lawyer

#UK High Court strikes down British data retention law - POLITICO

Latest

18/7/15 11:12 AM CEST

17/7/15 11:37 AM CEST

The company is being investigated over allegations it paid bribes as part of a fraudulent bidding process.

16/7/15 11:41 AM CEST

The law gave authorities a way to force communications providers to store records of customer activity.

17/7/15, 11:37 AM CET

Updated 17/7/15, 12:39 PM CET

The U.K. High Court struck down a key piece of the country’s surveillance legislation on Friday, but gave the government nine months to rewrite it.

The Data Retention and Investigatory Powers Act (DRIPA) had been fast-tracked a year ago as “emergency” legislation, after Europe’s highest court struck down the data retention directive for the European Union.

The U.K. law gives enforcement and intelligence agencies a way to force communications providers to store records of their customers’ activities.

However, the High Court agreed with Members of Parliament David Davis and Tom Watson, who challenged the law on the grounds it lacked sufficient privacy and data-protection safeguards.

This is the first time a British national court has struck down primary legislation in the country, and the first time that a member of parliament has brought a successful judicial review against the government.

“The court has recognized what was clear to many last year, that the government’s hasty and ill-thought-through legislation is fatally flawed,” Davis said in a statement.

Specifically, the court said the law failed to provide clear and precise rules for ensuring that the stored data could only be accessed in cases involving serious offences. DRIPA also did not give courts or an independent body control over who gets to access the data.

The Home Office said it will appeal the High Court’s ruling.

Security Minister John Hayes said in a statement that communications data, which indicates who contacted whom and when, was “fundamental” information for investigations that are not classified as a “serious crime,” such as harassment or missing persons.

“Communications data that could potentially save lives would only be available to the police and other law enforcement if a communications company had decided to retain it for commercial reasons. We believe that is wrong,” Hayes said.

Davis, a Conservative backbench MP with a long history of civil liberties advocacy, said the court’s decision was in line with recent surveillance law reports from David Anderson, the anti-terror legislation watchdog, and the Royal United Services Institute.

Watson, who is currently running for the deputy leadership of the Labour Party, said, “The government gave MPs one day to discuss the legislation which was wrongly represented as respectful of people’s right to privacy: it has until March 2016 to make sure that the law is re-written.”

In April 2014, the Court of Justice of the European Union (CJEU) struck down the data retention directive, which said phone and Internet companies had to store communications data for between six months and two years.

The court struck down the directive largely because of poor access controls, although it was also concerned that citizens were not being informed about who was holding their data, and that some of the data might unlawfully leave the EU.

The U.K.’s data retention regulations were based on the EU directive, so the CJEU ruling invalidated them. The British government revealed the DRIP bill in July 2014 as a way of shoring up those powers, and it was passed into law one week later.

The legislation has a sunset clause that means it will run out at the end of 2016.

It builds upon the 15-year-old Regulation of Investigatory Powers Act (RIPA,) which only explicitly covers telephone, SMS and email.

DRIPA extended the RIPA powers to take in anything that “consists in or includes facilitating the creation, management or storage of communications.” This allows the authorities to target a wide range of online communications.