Blow for UK as 'snoopers' charter' data plan rejected
EU countries cannot force telecom operators to keep all their customers' data, the EU's top court has ruled - weighing in on a privacy debate that has raged since Edward Snowden's 2013 leak on mass surveillance by British and US spies.
Attacks in Europe have reinforced calls for security agencies to be given greater powers, but privacy advocates say mass retention of data is ineffective in the fight against such crimes.
A number of British politicians - including Brexit minister David Davis - had filed a legal challenge against an early version of the UK's Investigatory Powers Act, a 2014 surveillance law, part of which was suspended by a British court.
Opponents of mass data retention had described the move as a "snoopers' charter." The Court of Justice of the European Union (ECJ) said its ruling was based on the view that holding traffic and location data en masse allowed "very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained".
Such interference with people's privacy could only be justified by the objective of fighting serious crime and access to data should be subject to prior review by a court or independent body except in urgent cases, it said.
Governments could demand targeted data retention subject to strict safeguards, the ECJ statement said, but the data must be stored within the EU given the risk of unlawful access.
The court was responding to challenges against data retention laws in Britain and Sweden on the grounds that they were no longer valid after the ECJ struck down an EU-wide data retention law in 2014.
The ruling will make uncomfortable reading for the British government, which passed a new data retention law in November.
"On the face of it, there is quite a lot in the data retention bit of the Investigatory Powers Act (IPA) that does not comply with the conditions that the Court of Justice has laid down," said Graham Smith a partner at Bird & Bird law firm.
Privacy International, an advocacy group that intervened in the case, said the ruling raised questions about the legality of provisions in the British bill requiring telecom operators to store data for up to 12 months "for reasons that go far beyond what is strictly necessary for fighting serious crime". (Reuters)