Judgment Approved by the court for handing down.
41.
Davis & Ors v SSHD
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I.
2003/2426) implemented the e-Privacy Directive in the United Kingdom.
Data Retention (EC Directive) Regulations 2007 and 2009
42.
The Data Retention Directive was implemented in the United Kingdom with respect
to fixed network and mobile telephony by the Data Retention (EC Directive)
Regulations 2007 (S.I. 2007/2199) (“the 2007 Regulations”). The 2007 Regulations
were superseded by the Data Retention (EC Directive) Regulations 2009 (S.I.
2009/859) (“the 2009 Regulations”), which contained additional provisions relating to
internet access, internet telephony and email.
Regulation of Investigatory Powers (Communications Data) Order 2010
43.
This statutory instrument set out the office holders designated for the purposes of
chapter II of RIPA and thus permitted to grant authorisations or give notices under
that statute. The same provisions are incorporated by reference into DRIPA. An
example is that a police superintendent may give a notice in relation to traffic data or
service data but a police inspector may give a notice in relation to subscriber data.
Digital Rights Ireland
44.
In Digital Rights Ireland the CJEU held that the Data Retention Directive was invalid.
The reasoning of the CJEU in Digital Rights Ireland is so central to the present case
that we set it out in full in Appendix 1.
45.
The invalidation of the Data Retention Directive by the CJEU put in doubt the legal
basis for requiring the continued retention of communications data under the 2009
Regulations. Although the 2009 Regulations remained in force, they had been made
under s. 2(2) of the European Communities Act 1972 to implement the Data Retention
Directive and were already subject to a legal challenge that had been stayed pending
the outcome of the Digital Rights Ireland case. We were told that following the
Digital Rights Ireland judgment, some CSPs expressed the view that there was no
legal basis for them to continue to retain communications data, and indicated that they
would start to delete data that had been retained under the 2009 Regulations.
46.
The absence of a clear legal power to require communications data to be retained
threatened the ability of UK law enforcement and intelligence agencies to use
communications data to investigate criminal activity and protect the public. The fact
that DRIPA was a response to Digital Rights Ireland is apparent from the opening
words of the long title of the statute, describing it as: “An Act to make provision, in
consequence of a declaration made by the Court of Justice of the European Union in
relation to Directive 2006/24/EC, about the retention of certain communications
data……”. Mr Regan’s evidence notes that the Bill was fast-tracked through
Parliament. It passed through all its stages in the House of Commons on 15 July 2014,
was considered by the House of Lords on 16 and 17 July, and received the Royal
Assent on 17 July.
The 2014 Act (DRIPA)
47.
Section 1 of DRIPA provides as follows: