The European Court of Justice ruled that mass surveillance of phone and internet data is against EU law. This means the UK’s mass data retention regime is contrary to the bloc’s law, which puts in doubt any adequacy decision ahead of the country’s exit from the single market. Britain will now have to explore international fallbacks to ensure data can be shared back and forth with the EU.
It also means France and other EU countries will see the powers of their spy agencies significantly curbed.
The ECJ said: “The Court of Justice confirms that EU law precludes national legislation requiring a provider of electronic communications services to carry out the general and indiscriminate transmission or retention of traffic data and location data for the purpose of combating crime in general or of safeguarding national security.”
Member states and the European Commission had argued that data retention should not be covered by EU law because of its link to national security.
The Luxembourg-based court decided that EU capitals could retain huge amounts of data “in situations where a member state is facing a serious threat to national security”, but this would be “limited in time”.
Its judges also claimed derogations could be provided “for the targeted retention of that data” when “combatting serious crimes and preventing serious threats to public security”.
The ruling is a result of four faces in Belgium, France and Britain where governments have called for an extension of surveillance powers to protect their citizens.
The ECJ said: “Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority.”
The decision will likely have an implication on the EU’s data-sharing with governments outside of the bloc, such as China and the United States who have both ramped up their surveillance tools in the name of national security.
Experts have said the decision will all but end hopes of a British data adequacy deal with Brussels.
Ahead of the ruling, Estelle Masse, of Access Now, said: “Any hope of adequacy will vanish on Tuesday if the ECJ confirms that UK authorities’ access to communications data is contrary to EU law.”
She told the Politico website the UK’s chances were already “slim” to achieve a deal.
European law expert Theodore Christakis, of Universite Grenoble Alpes, said: “The problem for the UK is that it will be in the same place as the US after Schrems II if the court goes out and says that British law does not meet EU standards.
“This will make an adequacy decision problematic without changes to UK surveillance law, but it will also render the use of standard contractual clauses questionable.”
The European Commission is currently assessing whether Britain’s rules are stringent enough to allow data sharing with EU countries after the end of the transition period.
Caroline Wilson Palow, Legal Director of Privacy International, said: “Today’s judgment reinforces the rule of law in the EU. In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.
Barnier’s EU-Irish border hurdle is a LIE – and THIS proves it [COMMENT]
‘EU doesn’t get it!’ Bill Cash explodes at Brussels in Brexit threat [VIDEO]
Nigel Farage’s NEW plan to dethrone Boris Johnson [REVEALED]
“While the Police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power. They should focus on providing us with effective, targeted surveillance systems that protect both our security and our fundamental rights.”
EU firms have already raised concerns over data sharing with the US because of legal challenges from activists.
Campaigner Max Schrems won a ruling at the ECJ in July which invalidated the transatlantic Privacy Shield agreement used by around 5,000 businesses to transfer data from the EU to the US.
Mr Schrems successfully argued EU citizens’ data was not safe in the US and could easily fall into the hands of its intelligence agencies.