Following an application for judicial review by Liberty (the National Council for Civil Liberties). The High Court has ruled that Part 4 of the Investigatory Powers Act 2016 (the “Act”) is incompatible with European law. Broadly, this part of the Act allows the government to require that communications companies store customer emails, phone calls, internet history and location data in order that security personnel can access it. The High Court held that it is incompatible with fundamental rights in EU law in that access to retained data is not limited to the purpose of combating “serious crime”; and access to retained data is not subject to prior review by a court or independent administrative body (paragraph 186 of the judgment).
This decision follows a Court of Appeal ruling in January that the Data Retention and Investigatory Powers Act was inconsistent with EU law due to its lack of sufficient safeguards. This decision followed an ECJ preliminary ruling on the matter, which stated that EU law precludes “national legislation which, for the purpose of fighting crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication.” The High Court noted at paragraph 4 of its judgment that part 4 of the Act “substantially re-enacts the Data Retention and Investigatory Powers Act 2014”.
Following these rulings, the government had indicated that it would amend Part 4 of the Act by secondary legislation, but until this happened, the unlawful retention of data was continuing; hence Liberty’s application for judicial review. The High Court’s ruling sets a deadline of 1 November 2018 for the requisite amendments to be made.
Anyone with questions regarding this development, data privacy and retention, and data protection more generally, please contact Jose Saras.