On 20 November 2015 the UK's Court of Appeal referred questions on data retention to the Court of Justice of the European Union (CJEU) following a challenge to the Data Retention and Investigatory Powers Act (DRIPA) 2014.
The referral to the CJEU is significant as it could finally provide clarification as to the application of the CJEU's decision in Digital Rights Ireland, which found Directive 2006/24/EC (Data Retention Directive) invalid, and the extent to which Member States can impose national data retention obligations.
Directive 2006/24/EC and the decision in Digital Rights Ireland
The UK enacted DRIPA last year, using emergency procedures, following the CJEU's decision in Digital Rights Ireland that invalidated the data retention obligations imposed on publicly available electronic communications services and networks because the data retention obligation conflicted with data protection rights under Data Protection Directive 95/46/EC.
The Data Retention Directive attempted to harmonise the data retention laws of the Member States by requiring national legislation to impose obligations on telecommunications operators to retain certain data that could be accessed by national authorities for the purposes of detecting and investigating serious crimes. The CJEU found that such obligations constituted an interference with Article 7 (Respect for Private and Family Life) and Article 8 (Protection of Personal Data) of the European Charter of Human Rights (the "Charter"), and ruled that the Directive was invalid. Following that decision, the UK enacted DRIPA which set out new data retention obligations on telecommunications operators.
Challenges to DRIPA
In July 2015 the legality of DRIPA was challenged by way of a judicial review. The Divisional Court, following Digital Rights Ireland, declared that the data retention provisions of DRIPA were incompatible with Articles 7 and 8 of the Charter. That decision was appealed to the Court of Appeal.
The Court of Appeal chose to refer questions to the CJEU rather than issue a ruling at this stage. Reference to the CJEU relates to each of Austria, Slovenia, Belgium, the Netherlands, Romania and Slovakia, invalidating their national data retention legislation following Digital Rights Ireland.
The UK Court of Appeal has referred two questions seeking to understand whether the CJEU in Digital Rights Ireland intended to lay down mandatory requirements of EU law with which the national legislation of Member States must comply and to expand the effect of Articles 7 and/or 8 of the EU Charter beyond the effect of Article 8 as established in the jurisprudence of the European Court of Human Rights of the Council of Europe (ECHR).
Despite referral to the CJEU, the Court of Appeal has stated that its provisional opinion is that the CJEU was not laying down definitive mandatory requirements in relation to retained communications data in the Digital Rights Ireland case. The Court of Appeal has asked that CJEU to expedite its decision and to hear the matter alongside the Swedish case of Tele2 Sverige AB in which the Stockholm Administrative Court of Appeals has referred similar questions.
Ideally the CJEU will issue its decision before DRIPA is due to come into force in mid-December 2015. Typically the CJEU has not expanded rights beyond the ECHR's jurisprudence, and in light of the recent terrorist attacks in France and the lockdown of Brussels, the balancing of privacy rights and national security is at a crucial point. If the Court of Appeals' provisional opinion is correct that Digital Rights Ireland did not expand the scope of human rights under the Charter of Europe, we could see many other Member States follow the UK and enact new data retention legislation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
