European court to decide on legality of bulk phone and internet surveillance

Retained communications

Law and intelligence agencies across Europe collect and retain the communications data of citizens, including details of websites they have visited, records of where emails were sent and at what time, email subject lines and the location of mobile phones and call records.

This “metadata” can be used to build a highly detailed profile of an individual, including their contacts and associates, their interests and habits, and movements over time – as well as sensitive information, including their sexuality, religious beliefs and medical conditions.

European law regulating data retention has been in legal limbo since 2014, when the CJEU declared Europe’s data protection directive invalid, following a legal challenge by Digital Rights Ireland. The court concluded the directive interfered in a serious manor with individuals’ fundamental rights.

European member states have been in no hurry to reinstate a new version of the directive with stronger protections for individual privacy, giving them the freedom to continue with their existing data and potentially unlawful data retention programmes.

EU law could cripple intelligence services

The Investigatory Powers Tribunal has asked the court to decide, first, whether requiring telcos and internet companies to supply communications data to the intelligence agencies of member states falls within the scope of Union law and of the e-Privacy Directive.

Second, if the answer to the first question is yes, whether the legal safeguards in the Tele2/Watson judgment in 2016 – which found the general and indiscriminate retention of communications unlawful – should apply to the extent that they impede SIAs in national security cases.

The UK government argues that applying rulings by the ECJU and other EU law to current surveillance legislation would cripple the ability of the intelligence services to collect bulk communications data.

It claims that bulk data collection falls outside the scope of the European Union because it relates to national security rather than serious crime, arguing that Article 8 of the European Convention on Human Rights – which guarantees people the right to a private family and home life and private correspondence – provides sufficient safeguards to the public.

Member states argue for surveillance powers

Europe’s member states made 15-minute oral submissions during hearings on hearing on 9 and 10 September, arguing for the right to continue collecting bulk communications data without additional controls.

“All of the governments kept saying that generalised, indiscriminate retention is absolutely necessary,” said Siatitsa. “Every single government came up and said that, so the court is under a lot of pressure to do that.”

However, Anna Buchta, head of policy and constitution at the European Data Protection Supervisor, told the court that the data collected by governments should be limited.

She said that metadata included the subject line of emails, addresses of websites visited, date, time and length of online conversations, the geographical location of the device, email headers, telephone numbers called, and the location of terminal equipment “can be as revealing as the actual contents of the communication”.

“For example, it’s easy to infer some of the content of an email message from a subject field that reads: ‘Test results from your annual medical checkup last Monday’,” she said.

“Research has shown that a person can already be identified from a very limited amount of mobile phone location data. It has also been demonstrated that intimate details about a person’s lifestyle and beliefs, such as political leanings and associations, medical issues, sexual orientation, or habits of religious worship can be discovered through mobile phone traffic data.”

Specialised applications

Some applications for mobile devices are so specialised that just knowing they are used will allow profiling of a person. These include Grindr, which markets itself as a mobile social networking app for LGBTQ people.

Butcha said the collection of communications data should be limited to defined categories of data, each collected for a specific legal purpose. Data collection should be limited to data strictly necessary for each purpose for a limited retention period.

Governments seek prior authorisation by a court or independent administrative body before harvesting private data, “given the often very revealing nature of the data”.

There should be further controls in place after member states have collected data, with sanctions for non-compliance, periodic reviews of the data retention and access systems, and a high degree of transparency, said Buchta.

France: Real-time surveillance

France’s highest administrative court, the Conseil D’État, asked the European Court of Justice whether the e-privacy directive permits the real-time collection of traffic and location data of specified individuals, whether individuals should be informed their data has been collected once the investigation is over.

The intervention follows two lawsuits filed by the French Data Network, a non-profit organisation, the campaigning group La Quadrature du Net, the federation of internet service providers FFDN, and a non-profit internet service provider, which called for the annulment of regulations which allow the indiscriminate retention of personal data in contravention of EU law.

Privacy International, which joined the case, along with the Centre for Democracy and Technology, argues that the data protection directive and the European Charter on Fundamental Human Rights prohibit the widespread and indiscriminate retention of all user and subscriber data.

It argued that EU law does not allow national government to collect the traffic data and location data of individuals in real time without seeking prior authorisation from a court or independent body, it says in legal filings. EU law also precludes national governments collecting login data on individuals without notifying the people concerned as soon as the investigation is complete.

Privacy International claims in legal filings that communications data is “liable to allow very precise conclusions to be drawn” about people’s private lives, “such as everyday habits, permanent or temporary places of residence, daily or other movement, the activities carried out, the social relationships of those persons, and the social engagements frequented by them”.

Belgium asks for rights to continue data collection

Belgium’s constitutional court has asked the ECJU to decide whether EU law allows national legislation to compel telcos and internet service providers to retain the communications and location data for a wide range of purposes, including the investigation of serious crime, the safeguarding of national security, and defence.

The Belgian court has also asked Europe for permission to continue its collection and retention of electronic communications data on a temporary basis, and to use data previously collected and retained if the Constitutional Court found that its data retention law fails to meet EU law.

Legal action by NGOs has led to stronger oversight

The IPT submitted questions to the European Court of Justice after Privacy International filed a legal challenge over the intelligence agency’s acquisition of bulk communications under section 94 of the Telecommunications Act 1984 in June 2015.

Privacy International also challenged the UK’s intelligence agency’s acquisition of of bulk personal datasets (BPDs), which contain personal data about individuals – the majority of whom are unlikely to be of interest – such as passport databases and finance-related activity of individuals.

The Investigatory Powers Tribunal ruled in 2016 that UK intelligence agencies had been unlawfully collecting the population’s mobile phone and internet data for 17 years, without adequate safeguards or supervision. The practice remained secret until November 2015, when the government “avowed” the practice with the introduction of the Investigatory Powers Bill, known as the Snoopers’ Charter.

In a separate case, the European Court of Human Rights ruled last year that GCHQ’s use of mass surveillance of online communications data breached privacy laws and lacked sufficient oversight and safeguards.

The court acknowledged that the interception of data about people’s communications – including times and destinations of emails and phone calls, web pages visited, and mobile phone location – – poses as serious a risk to individuals’ privacy as the interception of phone calls, emails and texts.

The UK’s mass surveillance programmes do not “meet the quality of law” and were not capable of limiting “interference” to that “necessary in a democratic society”, it said, following a five-year legal battle by 11 human rights groups, including Liberty, Amnesty and Privacy International.

One concern of privacy campaigners, which does not feature in the legal arguments in the European Court of Justice, is that once intelligence agencies have collected data for national security purposes, it can potentially be repurposed for other uses, such as checking up on people’s tax status.

For example, under one programme – codenamed Milkwhite – GCHQ made huge volumes of data about people’s online activities available to MI5, the Metropolitan Police, the then Serious Organised Crime Agency, the Police Service of Northern Ireland, the Scottish Recording Centre, and Her Majesty’s Revenue and Customs (HMRC).

The court has not given a timetable for responding to the questions.

The impact of the court’s decision on the UK will largely depend on the timing of Brexit. If the UK leaves the EU before the court has reached a decision, it will no longer come under the jurisdiction of the CJEU, and will not have to comply with any legislative changes.

However, if the UK is still a member of the EU when the court releases its decision, the UK may be forced to amend its data retention legislation.