The High Court ruled that Part 4 of the Investigatory Powers Act 2016 (the Act) is incompatible with people’s fundamental rights because Ministers can issue data retention orders without independent review by a court or an administrative body and for reasons unrelated to the investigation of serious crimes. The Court concluded that the legislation must be amended within a reasonable time and that a reasonable time would be 1 November 2018 which is just over six months from the date of the judgement. The Court reasoned following an analysis of previous case law that it was appropriate to issue a declaration. The Court rejected the argument put forward by the Government that notwithstanding the acknowledged flaws in Part 3 it should be permitted to continue to apply it until April 2019. The Court agreed with the claimant that there was no reason that the legal framework could not be amended prior to this.
Liberty an organisation who campaigns for civil liberties and human rights in the UK sought to judicially review Part 4 of the Act on the basis that its provisions were inconsistent with EU law and the European Convention on Human Rights. Liberty brought up specific concerns as to the power that was granted to the Secretary of State under the Act, which would allow him/her to issue a data retention notice to telecommunication operators. This retention of data does not concern access to the data. The Court stressed that, although the power affects a wide range of private information to do with communications, it does not concern the content of such communications, such as emails or text messages.
The Act came into effect in September 2016, with Part 4 coming into force in December 2016. The claimant was granted permission to challenge Part 4 in June 2017. The defendants accepted that that Part 4 was not compatible with European Union law. Proposals by the British government that the Part 4 was to be amended by secondary legislation had not come into effect and the claimant argued that in the meantime data retention still continued. The continuing violation of EU privacy rights led to the issuing of the declaration where by the defendant is now time bound to implement the necessary changes to the law to ensure compatibility by 1 November 2018.
Click here for a copy of the judgement.
Click here for further commentary on the case.
Click here for PILA commentary on the CJEU decision from 2017.