The widespread collection and retention of electronic communications allowed by the UK's Investigatory Powers Act is illegal, Europe's highest court has ruled, dealing a major blow to the government's so-called snooper's charter.
The court said the “general and indiscriminate retention” of emails and electronic communications by governments was illegal, and only the targeted interception of traffic and location data is justified when it is necessary to combat serious crime.
Read more: What is the IP Act and how will it affect you?
The ruling in the judgment means that the court could trigger challenges against the new act.
Both the House of Lords and the House of Commons recently passed the IP bill into law, the biggest overhaul of surveillance powers for more than a decade. Under the new act, security services and police forces will be able to access communications data when it is needed to help their investigations, meaning all internet history data would have to be stored for 12 months. It is this issue that the ECJ has named “illegal”.
A legal challenge was brought by Brexit secretary David Davis and Labour deputy leader Tom Watson over the legality of what was then the Data Retention and Investigatory Powers Act 2014, since replaced by the IP bill. The aim of the challenge was to clarify the EU law on surveillance.
The two MPs had won a high court victory on the issue but the government appealed the decision, which is why the case was referred to the ECJ.
“With respect to retention, the retained data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained," the ECJ explained in its ruling.
“The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance. Consequently, only the objective of fighting serious crime is capable of justifying such interference.
"The Court states that legislation prescribing a general and indiscriminate retention of data does not require there to be any relationship between the data which must be retained and a threat to public security and is not restricted to, inter alia, providing for retention of data pertaining to a particular time period and/or geographical area and/or a group of persons likely to be involved in a serious crime."
Under the IP bill, a total of 48 public authorities, including the Metropolitan Police, GCHQ, the Ministry of Defence and the Department for Work Pensions, will all have access to internet connection records. Internet service providers will have to store metadata about communications made through their services, the websites you visit and what time you do it, as well as what device you access it on under the act, in case government agencies need to use them in criminal cases.
The statement from the court continued: “Such legislation therefore exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society, as required by the directive, read in the light of the charter”
Though some may call this a victory against the snooper’s charter, Davis is currently negotiating the UK’s withdrawal from the EU, which would mean the ECJ no longer has judicial authority. After that, it would remain to be seen if this ruling has any impact on UK law.
This article was originally published by WIRED UK
