80
A Democratic Licence to Operate
4.34
In the Digital Rights Ireland case at the European Court of Justice (ECJ), the EU’s 2005
Directive was challenged on the grounds of infringement of the right to private life, and
the right to the protection of personal data of individuals, as guaranteed in Articles 7 and
8, respectively, of the Charter of Fundamental Rights of the European Union. The case
was bought by the High Court in Ireland and the Constitutional Court in Austria, which
asked the ECJ to examine the validity of the Directive, in particular in light of the Charter
of Fundamental Rights. In April 2014, the ECJ declared the Directive invalid, declaring
that ‘by requiring the retention of those data and by allowing the competent national
authorities to access those data, the directive interferes in a particularly serious manner
with the fundamental rights to respect for private life and to the protection of personal
data’.20 The ECJ determined that the Directive represents a serious interference with
these fundamental rights without limiting that interference to what is strictly necessary.21
It also concluded that, in adopting the data-retention Directive, ‘the EU legislature has
exceeded the limits imposed by compliance with the principle of proportionality’.
4.35
Given that the Directive was no longer valid, this meant that, to all intents and purposes,
the secondary legislation introduced by the UK in 2009 was also invalid. A footnote to the
Court’s press release noted that this was with immediate effect, since ‘the declaration of
invalidity takes effect from the date on which the directive entered into force’.
The Data Retention and Investigatory Powers Act 2014
4.36
On 10 July 2014 the government announced that emergency legislation would be
introduced on retention of communications data. The government stated that the need
for the Bill was twofold. First, in light of the Digital Rights Ireland case, there was no
legal basis for the government to ask CSPs to retain data for any length of time; it was
therefore concerned that, unless they had a business reason to hold this data, internet
and phone companies would start deleting it, fearing legal action.22
4.37
Secondly, the government sought to ‘clarify’ the extra-territorial reach of the RIPA
2000.23 It amended the legislation to put beyond doubt that requests for interception
and communications data made to overseas companies providing communications
services within the UK are subject to the legislation. At the same time, the prime
minister announced a series of other measures, including the establishment of a Privacy
and Civil Liberties Oversight Board, half-yearly transparency reports on the use of
Bill’, 2014, p. 4.
20. Court of Justice of the European Union, ‘The Court of Justice Declares the Data Retention
Directive to Be Invalid’, press release, No. 54/14, 8 April 2014.
21. Liberty et al., ‘Liberty, Privacy International, Open Rights Group, Big Brother Watch, Article
19 and English PEN Briefing’, pp. 7–8.
22. Ward and Horne, ‘Interception of Communications’, p. 2.
23. Liberty et al., ‘Liberty, Privacy International, Open Rights Group, Big Brother Watch, Article
19 and English PEN Briefing’, p. 2.