Judgment Approved by the court for handing down.
Davis & Ors v SSHD
purposes listed in article 13(1) of the Data Protection Directive. The claimants accept
that this decision is binding on us but reserve the point should the present case go to
the Supreme Court. We therefore need say no more about it.
Retention notices
64.
The evidence before us does not include, even in a redacted form, the contents of any
retention notice. In his evidence on behalf of the Secretary of State Paul Regan, Head
of the Counter-Terrorism Legislation and Investigatory Powers Unit in the Home
Office, states that the Home Office does not intend to publicise either the content of
such notices or the identity of the CSPs to whom they are given. He explains:“…This is because to do so would risk undermining national
security and the prevention and detection of crime and for
reasons of commercial confidentiality. To provide a
confirmation or denial as to whether a notice has been given to
a specific CSP or to disclose any details of such a notice would
allow interested parties to determine the extent and scope of
work in this area. This would provide an insight into what the
limit or scope of operation capability might be. Information
concerning operation capability in respect of law enforcement
and national security is highly sensitive information. It would
be of significant value to criminal or terrorist groups. If, for
example, the Home Office were to confirm that no notice had
been given to a particular company, criminals and terrorists
may choose to use that company rather than companies they
know or suspect could be subject to a notice.”
65.
Mr Eadie accepted that the consequence of this policy stance is that we should test the
validity of DRIPA on the assumption that the retention notices issued under it may be
as broad in scope as the statute permits, namely a direction to each CSP to retain all
communications data for a period of 12 months. The case was argued on both sides on
that basis. We shall refer in this judgment to a system under which the State may
require CSPs to retain all communications data for a period as a “general retention
regime”.
66.
It was also accepted on all sides that it is unnecessary for any of the Claimants to
show that public authorities have in fact acquired their communications data. The
ECHR said in Weber and Saravia v Germany (2008) 46 EHRR SE5 at [78]:
“The Court further notes that the applicants, even though they
were members of a group of persons who were likely to be
affected by measures of interception, were unable to
demonstrate that the impugned measures had actually been
applied to them. It reiterates, however, its findings in
comparable cases to the effect that the mere existence of
legislation which allows a system for the secret monitoring of
communications entails a threat of surveillance for all those to
whom the legislation may be applied. This threat necessarily
strikes at freedom of communication between users of the
telecommunications services and thereby amounts in itself to an