UK Court Defers DRIPA Internet Snooping Appeal to CJEU

The Government’s appeal to overturn an earlier ruling against their Data Retention and Investigatory Powers Act (DRIP), which found the legislation to be unlawful, has today been given a boost after the decision was formally passed on to the Court of Justice of the European Union (CJEU).

As a quick recap, DRIP was rushed into law last year after the previous Regulation of Investigatory Powers Act 2000 was declared “invalid” by the European Court of Justice (here and here), which ruled that it breached the “fundamental right to respect for private life and the fundamental right to the protection of personal data” (Charter of Fundamental Rights of the EU).

At the time the Government was still working on building a new law to expand the scope of Internet snooping (this has recently been published here), but that wasn’t going to be ready in time and so RIPA was hurriedly redrafted into the temporary replacement legislation (here)

However two ministers, David Davis MP (Conservative) and Tom Watson MP (Labour), opposed the apparent attempt to circumvent the ECJ ruling (DRIP was effectively RIPA with a few tweaks) and subsequently joined with civil rights groups in order to launch a Judicial Review at the High Court.

In July 2015 the Divisional Court agreed that EU law requires an independent approval to access communications data (this is based off an earlier judgement in the Digital Rights Ireland case), which didn’t exist in DRIP and must thus be put in place by March 2016 (here). The ruling was in respect to sections 1 and 2 of the DRIP Act that focused upon the powers needed for retaining and accessing communications data.

Divisional Court Findings for Sections 1 and 2 (DRIPA):

* Both fail to provide clear and precise rules to ensure data is only accessed for the purpose of preventing and detecting serious offences, or for conducting criminal prosecutions relating to such offences.

* Access to data is not authorised by a court or independent body, whose decision could limit access to and use of the data to what is strictly necessary. The ruling observed that: “The need for that approval to be by a judge or official wholly independent of the force or body making the application should not, provided the person responsible is properly trained or experienced, be particularly cumbersome.”

The outcome would have made it difficult for security services to conduct blanket surveillance of all citizens, although the Government wasted no time in lodging an appeal and today a final decision has been published by the Court of Appeal (here). Unfortunately it spells bad news for privacy campaigners.

The appeal court ended up taking a very different view and pointed to some “considerable doubt” about whether or not a past judgement in the Digital Rights Ireland case could be used as a basis for deciding the Judicial Review.

Court of Appeal Summary (20th Nov 2015)

In these circumstances we have come to the conclusion that we should refer the following questions to the CJEU:

(1) Did the CJEU in Digital Rights Ireland intend to lay down mandatory requirements of EU law with which the national legislation of Member States must comply?

(2) Did the CJEU in Digital Rights Ireland intend to expand the effect of Articles 7 and/or 8, EU Charter beyond the effect of Article 8 ECHR as established in the jurisprudence of the ECtHR?

We consider that the answers to these questions of EU law are not clear and are necessary in order for us to give judgement in these proceedings. For the reasons set out above, we exercise our discretion in favour of making a reference to the CJEU.

We will hear the parties as to the form of the order for reference and the precise terms of the questions to be referred. We will also hear the parties on any applications in respect of interim relief.

It’s not uncommon for such processes to take an exceptional amount of time to complete and as such the Court of Appeal called on the CJEU to “look favourably on a request from this court for the expedition of a reference.”

Never the less it seems likely that the outcome will now not be known until after DRIPA has been replaced (around the end of 2016) by the new Investigatory Powers Bill (IPB). Mind you the IPB still has plenty of challenges to overcome, not least in terms of the cost and technical implementation side.