Chapter 25 Answer guidance to end of chapter questions

1. YourSpace is an online social media and messaging platform. It is expanding its operations across the EU and wants particularly to provide its services in the UK. The YourSpace board have been advised they may need to comply with s.87 (including s.87(11) ‘internet connection records’) of the Investigatory Powers Act 2016. YourSpace is concerned about the costs that such a retention requirement will entail for it and seeks your legal advice on the potential viability of a successful legal challenge against any retention notice issued on it under s.87.

Advise YourSpace.

To answer this question I would expect the student to discuss:

  1. The scheme for retention notices found in the Investigatory Powers Act.
  2. The legal basis for the striking out of the original Data Retention Directive as found in Digital Rights Ireland. They should note that the court held that Directive 2006/24 (now repealed) did not lay down any objective criterion by which the number of persons authorised to access and subsequently use the data retained is limited to what is strictly necessary in the light of the objective pursued. Above all, the access by the competent national authorities to the data retained is not made dependent on a prior review carried out by a court or by an independent administrative body whose decision seeks to limit access to the data and their use to what is strictly necessary for the purpose of attaining the objective pursued and which intervenes following a reasoned request of those authorities submitted within the framework of procedures of prevention, detection or criminal prosecutions. Nor does it lay down a specific obligation on Member States designed to establish such limits. They should note that the scheme for retention notices found in the Investigatory Powers Act gives not subject to “a prior review carried out by a court or by an independent administrative body”
  3. They should then discuss the Davis & Ors challenge to DRIPA. They should note that the High Court found DRIPA s.1 to be unlawful as “section 1 of the Data Retention and Investigatory Powers Act 2014 is inconsistent with European Union law in so far as: (a) it does not lay down clear and precise rules providing for access to and use of communications data retained pursuant to a retention notice to be strictly restricted to the purpose of preventing and detecting precisely defined serious offences or of conducting criminal prosecutions relating to such offences; and (b) access to the data is not made dependent on a prior review by a court or an independent administrative body whose decision limits access to and use of the data to what is strictly necessary for the purpose of attaining the objective pursued.” However they should note that the Court of Appeal did not believe it was the intent of the CJEU to lay down a mandatory requirement automatically applicable to national legislation. In fact the court thought this was highly unlikely: ‘we consider that it would be surprising if the CJEU were here seeking to lay down a mandatory minimum standard of universal application without referring to any of the relevant case law and without any consideration of the competing considerations.’ 
  4. The outcome of the Tele2 decision that ‘given the seriousness of the interference in the fundamental rights concerned represented by national legislation which, for the purpose of fighting crime, provides for the retention of traffic and location data, only the objective of fighting serious crime is capable of justifying such a measure.’ Limiting the scope of s.87 but noting that on the general principle of data retention the court found that Art.15(1) ‘does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data, for the purpose of fighting serious crime, provided that the retention of data is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary.’
  5. Students may note that in two subsequent cases R (Liberty) v Secretary of State for the Home Department and R (Liberty) v Secretary of State for the Home Department (Liberty II) although procedural flaws in the data retention scheme have been identified the broad legitimacy of the regime has not been questioned.

2. Systematic bulk digital surveillance can never be compatible with the right to a private life under Art.8 ECHR.

Discuss.

This is a very open question and there are many ways to answer this. Here is one outline:

  1. Begin with a discussion of privacy as a fundamental right. This is beyond the scope of this book, but any law student should be familiar with this – see for example Nissenbaum Privacy in Context: Technology, Policy, and the Integrity of Social Life or Richards, Why Privacy Matters.
  2. Discuss the Scope of Article 8 ECHR and note in particular the limits imposed by Art.8(2) “necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime”.
  3. To discuss the relevant line of surveillance ECtHR case law – Klass & Ors. v Germany, Malone v UK, Kruslin v France, S & Marper v UK.
  4. Discuss how the warrants system works under IPA with both targeted and bulk interception warrants then focusing on bulk interception as the question directs.
  5. An analysis of the extensive UK and ECtHR case law Liberty & Privacy International v GCHQ, Roman Zakharov v Russia, Szabó & Vissy v Hungary, Centrum För Rättvisa v Sweden and Big Brother Watch v UK shows a move to a more permissive approach from the ECtHR with the latter cases leading perhaps to .The Grand Normalization of Mass Surveillance’.
  6. By analysing these cases the student should answer the question.
Back to top