data have been collected by private operators for
commercial purposes and it is they who arrange for
their transfer to a third country, the transfer in
question is not covered by that provision. The transfer
falls within a framework established by the public
authorities that relates to public security.
59.
ii)
It follows from the foregoing considerations that the
decision on adequacy concerns processing of personal
data as referred to in the first indent of Art.3(2) of the
Directive. That decision therefore does not fall within
the scope of the Directive.”
Digital Rights Ireland Ltd v Communications Minister [2015] QB 127
(“DRI”). This was adopted and applied by the Grand Chamber in Watson.
DRI related to provisions in the then Data Retention Directive 2006/24/EC
(“the DRD”), which required PECNs to ensure the retention of personal data
for the purpose of fighting serious crime, and found them to be in breach of
Articles 7 and 8 of the Charter, and consequently invalid. DRIPA, the statute
passed by the UK legislature (but with a ‘sunset clause’ expiring at the end of
2016) to replace the DRD, which was the subject (together with a Swedish
statute) of Watson, was obviously very analogous. The Court in DRI laid
down requirements in relation to the data so retained by the operators which
formed the basis of the Watson Requirements.
Watson
23.
The first of the two conjoined cases in Watson related to a Swedish statute
which authorised the collection of data, in the context of criminal offences
punishable by a term of imprisonment of 2 years, or in some cases less.
DRIPA, as described in paragraph 19 above, provided for a retention notice
requiring PECNs to retain communications data if the Secretary of State
considered it necessary and proportionate for one or more of the purposes
Page 20