On 6th October 2020, the Court of Justice of the European Union (CJEU) found that bulk data collection and mass surveillance, conducted by the UK, France and Belgium did not respect the right to privacy, and contravened Articles 7, 8 and 11 of the EU Charter of Fundamental Rights (‘Charter’). Those being the right to the protection of personal data, right to private and family life, home and communications, freedom of expression and information, and proportionality.
In 2015, Privacy International challenged the UK’s bulk data collection by agencies such as MI5, MI6, and Government Communications Headquarters (GCHQ), as they said it was incompatible with EU law. GCHQ says it is a ‘world-leading intelligence, cyber and security agency’ who is responsible for UK’s national security. In 2016, there was a similar case involving France and Belgium’s surveillance regimes. In 2018, the French Conseil d’État (highest administrative court) referred questions regarding France’s data collection to the CJEU, which led us to this ruling delivered on 6th October.
The issues considered by the court were whether domestic legislation adopted by the aforesaid Member States, which required electronic communications service providers to forward user’s data and location data to public authorities, was lawful. The written observations submitted by the Member States said that the domestic legislation fell outside of the scope of the EU directive on privacy and electronic communications, as it was intended to safeguard national security, and this was permissible under the EU law. (Article 4(2) of the Treaty on the Functioning of the European Union (TFEU)).
However, the CJEU, in this case, held that the said laws fell within the scope of the directive. They further ruled that “the directive on privacy and electronic communication did not permit Member States to adopt, for the purposes of national security, domestic legislation intended to restrict the scope of the rights and obligations in the directive, in particular the obligation to ensure the confidentiality of communication and traffic data”.
In response to the CJEU judgment, Privacy International stated that the surveillance regimes must be changed so as to bring them within the scope of EU law. The CJEU held that ‘in situations where a Member State is facing a serious threat to national security, that proves to be genuine, present or foreseeable, the directive or the charter does not preclude it from a court order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data. It also said that national legislation can require electronic communication service providers to retain data of specific people where there is a valid reason to suspect that they are involved in terrorist activities. However, this was subject to ‘effective safeguards’ and a review by the court or an Independent Authority, whose decision would be binding.
In the context of criminal convictions brought on the back of illegal surveillance as these, the EU Court Press release, referring to the CJEU’s ruling, said that:
The directive on privacy and electronic communications, interpreted in the light of the principle of effectiveness, requires national criminal courts to disregard information and evidence obtained by means of the general and indiscriminate retention of traffic and location data in breach of EU law, in the context of such criminal proceedings, where those persons suspected of having committed criminal offences are not in a position to comment effectively on that information and evidence.
In light of this decision, there has been speculation that this ruling may affect prosecutions brought following Encrochat operation, carried out in July this year, which led to the arrest of 746 people involved in organised crime in the UK. The operation itself was an international crime sting, involving European law-enforcement cracking the secret, global and criminal chat system. Encrochat has been described as an instant-messaging system that allows criminals to plot all manner of crimes. It is now for the UK Courts to determine what impact this ruling will have on these prosecutions.
This article is intended for guidance only and must not be relied upon for specific advice.