Court of Justice of the European Union, Luxembourg
The UK, France and Belgium must respect privacy when carrying out mass surveillance, the European Court of Justice has ruled.
Under the ruling, the ‘general and indiscriminate transmission or retention of traffic data and location data’ is banned.
The personal data of phone and internet users can only be handed over to security services where there is a serious threat to national security, it says. The retention should be ‘limited in time to what is strictly necessary’, and effective safeguards and an independent review system need to be in place.
The case was brought by privacy campaign groups Privacy International and La Quadrature du Net, which argued that the bulk data collection or retention regimes engage European fundamental rights to privacy, data protection and freedom of expression, as guaranteed respectively by Articles 7, 8, and 11 of the EU Charter of Fundamental Rights.
“Today’s judgment reinforces the rule of law in the EU. In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies,” says Caroline Wilson Palow, legal director of Privacy International.
“While the police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power. They should focus on providing us with effective, targeted surveillance systems that protect both our security and our fundamental rights.”
The ruling will now need to be implemented by each individual country’s courts.
“This judgment is a landmark after nearly six years of actions in French courts to restore the right to privacy with respect to our electronic communications,” says Hugo Roy, who represents Privacy International in the French case.
“We hope now that the French Conseil d’ État will finally apply European human rights law standards to the French State.”
The ruling supports several previous judgements that member states can’t require providers of electronic communications services to retain traffic data and location data in a general and indiscriminate way.
This, the court concedes, ‘has caused concerns on the part of certain states that they may have been deprived of an instrument which they consider necessary to safeguard national security and to combat crime’.
In the UK, the controversial Investigatory Powers Act appears to fall foul of the new ruling. And while the country’s set to leave the EU at the end of the year, this may not solve the problem.
With the demise of Privacy Shield, EU-US data transfers are under threat because of concerns over indiscriminate bulk surveillance by the US government. This new ruling could put the UK in the same position.