Advocate General’s Opinion in Joined Cases C-203/15 Tele2 Sverige AB v Post-och telestyrelsen and C-698/15 Secretary of State for Home Department v Tom Watson and Others

Background

The joined cases relate to questions from both the UK and Swedish national courts. The national courts' questions arose in light of the ECJ's judgment in Digital Rights Ireland, in which the ECJ declared that Directive 2006/24/EC (the "Data Retention Directive") was invalid because it infringed the principle of proportionality (Article 52(1) of the Charter of Fundamental Rights of the European Union – the "Charter"), in respect of Article 7 (right to a private life) and Article 8 (right to data protection) of the Charter. In its judgment, the ECJ condemned the Data Retention Directive for failing to provide sufficient safeguards against unlawful access to and use of retained data by public authorities.

Following the ECJ's ruling in Digital Rights Ireland, the validity of national data retention legislation, and its compatibility with EU law, was called into question. Following a challenge in the UK courts, the High Court found the Data Retention and Investigatory Powers Act 2014 (the national UK data retention legislation) incompatible with EU law. This case came before the UK Court of Appeal, which asked the ECJ to clarify the scope of its judgment in the Digital Rights Ireland case, particularly in relation to the effect of Articles 7 and 8 of the Charter. In Sweden, telecoms operator Tele2 ceased retaining communications data after the Digital Rights Ireland judgment was delivered. The Swedish telecoms regulator ordered Tele2 to continue to retain the data; Tele2 then challenged this order in the Swedish Courts. This case came before the Stockholm Administrative Court, which asked the ECJ to clarify the relationship between data retention obligations and the E-Privacy Directive, in particular, the circumstances in, and conditions under which, data retention obligations would be compatible with the E-Privacy Directive.

The Opinion

Advocate General Saugmandsgaard Øe found that general data retention obligations could still be compatible with EU law (in particular the E-Privacy Directive and Articles 7 and 8 of the Charter), and in line with the Digital Rights Ireland judgment, provided that a number of conditions that limit the interference with rights under the E-Privacy Directive and Articles 7 and 8 of the Charter, are satisfied:

• The national legislative instrument outlining the data retention obligations and accompanying safeguards must be accessible, foreseeable and offer adequate protection against arbitrary interference with rights under the E-Privacy Directive and Articles 7 and 8 of the EU Charter;
• The data retention obligations must observe the essence of the Article 7 and 8 rights (particularly in relation to Article 8, appropriate technical and organisational measures must be put in place against accidental or unlawful destruction and accidental loss or alteration of the data, at a national level);
• The data retention obligations must be strictly necessary in the fight against crime (the Advocate General considered that this must be the fight against serious crime, rejecting the UK government's argument that "crime" included the fight against ordinary crime or civil wrongs such as copyright enforcement; he also found that national courts should rigorously verify that no other measure or combination of measures, could be as effective in the fight against serious crime before resorting to data retention measures);
• The data retention obligations must be accompanied by all the safeguards described by the ECJ in its judgment in Digital Rights Ireland (regarding access to data, period of data retention and protection and security of the data) to ensure that the interference with rights under the E-Privacy Directive and Articles 7 and 8 of the Charter is limited to what is strictly necessary; and
• The obligation must be proportionate, meaning that the serious risks engendered by the obligation arising from the power to catalogue the private lives of individuals, must not be disproportionate to the advantages which it offers to authorities in the fight against serious crime.

Potential Impact in the UK

The ECJ will give its final judgment in the case later this year.

If the AG's Opinion is followed by the ECJ, the ECJ's judgment is likely to result in the UK courts declaring the Data Retention and Investigatory Powers Act 2014 (and potentially the Investigatory Powers Bill) incompatible with EU law, on the basis that these legislative provisions do not fulfil the conditions laid down by the ECJ to limit interference with the rights under Articles 7 and 8 of the Charter, and the E-Privacy Directive. In particular, the right of the Secretary of State to issue retention notices under both the act and the bill may be incompatible with EU law.

In light of the Brexit vote, whether or not any declaration of incompatibility will actually be made by national courts is uncertain; in any case, the EU interpretation of data retention is likely to continue to be a serious consideration for Parliament in the context of future national data protection legislation.

The full Opinion is available here.