Labour Party MP and deputy leader Tom Watson, who submitted a filing on the powers to the courts alongside a number of parliamentarians, said the ruling had shown the danger of passing new laws “without proper scrutiny.”
“At a time when we face a real and ever-present terrorist threat, the security forces may require access to personal information none of us would normally hand over. That's why it's absolutely vital that proper safeguards are put in place to ensure this power is not abused, as it has been in the recent past,” he said.
“Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the government the power to arbitrarily seize our phone records or emails to use as they see fit. It's for judges, not Ministers, to oversee these powers. I'm pleased the court has upheld the earlier decision of the UK courts.”
Among parliamentarians backing the filing with the court of appeal, the name of Conservative MP David Davis, a fierce critic of the legislation recently appointed to the Cabinet of Prime Minister Theresa May, has since been removed from the filing.
Outside of parliament, a number of privacy and campaign groups have welcomed the ECJ ruling as a blow to the government’s ambitions to formalise security powers and broad access to UK citizen data without “independent sign-off”.
Civil rights group Liberty said the European court had concluded that parts of the IP Act and the temporary Data Retention and Investigatory Powers Act (DRIPA) it replaces were unlawful and would require urgent amendments by the government.
Liberty director Martha Spurrier argued the judgement would protect the privacy of British people from being spied on by authorities without good reason or a court-backed warrant.
“This is the first serious post-referendum test for our Government’s commitment to protecting human rights and the rule of law. The UK may have voted to leave the EU – but we didn't vote to abandon our rights and freedoms,” Spurrier said.
As well as intelligence and security-focused organisations such as GCHQ, a number of public sector organisations including central government departments, police services and specific governors in the Northern Ireland Prison Service will be able to try and obtain data under the law.
The government has previously pledged to introduce a so-called "double-lock" on powers that are deemed to be the most intrusive, which will require a senior judge's approval. An Investigatory Powers Commissioner that will view how powers are used under the legislation will also be put in place.