{"id":110,"date":"2018-02-03T10:24:23","date_gmt":"2018-02-03T10:24:23","guid":{"rendered":"http:\/\/counterterrorismreview.com\/?p=110"},"modified":"2020-08-20T10:03:25","modified_gmt":"2020-08-20T09:03:25","slug":"the-dripa-of-watson","status":"publish","type":"post","link":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/2018\/02\/03\/the-dripa-of-watson\/","title":{"rendered":"The DRIP(A) of Watson"},"content":{"rendered":"

Originally posted on the SCRIPTed Blog<\/a> on 3 February 2018<\/p>\n

Lydia Morgan<\/em>[1]<\/a><\/p>\n

Despite Security Minister Ben Wallace\u2019s attempts to downplay it,[2]<\/a>\u00a0\u00a0the Court of Appeal\u2019s ruling in the\u00a0Watson\u00a0<\/em>case (SSHD v Watson & others<\/a>)[3]<\/a>\u00a0continues the drip of cases finding the Government\u2019s draconian attempt to access bulk communications data (BCD) unlawful. \u00a0Concerning the now expired sections 1 and 2 of Data Retention and Investigatory Powers Act 2014 (DRIPA), the ruling impacts Part 4 of the Investigatory Powers Act 2016. Although\u00a0amendments are already tabled<\/a>, the upcoming judicial review brought by Liberty means the Government should heed the court\u2019s warning.\u00a0\u00a0Watson<\/em>\u00a0and related cases centre on the state\u2019s power to retain and access bulk communications data and privacy and communications rights.[4]<\/a>\u00a0 In this knotty area three key lessons can be found.<\/p>\n

The\u00a0Purpose\u00a0<\/em>of Data Retention matters<\/h1>\n

The ruling relates to\u00a0EU directives<\/a>\u00a0on Privacy and Electronic Communications[5]<\/a>\u00a0and a December 2016\u00a0Court of Justice of the European Union (CJEU) Grand Chamber three part ruling<\/a>.[6]<\/a>\u00a0 First, it is unlawful for a domestic law to provide for the general and indiscriminate retention of all traffic and location data (sometimes referred to as metadata).\u00a0 Second, any power which gives a public authority the power to access or compel access to retained data must (a) only be for the purpose of fighting serious crime;\u00a0[7]<\/a>\u00a0(b) have prior approval from a court or an independent authority;[8]<\/a>\u00a0and (c) ensure the data remain within the EU.[9]<\/a>\u00a0These are known as the\u00a0Watson Requirements.<\/em>\u00a0Finally, the CJEU refused to rule on the potential conflict between the\u00a0EU\u2019s Charter of Fundamental Rights<\/a>\u00a0and the European Convention on Fundamental Rights (ECHR).\u00a0 I will not comment on this third issue.<\/p>\n

According to the Court of Appeal, DRIPA 2014 did not meet the CJEU\u2019s conditions. It neither restricted data access to fighting serious crime nor required prior approval, which means it was inconsistent with EU law (or would have been were DRIPA still in force).[10]<\/a>\u00a0 While the significance of this must not be understated \u2013 it continues to dent the UK\u2019s ambition to access and retain as much data as possible \u2013 the lack of declaration on issue one and part (c) of issue two is interesting, but not necessarily unsurprising.<\/p>\n

The Court did not rule on part one because the issue relating to Part 4 IPA 2016 is the subject of Liberty\u2019s judicial review, due to be heard in late February.\u00a0 The Court further claimed the relevant part of the\u00a0dispositif<\/em>\u00a0was directed to a Swedish law even though it could be regarded as having general application (and Lord Lloyd-Jones initially thought so).[11]<\/a>\u00a0 Unusually, the court allowed further submissions after the draft judgement was circulated in which the Government argued that upholding part one relied on a restrictive and inaccurate interpretation of\u00a0Digital Rights Ireland<\/em>\u00a0(the original impetus for DRIPA).[12]<\/a>\u00a0 It will be interesting to see if the Court agrees in upcoming judicial review.<\/p>\n

The government thinks rights are always less important than national security<\/h1>\n

When it comes to national security, the government, the courts and the Security and Intelligence Agencies (SIAs) get rather exercised.\u00a0 They argue, with some considerable force, that national security is the paramount government responsibility and sits squarely within the realm of prerogative power.\u00a0 In other words, the courts, UK or European, have no business of telling the government what it can and cannot do.\u00a0 This is a long established area of law.[13]<\/a>\u00a0Repeating a recent related decision by the Investigatory Powers Tribunal (IPT), the Court of Appeal highlighted how far national security co-opts the courts.\u00a0 The use of bulk communications data is \u2018essential\u2019 to national security and can identify \u2018previously unknown\u2019 threats to national security swiftly and provide a basis for action \u2018in the face of an imminent threat.\u2019[14]<\/a>\u00a0Further, as the UK courts have previously found the regime consistent with ECHR requirements, were the\u00a0Watson requirements<\/em>\u00a0enforced it would \u2018frustrate\u2019 national security.[15]<\/a><\/p>\n

