UK government told to amend communication surveillance laws

The High Court ruling on Friday concerned rules set out in the UK's Investigatory Powers Act, which came into force in November 2016.

Civil liberties group Liberty challenged the lawfulness of rules contained in the Act which concern powers of UK authorities to require telecoms companies to retain 'communications data'.

The High Court ruled the Act's communications data regime unlawful because it does not limit access to retained data "to the purpose of combating 'serious crime'", and because access to the data "is not subject to prior review by a court or an independent administrative body". The government previously admitted to the failings in the legislation.

The High Court considered an earlier ruling by the Court of Justice of the EU (CJEU) when evaluating the legislation, as well as  a ruling earlier this year by the Court of Appeal.

In December 2016, the CJEU ruled that EU law precludes EU countries from passing a law that "provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication" in order to help fight crime.

The CJEU also said that EU law does permit national law makers to, "as a preventive measure", require traffic and location data to be retained on a targeted basis, but only where the objective of the data retention rules is to fight "serious crime".

The Court of Appeal ruled in January this year that the now-expired Data Retention and Investigatory Powers Act (DRIPA) was inconsistent with EU law because it did not limit the data gathering powers to being used for "fighting serious crime" only. It also held that the Act was unlawful where it enabled access to data without "prior review by a court or an independent administrative authority".

The High Court held that the failings found with DRIPA also apply in the context of the communications data regime under part 4 of the Investigatory Powers Act. A further ruling on whether the communications data provisions are lawful when the data retention powers are exercised for national security purposes, and whether the data can be stored by the telecoms operators outside of the EU, is expected in future.

However, the High Court did rule that the Investigatory Powers Act does not require or permit "a general and indiscriminate retention of communications data".

The government welcomed the fact that the High Court did not "abolish" the entire communications data regime.

The Home Office said: "Communications data is an essential tool for law enforcement and national security investigations. It is used to investigate crime, keep children safe, support or disprove alibis and link a suspect to a particular crime scene, amongst many other purposes. The ruling means crucial powers which are used by law enforcement every day to prevent and detect crime and to keep people safe will be maintained."

Liberty called the proceedings the "first stage of its comprehensive challenge to the law".

Martha Spurrier, director of Liberty, said: "Spying on everyone’s internet histories and email, text and phone records with no suspicion of serious criminal activity and no basic protections for our rights undermines everything that’s central to our democracy and freedom – our privacy, free press, free speech, protest rights, protections for journalists’ sources and whistleblowers, and legal and patient confidentiality. It also puts our most sensitive personal information at huge risk from criminal hackers and foreign spies."

"The court has done what the government failed to do and protected these vital values – but today’s ruling focuses on just one part of a law that is rotten to the core. It still lets the state hack our computers, tablets and phones, hoover up information about who we speak to, where we go, and what we look at online, and collect profiles of individual people even without any suspicion of criminality. Liberty’s challenge to these powers will continue," she said.