On 6 October 2020, the Court of Justice of the European Union (‘CJEU’) issued its judgment regarding the Security Intelligence Agencies’ collection of bulk communications data pursuant to section 94 of the Telecommunications Act 1984.
From 2001 (in respect of GCHQ) and 2005 (in respect of MI5), up until the regime introduced by the Investigatory Powers Act 2016, the Secretary of State issued directions under section 94 of the Telecommunications 1984 to electronic services providers, requiring them to provide the agencies with bulk communications data (i.e. the ‘who, when, where, how and with whom’ of a communication).
Privacy International argued before the Investigatory Powers Tribunal (‘IPT’) that this was contrary to EU law.
The IPT delivered a judgment expressing its provisional view that the matter was outside the scope of EU law, because it concerned national security, and that the EU-law safeguards established for bulk data in Tele2 Sverige and Watson could in any event not be applied. The IPT made a reference of the matter to the CJEU.
The CJEU held that the matter was within the scope of EU law, and that the general and indiscriminate transmission of bulk data was unlawful.
It held that ‘national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of [EU law]’ (§49).
It further held that ‘national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society’ (§81).
The CJEU laid down further guidance as to the applicable safeguards required by EU law in the context of national security in the joined cases C-511, 512, 520/18 La Quadrature du Net & ors, in its judgment issued on the same day.
The full judgment can be read here.
Tom de la Mare QC, Ben Jaffey QC and Daniel Cashman acted for Privacy International before the IPT and the CJEU.