CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
6. Privacy International v Secretary of State for Foreign and
Commonwealth
Affairs
and
Others
(Case
C-623/17;
ECLI:EU:C:2020:790) and La Quadrature du Net and Others,
French Data Network and Others and Ordre des barreaux
francophones et germanophone and Others (Cases C-511/18, C512/18 and C-520/18; ECLI:EU:C:2020:791)
124. On 8 September 2017 the United Kingdom Investigatory Powers
Tribunal (“IPT”) gave judgment in the case of Privacy International, which
concerned the acquisition by the intelligence services of bulk
communications data under section 94 of the Telecommunications Act 1984
and bulk personal data. The IPT found that, following their avowal, the
regimes were compliant with Article 8 of the Convention. However, it
identified the following four requirements which appeared to flow from the
CJEU judgment in Watson and Others and which seemed to go beyond the
requirements of Article 8 of the Convention: a restriction on non-targeted
access to bulk data; a need for prior authorisation (save in cases of validly
established emergency) before data could be accessed; provision for
subsequent notification of those affected; and the retention of all data within
the European Union.
125. On 30 October 2017 the IPT made a request to the CJEU for a
preliminary ruling clarifying the extent to which the Watson requirements
could apply where the bulk acquisition and automated processing
techniques were necessary to protect national security. In doing so, it
expressed serious concern that if the Watson requirements were to apply to
measures taken to safeguard national security, they would frustrate them
and put the national security of Member States at risk. In particular, it noted
the benefits of bulk acquisition in the context of national security; the risk
that the need for prior authorisation could undermine the intelligence
services’ ability to tackle the threat to national security; the danger and
impracticality of implementing a requirement to give notice in respect of the
acquisition or use of a bulk database, especially where national security was
at stake; and the impact an absolute bar on the transfer of data outside the
European Union could have on Member States’ treaty obligations.
126. A public hearing took place on 9 September 2019. The Privacy
International case was heard together with cases C‑511/18 and C‑512/18,
La Quadrature du Net and Others, and C‑520/18, Ordre des barreaux
francophones et germanophone and Others, which also concerned the
application of Directive 2002/58 to activities related to national security and
the combating of terrorism. Thirteen States intervened in support of the
States concerned.
127. Two separate judgments were handed down on 6 October 2020. In
Privacy International the CJEU found that national legislation enabling a
State authority to require providers of electronic communications services to
forward traffic data and location data to the security and intelligence