CHAPTER 5: LEGAL CONSTRAINTS
extensive criminal cases could not have been resolved without data retention”. It
indeed recognised that its judgment “may have profound implications for the detection
and prosecution of offences” (para 3.6).
5.73.
As to the detail, the District Court construed the Digital Rights Ireland criteria,
summarised at 5.68 above, as having contributed collectively to the CJEU’s
conclusions. This was helpful to the State, for it enabled the District Court to find
unobjectionable the fact that the Dutch law provided for the storage of everybody’s
data, and not just those of suspected criminals (5.68(a) and (c), above). The court
pointed out that a limitation such as that apparently envisaged by the CJEU would not
be conceivable in view of the law’s purpose of tracing serious crime: “Indeed, in the
case of a first offender, it is not possible to make a distinction in advance between
suspect and non-suspect citizens”.
5.74.
Other features of the Dutch law however rendered it disproportionate, having regard
to Digital Rights Ireland, in particular:
(a)
its failure to provide that the data should be retained within the EU, which was
described as “an essential component for the protection of the people in the
processing of personal data” (cf 5.68(i) above), and
(b)
the fact that retained data could be used in relation to “criminal offences not
sufficiently serious to justify the interference”, including bicycle theft and (it
would appear) all other offences for which a suspect could be remanded in
custody: cf. 5.68(e) above.92
These matters were said to be all the more important because access to the retained
data did not require prior authorisation by a judicial authority or independent
administrative body: 5.68(f)5.68 above. 93
English case
5.75.
The equivalent UK case is a judicial review claim by two Members of Parliament (Tom
Watson MP and David Davis MP) challenging DRIPA 2014, s1, on the grounds that it
is inconsistent with Digital Rights Ireland.94 That case was given permission by the
Administrative Court to proceed, and is currently listed for hearing in June 2015.
The future
5.76.
92
93
94
Only the courts (and ultimately, the CJEU) can pronounce authoritatively on the extent
to which Digital Rights Ireland constrains current and future UK data retention rules.
If the EU adopts a replacement Data Retention Directive, which it may do in the future,
that too will serve as a constraint. But even if (to make assumptions favourable to the
Government) the Directive turns out to have been invalidated only on the basis of the
cumulative application of the factors set out at 5.68 above, and even if the Dutch court
The District Court noted in this regard that the Data Retention Directive was a response to the terror
attacks in Madrid and London of 2004-2005.
Paras 3.9-3.11.
David Davis MP and Tom Watson MP v Home Secretary.
89