On 17 July 2015, the High Court held that the UK’s emergency surveillance legislation was incompatible with European Union law. This case illustrates the crucial importance of the judicial system for raising fundamental questions and for holding the state to account. The case was brought by a number of Members of the House of Commons, who were concerned about the intrusive nature of the measures the legislation introduced and the absence of sufficient safeguards to protect an individual’s right to privacy. Two UK Human Rights Groups and the Law Society of England & Wales were also granted permission to submit an intervention by way of written submissions.Exactly a year earlier, on 17 July 2014, the UK government had passed emergency legislation, the Data Retention and Investigatory Powers Act (DRIPA), following what the UK government perceived to be an adverse ruling from the Court of Justice of the European Union (CJEU) [1].In April 2014, in Digital Rights Ireland the CJEU had ruled that the Data Retention Directive 2006/24/EC (the Directive) was invalid on the grounds that it was said to have exceeded the limits imposed by compliance with the principle of proportionality under Articles 7, 8 and 52 of the Charter of Fundamental Rights of the EU, which provide that everyone has the right to respect for his or her private and family life, home and communications, and that personal data must be processed fairly for specified purposes on the basis of consent or some other legitimate basis as laid down by the law.

The Directive placed an obligation on providers of publically available electronic communications services to store data necessary to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of communication, to identify users’ communication equipment, and to identify the location of mobile communication equipment . The Directive and the national laws implementing the Directive had been the subject of widespread criticism on the grounds it entailed a serious interference with the fundamental rights to respect for private life and to the protection of personal data rights.The CJEU agreed that the collection and storage of data constituted a serious interference with an individual’s privacy and their rights to protection of personal data. Whilst the retention of data for the purposes of assisting law enforcement to detect and prevent serious crime was justified, the CJEU held that the extent of interference with individuals’ privacy and personal data protection rights was not proportionate to serving that purpose. The CJEU also criticised the Directive for failing to provide sufficient safeguards. Shortly thereafter, the UK passed DRIPA to ensure that mass data retention rules equivalent to those previously implemented under the Directive (and found to be invalid) would continue to apply in the UK.The High Court agreed that the CJEU decision was central to the question of whether or not DRIPA was compatible with the requirements of EU law, as interpreted by the CJEU in Digital Rights Ireland.

The High Court agreed that section 1 of DRIPA was inconsistent with European Union law in so far as:it did not lay down clear and precise rules providing for access, restricted to the purpose of preventing and detecting precisely defined serious offences or of conducting criminal prosecutions relating to such offences; andaccess to the data was not made dependent on a prior review by a court or an independent administrative body, to ensure that only data deemed strictly necessary for the purpose of attaining the objective pursued was examined.As a result, the High Court ordered that section 1 of DRIPA should be disapplied to the extent that it permitted access to retained data which was inconsistent with EU law. However, the Court’s declaration was ordered to be suspended until 31 March 2016, to allow the government sufficient time to rectify the position. It is likely that the decision will be appealed. A copy of the High Court decision can be found here. Digital Rights Ireland and Seitlinger and others (C-293/12 and C-594/12).