Don\u2019t be fooled by the legal-ese here, these are strong words.\u00a0 If the powers to compel retention of data and the provision of access to SIAs are not upheld in the scheme as it stands, the CJEU would be putting UK national security at risk.\u00a0 The continued attempts to fight restrictions on access to data, the strength of the words and the fraught back and forth judgements between the UK courts and the CJEU indicate how little regard the UK government has to privacy and other digital rights.\u00a0 National security is used as a blanket justification for expansive and intrusive surveillance and the UK courts appear minded to accept it.<\/p>\n

Data Transfer outside the EU might be permitted with \u2018safeguards\u2019<\/h1>\n

The transfer of the data retained and accessed outside the EU is one of the muddier parts of the Court of Appeal\u2019s ruling, except that it declined to rule on it.\u00a0 The line to take note of comes in paragraph 17 of the judgement.\u00a0 The court noted the CJEU judgment could be interpreted as saying either (a) that the data could never be transferred outside of the EU, or (b) the data should be retained within the EU, except when there were \u2018adequate safeguards\u2019 or when the transfer only concerned related products but not the data itself.\u00a0 The\u00a0Privacy International<\/em>\u00a0ruling suggested \u2018independent authority\u2019 supervision would be an adequate safeguard.[16]<\/a>\u00a0 It is not entirely surprising that these suggestions have been made.\u00a0 The use of independent and expert authorities to \u2018check\u2019 the government\u2019s potential infringement of rights has grown in the last decade or so.\u00a0 Quite whether these systems actually provide such check with sufficient consideration of rights remains to be seen.[17]<\/a><\/p>\n

\n

[1]<\/a>\u00a0Post-doctoral Research Fellow at Birmingham Law School.<\/p>\n

[2]<\/a>\u00a0Alan Travis, \u201cUK Mass Digital Surveillance Regime Ruled Unlawful\u201d (The Guardian, 30 January 2018), available at\u00a0https:\/\/www.theguardian.com\/uk-news\/2018\/jan\/30\/uk-mass-digital-surveillance-regime-ruled-unlawful-appeal-ruling-snoopers-charter<\/a>\u00a0(accessed 2 February 2018).<\/p>\n

[3]<\/a>\u00a0Secretary of State for the Home Department v Tom Watson MP & Others<\/em>, [2018] EWCA Civ 70.<\/p>\n

[4]<\/a>\u00a0Charter of Fundamental Rights of the European Union, arts. 7, 8, 11, 52(1).<\/p>\n

[5]<\/a>\u00a0Directive 2002\/58\/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications); Directive 2009\/136\/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002\/22\/EC on universal service and users\u2019 rights relating to electronic communications networks and services, Directive 2002\/58\/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006\/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws.<\/p>\n

[6]<\/a>\u00a0Tele2 Sverige<\/em>, Joined Cases C-203\/15 and C-698\/15, [2016] OJ C53\/11.<\/p>\n

[7]<\/a>\u00a0Ibid.,<\/em>\u00a0para. 9(1).<\/p>\n

[8]<\/a>\u00a0Ibid.,<\/em>\u00a0para. 9(2).<\/p>\n

[9]<\/a>\u00a0Ibid.<\/em>, para. 9(2).<\/p>\n

[10]<\/a>\u00a0Supra<\/em>\u00a0n. 3, para. 27.<\/p>\n

[11]<\/a>\u00a0Ibid.,<\/em>\u00a0para. 24.<\/p>\n

[12]<\/a>\u00a0\u00a0Digital Rights Ireland and Seitlinger and Others,<\/em>\u00a0Joined Cases C-293\/12 and C-594\/12, [2014] OJ C175\/6.<\/p>\n

[13]<\/a>\u00a0Council of Civil Service Unions v Minister for the Civil Service,<\/em>\u00a0[1983] UKHL 9.<\/p>\n

[14]<\/a>\u00a0Privacy International v FCO, Home Office & GCHQ & Others,\u00a0<\/em>[2017] IPT\/15\/110\/CH.<\/p>\n

[15]<\/a>\u00a0Supra\u00a0<\/em>n. 6, paras. 119-125.<\/p>\n

[16]<\/a>\u00a0Supra<\/em>\u00a0n. 14.<\/p>\n

[17]<\/a>\u00a0See, for example, Jessie Blackbourn, \u201cEvaluating the Independent Reviewer of Terrorism Legislation\u201d (2014) 67\u00a0Parliamentary Affairs<\/em>\u00a0955.<\/p>\n","protected":false},"excerpt":{"rendered":"

Originally posted on the SCRIPTed Blog on 3 February 2018 Lydia Morgan[1] Despite Security Minister Ben Wallace\u2019s attempts to downplay it,[2]\u00a0\u00a0the Court of Appeal\u2019s ruling in the\u00a0Watson\u00a0case (SSHD v Watson & others)[3]\u00a0continues the drip of cases finding the Government\u2019s draconian attempt to access bulk communications data (BCD) unlawful. \u00a0Concerning the now expired sections 1 and … Continue reading “The DRIP(A) of Watson”<\/span><\/a><\/p>\n","protected":false},"author":774,"featured_media":116,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/posts\/110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/comments?post=110"}],"version-history":[{"count":1,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/posts\/110\/revisions"}],"predecessor-version":[{"id":1077,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/posts\/110\/revisions\/1077"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/media\/116"}],"wp:attachment":[{"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/media?parent=110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/categories?post=110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/counterterrorismreview\/wp-json\/wp\/v2\/tags?post=110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}