The legality of the UK's Investigatory Powers Act has been called into question by a landmark EU legal ruling this morning, which has restated that access to retained data must only be given in cases of serious crime.
The landmark judgment [PDF] was handed down by the European Union's Court of Justice, setting a new precedent for EU member states' data retention regimes, stating that access to such data must be restricted to the purpose of preventing and detecting serious crime.
The judges also stated that police and public bodies should not be allowed to authorise their own access to this data, instead requiring that access requests receive prior authorisation by independent courts or similar bodies.
The ruling results partly from a legal challenge against DRIPA filed by two MPs, David Davis and Tom Watson, though Davis subsequently exited the complaint against the government following his appointment as the government's minister for exiting the EU. This challenge was combined with one by Swedish telco Tele2.
Martha Spurrier, director of Liberty, which represented Tom Watson, said: "Today’s judgment upholds the rights of ordinary British people not to have their personal lives spied on without good reason or an independent warrant. The Government must now make urgent changes to the Investigatory Powers Act to comply with this."
"This is the first serious post-referendum test for our Government’s commitment to protecting human rights and the rule of law. The UK may have voted to leave the EU – but we didn't vote to abandon our rights and freedoms," added Spurrier.
A Home Office spokesperson said: "We are disappointed with the judgment from the European Court of Justice and will be considering its potential implications.
"It will now be for the Court of Appeal to determine the case," the spokesperson added. "The Government will be putting forward robust arguments to the Court of Appeal about the strength of our existing regime for communications data retention and access.
"Given the importance of communications data to preventing and detecting crime, we will ensure plans are in place so that the police and other public authorities can continue to acquire such data in a way that is consistent with EU law and our obligation to protect the public."
Liberal Democrat Shadow Home Secretary Brian Paddick said: "This ruling proves that this Conservative Government has overstepped the mark. The legality of the Investigatory Powers Act - passed into law with Labour's full support - has now been called into question."
Collecting and storing everyone's internet web browsing histories and phone records so government agencies can look at them is an Orwellian nightmare that intrudes into our privacy and erodes our civil liberties. Liberal Democrats tried to stop the worst excesses and now the courts agree.
We need to keep people safe but mass surveillance as sanctioned by the Investigatory Powers Act is unacceptable in a democratic society, would be unconstitutional in many countries, and is likely to be ineffective and counter-productive.
"This dreadful piece of legislation will cost millions to implement and unless the Government reconsider, they will inevitably face further embarrassment in the courts," concluded Paddick.
Tom Watson MP said: “This ruling shows it's counter-productive to rush new laws through Parliament without a proper scrutiny.
“At a time when we face a real and ever-present terrorist threat, the security forces may require access to personal information none of us would normally hand over. That's why it's absolutely vital that proper safeguards are put in place to ensure this power is not abused, as it has been in the recent past.
“Most of us can accept that our privacy may occasionally be compromised in the interests of keeping us safe, but no one would consent to giving the police or the government the power to arbitrarily seize our phone records or emails to use as they see fit. It's for judges, not Ministers, to oversee these powers. I'm pleased the court has upheld the earlier decision of the UK courts.” ®
Sponsored: Webcast: Simplify data protection on AWS