Raven Butcher
LLM student at King’s College London specialising in International Business Law
EU law affects, or has the power to affect, Member States’ (MS) national laws. Where the Directives are clear, coherent and accepted by MS, the legal order can be viewed in systematic terms. Where they are less so, however, they become more contingent and fragile. The conveyance of these laws across states is not homogeneous and varies in light of identifiable factors. For example, transnational legal processes, processes through which transnational norms are conveyed, challenge national legal contexts and often conflict with domestic laws. States may block, adopt, translate or appropriate transnational law, and spur its reassessment. A prime example of this are the decisions of the Court of Justice of the European Union (CJEU) which are handed down to EU Member States, directly influencing their national legislation and in turn, moulding the relationship between them and their citizens. This article evaluates the extent to which EU law affects national legal systems by analysing the specific example of the Data Retention Directive (2006/24/EC) and its impact on Member States with particular focus on the UK.
In the post-Snowden era, the retention of data has been the subject of much heated debate. The CJEU judgment in early April[1] further added to the controversy by declaring the Data Retention Directive (2006/24/EC) void ab initio due to its violation of the EU Charter of Fundamental Rights (Charter). The decision was in respect of the joint preliminary reference made to the CJEU by Ireland and Austria under Article 267 of TFEU. It is an extraordinary move by the CJEU in relation to the protection of fundamental rights because this is the first time an entire EU legal instrument has been declared invalid for Charter infringement. For some Member States the Directive’s invalidation is less taxing. Their national legislation implementing the Directive will only have to be amended to the extent required by the Court’s decision, or, they may choose to void the offending act. For example, Austria’s Constitutional Court has the right to void an Act of Parliament and it is likely it will do so with regard to the Austrian implementing law. The High Court of Ireland has similarly robust powers. Germany, who faces legal action from the European Commission for not re-implementing the Directive after their constitutional court invalidated the domestic act which initially implemented the Directive under the national fundamental rights framework, is now free from the obligation to re-implement the Directive due to the decision. It is expected that the European Commission will withdraw the legal action already brought against Germany in this regard.
For the UK, however, the situation is more complicated and problematic than the tedious task of amending acts. The CJEU’s decision means not only that there is no EU law mandating the retention of data across Member States, but also that the UK statutory instrument[2] transposing the Directive is ultra vires as it was implemented via the enabling provision of Section 2(2) of the European Communities Act 1972. This section exists for the sole purpose of implementing EU law thus fulfilling the UK’s EU obligations, however, it cannot implement legislation which is void ab initio. Hence, if the UK wanted to maintain powers to force public communications providers to retain data as per Section 4(1) of the Regulation, it would have to enact new legislation since the original instrument no longer has legal standing. Thus, any actions brought under it would likely be quelled in the UK courts. However, Article 15(1) of the E-privacy Directive (2002/58/EC) remains unaffected by the CJEU’s decision and Member States are therefore free to adopt their own national data retention laws.
What looked like a problem prima facie, has become an opportunity for the UK, which has taken full advantage of this revelation, leading Parliament swiftly to table the Data Retention and Investigatory Powers Bill 2014 (DRIP) on 10th July 2014 with the intention that it be enacted by the 17th. A legislative process, which usually takes up to a year, was truncated into seven days. Why was it suddenly necessary to expedite emergency surveillance legislation four months after the decision was handed down? If the CJEU’s decision necessitated the enactment of emergency legislation would it not have been initiated sooner after the CJEU’s ruling?
While the Directive had the objective of fighting organised crime and terrorism, it only harmonised certain aspects of the data retention system. The result was a mandatory EU framework governing the retention of communications data, whereas the regulation of access to such data was left to the Member States. This led to significant discrepancies in the approaches employed by various Member States with some, like the UK, authorising access to private data for purposes far beyond what was envisaged in the Directive and to organisations apathetic to said objective. At paragraph 51 of the aforesaid ruling the CJEU stated that while the provisions of the Directive were suitable to achieve the material objective, this purpose “in itself, does not justify retention measures such as that established [in the directive].” Therefore, requiring public communication providers to retain mass personal data of individuals who are not under any suspicion is grossly disproportionate and hence infringes Article 52(1) of the Charter. It also found that the retention of communications data pursuant to Articles 3-5 of the Directive, for the purpose of possible access to them by the competent national authorities, directly infringed Articles 7 and 8 of the Charter (the right to privacy and personal data protection) and hence are a flagrant violation of the European Convention on Human rights (the Convention) given effect in the UK by the Human Rights Act 1998.
The haste at which the Bill was pushed through Parliament is highly disconcerting. Firstly, because it means that not only was Parliament incapable of effectively scrutinising the bill, but the powers created thereby may well impede fundamental rights and civil liberties of citizens by being excessively wide ranging and disproportionate, which is the very reason the Directive was ruled void ab initio. Secondly, the Bill does not directly address the concerns of the CJEU expressed at paragraphs 65 and 66 of the judgment. In fact, the Bill makes no mention of the Charter of Fundamental Rights and even goes further by widening the scope of the existing Regulation of Investigatory Powers Act (RIPA) 2000. In virtue of Section 11 of RIPA, Clause 4(2) of the Bill creates unprecedented powers requiring the extraterritorial public communications providers to comply with interception warrants and communications data acquisitions as well as to build interception capabilities into their products and infrastructure. Clause 5 thereof also extends the definition of “telecommunications” within Section 2(8) of RIPA, widening the catchment of an interception warrant. Without EU law mandating data retention, Member States are free to enact new laws provided they comply with the CJEU ruling. Why then did the UK enact legislation that advertently flies in the face of the CJEU decision? The UK appears to have an ulterior motive which drove the passage of DRIP, which was not to give effect to the CJEU ruling, but rather to shift the legal basis for data retention from EU law, which is transnational and where it is vulnerable to challenge and judicial review, to English national law, where the doctrine of parliamentary sovereignty makes any legal challenge to primary legislation a near indefeasible feat.
DRIP is reminiscent of Theresa May’s infamous Draft Communication Data Bill (DCD)2012 which was withdrawn after a damning report by the joint committee and intense criticism by Parliament for infringing fundamental privacy rights. DRIP conveys all the arbitrary powers of DCD but conveniently avoided the scrutiny of Parliament. It seems that the bill is a convoluted façade for the state to justify the removal of civil liberties and the encroachments of its duty to protect the fundamental rights of its citizens under the pretext of necessity to eradicate serious crime and terrorism.
The analysis of the Data Retention Directive shows that when EU law leads to domestic legal and institutional change it does so in context-specific ways requires the intermediation of transnational law with domestic institutions, engenders manifold political struggles and gives rise to cultural issues of the states affected. It is too early to tell what the consequences of enacting DRIP will be but the CJEU’s decision makes it clear that it will not tolerate any legislation which offends the transnational legal rights awarded to EU citizens by the Charter. Indeed since DRIP came into force two members of parliament have already planned to commence legal action against the UK as they consider the act arbitrary and described it as being “driven through the House of Commons with ridiculous and unnecessary haste to meet a completely artificial emergency”[3] Therefore, if DRIP is found to be arbitrary, the repercussions for the UK could be severe as the European Commission could itself take legal action against the UK.
—
[1] C 293/12 and C 594/12
[2] The Data Retention (EC Directive) Regulations 2009
[3] Conservative MP, David Davis, for full quote see http://www.theregister.co.uk/2014/07/23/mps_sue_drip_act/