stockphoto mania - Fotolia
The European Court of Justice (ECJ) in Luxembourg began its examination of the UK Data Retention and Investigatory Powers Act (Dripa) on 12 April 2016, in a case originally brought by two MPs, Tom Watson, the deputy leader of the Labour Party, and David Davis, a former Tory shadow home secretary.
The case was sent to the European Court by the UK Court of Appeal to check whether Dripa was compatible with the Human Rights Act, which the appeal court found it was not. The Court of Appeal had supported a July 2015 ruling by the UK High Court, which had also found the act incompatible with Articles 7 and 8, the privacy and family rights aspects of the UK Human Rights Act.
Having lost in the High Court, home secretary Theresa May appealed, but lost again in the Court of Appeal.
The case takes place in the shadow of the UK government’s attempts to get a new surveillance measure, the Investigatory Powers Bill, onto the statute book in the face of huge unease in Parliament and beyond.
Almost 500 submissions have been made by MPs and bodies outside Parliament to have the bill amended. This is believed to be the largest number of submissions made about a single act in modern times.
Neither of the MPs who brought the action, first to the UK High Court, then to the UK Court of Appeal, are lawyers, but both have proved formidable campaigners for civil rights.
In comments reported by the Guardian before the case commenced in Luxembourg, Davis said mass surveillance “made us all suspects” and destroyed the English Common law principle of being innocent until proven guilty.
Behind the scenes, the US government has run an intense lobbying campaign to oppose the case, and 15 European governments have turned up at the ECJ to contest the matter.
Alongside the US government, internet giants Microsoft, Google, Facebook and YouTube have also been lobbying to halt the proceedings.
No more Safe Harbour agreement
Both the US government and the US companies lost a critical case before the same court on 6 October 2015, when it struck down the Safe Harbour agreement, which allegedly made data transfers between Europe and the US legal.
The court also found that the US was engaged in “indiscriminate mass surveillance”, which is criminal in the UK and unlawful in both the UK and Europe. The ECJ named the nine US companies carrying out the surveillance in Europe. These included Microsoft, Google and Facebook.
Neither the US government nor the nine companies concerned can appear formally in the court, but are trying to pave the way for a revision to the Safe Harbour strike-down on an, as yet, unclear basis. There is no formal appeal available against the final Safe Harbour judgement.
The new agreement, called Privacy Shield, proposed by the European Commission to replace Safe Harbour, is itself threatened if the European Court of Justice upholds the UK courts in the Watson-Davis case, as seems likely. The court will not give its judgement before the UK Referendum on staying in the EU, due to take place on 23 June.
Trouble for the new agreement does not end in Luxembourg, however. The Article 29 Data Protection Working Party, meeting in circumstances of unusual secrecy in Paris, is understood to have heard some regulators suggest that Privacy Shield is no better than Safe Harbour and gives Europeans no protection from US “indiscriminate mass surveillance” – the problem that led to the demise of Safe harbour in the first place.
The regulators are in an unusual position. Not one of them, with budgets together totalling more than £350m a year, reacted to the Snowden revelations in 2013, which led to a single Austrian law student, Max Schrems, reaching the European Court and having the Safe Harbour arrangement struck down. Not one of the regulators, especially the UK’s Christopher Graham, has taken any action to enforce the ECJ ruling on “indiscriminate mass surveillance”. The judgement is binding in the UK.
A spokesperson for the Department of Culture, Media and Sport said the judgement had been “noted” by the UK government but “no further action was necessary”.
Read more on Privacy and data protection
EU and US start discussions on ‘enhanced’ Privacy Shield data-sharing agreement
Schrems v Facebook: European court strikes down EU-US Privacy Shield agreement
European court to decide legality of EU-US data sharing in dispute between Schrems and Facebook
Facebook: Legality of EU-US data sharing to be decided by Court of Justice