Out-Law News 3 min. read
10 Jul 2014, 4:38 pm
Prime minister David Cameron insisted that the new laws will not create new tracking powers and will only restore the legal situation to what it was before the Court of Justice of the European Union (CJEU) ruled that the Data Retention Directive was unlawful because it disproportionately affected people's rights to privacy.
The CJEU ruled in April and the government statement announcing the legislation said that there was a risk that "unless they have a business reason to hold this data, internet and phone companies will start deleting it which has serious consequences for investigations".
"We are not introducing new powers or capabilities – that is not for this parliament," said Cameron. "This is about restoring two vital measures ensuring that our law enforcement and intelligence agencies maintain the right tools to keep us all safe."
Data retention laws are not about recording or storing the content of phone calls or emails but the data related to it, such as when a call was made and between what two numbers, or when a site was accessed from which IP address. The government said that this data has become vital in detecting and prosecuting crime.
Technology law expert John Salmon of Pinsent Masons, the law firm behind Out-Law.com, said that in order to survive future legal challenges the new laws cannot simply demand that data is retained for blanket periods of time.
"The extent to which the proposed bill could be subject to a challenge will depend upon the period of time for which data may be retained and the criteria that is proposed for setting that timeframe," said Salmon. "The CJEU was very clear when it said that it is not enough simply to propose a timeframe whether that be six months, 12 months or two years. Any local law seeking to retain data must also set out objective criteria, which ensures that the retention period is limited to what is strictly necessary for the purposes for which it is being retained."
Digital rights campaign group the Open Rights Group (ORG) has said that the government is acting now because a judicial review lodged by Tracey Cosgrove in 2011 is likely to find the legal basis of the previous laws flawed in light of the CJEU ruling.
"The judicial review was initially stayed pending the outcome of the CJEU judgment and until now the judicial review proceedings have not been public knowledge," said an ORG statement. "The home secretary has now confirmed that she has notified the High Court of the CJEU judgment. The judicial review claim will therefore proceed. If the judicial review is successful, the UK Regulations will be declared unlawful by a UK court. The proposed legislation is an attempt to avoid this. Unless any new legislation takes account of the CJEU judgment it will also be open to immediate challenge."
An ORG spokesman said that it believed that the new government proposals would not survive a legal challenge. "The proposed measures have the same flaws as the ones rejected by the CJEU, they are a blanket retention that interferes with the right to privacy," he said.
The proposed Data Retention and Investigatory Powers Bill (9-page / 153KB PDF) requires telcos to keep data "for up to 12 months".
Security minister James Brokenshire told the House of Commons last month that the government was still considering the CJEU ruling but "we consider that the UK Data Retention (EC Directive) Regulations 2009 remain in force. Those in receipt of a notice under the regulations have been informed that they should continue to observe their obligations as outlined in any notice".
Labour MP Tom Watson has criticised the use of emergency legislation to implement the proposed law, telling BBC Radio 4's Today programme that it was a "stitch up" that would not give MPs time to scrutinise the law.
The proposed law has cross-party support and could be passed by parliament as early as next week.
The government said that the law included a 'sunset clause' which means that to continue to have effect beyond 2016 it will need to be considered by the next government, and that there will be a review of interception law the Regulation of Investigatory Powers Act (RIPA) by 2016.
