CJEU ruling preserves individual privacy in criminal investigations – Bambos Tsiattalou

Partner, Bambos Tsiattalou examines the recent Court of Justice of the European Union (CJEU) ruling which states that bulk data retention regimes must be brought within EU law and what this means for authorities such as the National Crime Agency (NCA) and their investigations.

After a six-year battle in the courts to restore the right to privacy in electronic communications, the Court of Justice of the European Union (CJEU) has ruled that the UK, French and Belgian bulk data retention regimes must be brought within EU law.

Privacy International, which brought the UK case before the UK’s Investigatory Powers Tribunal (IPT) in June 2015, had challenged the use of communications data by the British security services: GCHQ, MI5 and MI6. The British government sought to argue the regime was outside the scope of EU law. The IPT referred the case to the CJEU.

Until the Brexit transition period ends in December, the CJEU retains jurisdiction over the UK meaning that it will continue to exercise its authority over existing cases through to their completion. Its rulings therefore remain effective domestically and cases will now return to each country’s courts for them to implement the landmark judgment.

In treating everyone as a suspect, the bulk data retention regimes are now subject to the CJEU ruling: the scope of European fundamental rights to privacy, data protection and freedom of expression extends to mass data retention and collection for national security purposes. The judgment from the EU’s highest court means that, in future, mass surveillance regimes must respect privacy, even in the context of national security.

Inevitably, this will have important practical effects for national governments. When they force telecoms providers to process data, EU law must always apply, including when this is done for national security. Meanwhile, in their collection and retention of data, EU law outlines privacy safeguards which national governments must follow.

For rights campaigners, its judgment underscores the rule of law in the EU, reminding governments that they are not above the law. Critically, it also underscores the limits and controls on surveillance powers outside the national security context, and in particular the powers of the UK’s Police and investigation agencies, including most notably the National Crime Agency. The invaluable work done by the NCA helps to control and reduce levels of serious organised crime. But in the context of the events of recent months, where the NCA has trumpeted the success of the infiltration of the encrypted communications platform EncroChat, the CJEU judgment serves as a very timely reminder that in the conduct of investigations which entail widespread electronic surveillance and data harvesting, investigation agencies must be careful not to overreach. Individual freedom and the right to privacy also matter too.