Most EU countries favour new harmonised data retention laws

The Justice and Home Affairs Council said that representatives from the national governments of countries that make up the EU recently discussed "the consequences" of an April 2014 ruling by the Court of Justice of the EU (CJEU) which held that the previous Data Retention Directive was unlawful. The CJEU ruled that the legislation disproportionately infringed on individuals' privacy rights.

"All member states considered that retaining bulk electronic communication data in a generalized manner is still allowed," the Council said. "A majority of delegations also considered that an EU-wide approach has to be considered in order to put an end to the fragmentation of the legal framework on data retention across the EU, and invited the Commission to present a new legislative initiative whenever possible."

Among the criticisms the CJEU levelled at the Data Retention Directive was that the legislation failed to set out sufficient controls and safeguards to limit law enforcement agencies' access to communications data, and did not impose stiff enough data security obligations. It also said the Directive gave EU countries too much freedom to set lengthy data retention periods and criticised it for allowing telecoms companies subject to the Directive to store communications data outside of the EU, among other things.

UK data retention regulations implementing the old Directive were updated in light of the CJEU's ruling. The UK government drew up new stop-gap national data retention laws and the Data Retention and Investigatory Powers Act (DRIPA) came into force in July 2014. DRIPA broadly requires telecoms providers to retain information about customers' communications and to disclose that information to law enforcement agencies when asked to do so.

However, DRIPA is subject to an ongoing legal challenge. The CJEU has been asked to rule on the legitimacy of its provisions by the Court of Appeal in London.

In July this year the High Court in London ruled that DRIPA was inconsistent with EU law and ordered that section 1 of the Act be "disapplied". Section 1 of the Act does not lay down clear and precise enough rules on the use of communications data, the High Court said. It also took issues with the fact that access to the data, provided for under section 1, is also not dependent on a prior review by a court or independent body.

The order that section 1 of the Act be disapplied was suspended until 31 March 2016 to give the government time to pass fresh legislation.

Since the July ruling the UK government has pursued an appeal before the Court of Appeal and also laid out plans for an overhaul of surveillance laws. It intends for its draft new Investigatory Powers Bill to be in force by the end of 2016. That timing would coincide with the expiry of DRIPA, owing to the fact a sunset clause is inserted into the Act.