Judgment Approved by the court for handing down.
SSHD v Watson & Others
an independent authority supervising the transfer of data out of the
European Union, thus making the bar not absolute.”
I also note that it was common-ground among the parties before the IPT that there was
uncertainty as to the scope of this obligation.
18.
The IPT also referred to an alternative submission of the claimant in those proceedings that
the requirement is only for the data itself to remain in the European Union and not the product
of the data. The Tribunal, while noting that, if that is so, it is less of a restriction, observed (at
paragraph 65) that the reference in paragraph 123 to a potential claim by a person “seeking
the protection of their data” would not appear to support this reading. The Tribunal went on
to observe (at paragraph 67) that a requirement imposing an absolute bar would appear to be
in clear conflict with earlier decisions of the CJEU in Joined Cases C-317/04& C-318/04
Parliament v Council (EU:C:2006:346) as approved in Case C-301/06 Ireland v Parliament
(EU:C:2009:68) and with the opinion of AG Mengozzi relating to the draft agreement
between Canada and the European Union on the transfer and processing of passenger name
record data (Opinion 1/15 (EU:C:2016:656), 8 September 2016). It further observed that this
would also appear to be in conflict with Article 25 of the Data Protection Directive under
Chapter IV of the directive, entitled “Transfer of Personal Data to Third Countries”. As a
result this issue now features large in the reference made by the IPT to the CJEU.
19.
In these circumstances there remains considerable uncertainty in relation to this further
requirement for which the Respondents and the Interveners contend. It is to be hoped that
these uncertainties, which inevitably affect the vital interests of Member States, will be
clarified by the CJEU when it considers the reference made by the IPT. However, as matters
stand, I do not consider that this court should make a definitive statement on this issue in the
form of a declaration.
Notification Requirement
20.
The Respondents and the Interveners submit that this court should also make a declaration to
the effect that the failure of DRIPA to make provision for ex post facto notification to persons
affected infringes EU law. They base this submission on para 121 of the judgment of the
CJEU which states:
“Likewise, the competent national authorities to whom access to the
retained data has been granted must notify the persons affected,
under the applicable national procedures, as soon as that notification
is no longer liable to jeopardise the investigations being undertaken
by those authorities. That notification is, in fact, necessary to enable
the persons affected to exercise, inter alia, their right to a legal
remedy, expressly provided for in Article 15(2) of Directive 2002/58,
read together with Article 22 of Directive 95/46, where their rights
have been infringed …”
21.
In my view, however, it is not appropriate to make such a declaration for the following
reasons. First, this has not previously been an issue in the national proceedings. Mr Jaffey
told us that this point was argued at the oral hearing of the reference in Luxembourg but he
accepted that the point had only been touched on briefly in the national proceedings.
Contrary to his submission, paragraph 29 of the order for reference in the present proceedings
does not address this issue but the powers of the Interception of Communications
Commissioner. Secondly, although the significance of this is not entirely clear, this
requirement is not included in the dispositif of the CJEU judgment in the present case where
the other Watson requirements are recited. Thirdly, it is clear that this will be an issue before