The European Union’s highest court has just ruled that “indiscriminate” collection of data is impermissible under EU law. The European Court of Justice (ECJ) held that data collection is subject to stringent conditions and must be utilized “solely for the purpose of fighting serious crime”. The matter will now be sent back to British courts for further adjudication in light of the ECJ decision.
The ruling did not concern the high profile Investigatory Powers Act, or so-called “Snooper’s Charter.” As we have previously written, the IPA requires service providers to maintain particular records of user activities. A number of agencies are entitled to access these records without a warrant. These range from the Gambling Commission to Food Standards Scotland to the Northern Ireland Health and Social Care Regional Business Services Organisation. While the ECJ ruling was directed at a predecessor statute, some IPA modifications seem inevitable.
Second, the ECJ ruling required that access to collected data should be controlled by an outside authority, presumably a judge. The existing system, which conditioned access on the approval of an internal authority – a “Designated Senior Officer” – was deemed inadequate.
Third, the stringent standards set out in the ECJ ruling might be a bad omen for the long term viability of Privacy Shield, the new U.S.-E.U. data transmission framework, which is already facing its own legal challenges.
Fourth, the petitioners in the case included Tom Watson, Deputy Leader of the Labor Party, and David Davis, MP. Mr. Davis had been a backbencher when the case was instituted. He is now Secretary for Brexit in the Cabinet. (He withdrew from the case after being appointed to the Cabinet; some wags compared the episode to the Yes Minister episode on electronic surveillance). Mr. Watson interpreted the ECJ ruling as vindicated his stance that the IPA or similar laws require additional Parliamentary input.
Of course, the ruling would have minimal impact once Britain finally leaves the EU. However, absent any British concessions, the ECJ ruling could make it harder for a post-Brexit Britain to retain its “adequacy” determination. Any indication that Britain’s data processing regimen would struggle to adhere to EU standards would draw technology businesses to other EU states. There are some indications that such an exodus, particularly to Ireland, may have already begun.