Today, Access sent the following letter to Members of Parliament in the United Kingdom. We are calling for the Data Retention and Investigatory Powers Act currently being rushed through under “emergency” procedures to be thrown out for its failure to comply with international human rights norms, the EU Charter of Fundamental Rights, and the recent decision of the Court of Justice of the EU invalidating the EU Data Retention Directive.
July 15, 2014
House of Commons
London, SW1A 0AA
To all Members of the House of Commons,
We write today to express extreme concern with the proposed Data Retention and Investigatory Powers Act (“DRIP”) currently before you. Intended to replace the UK’s data retention law which was invalidated by a recent Court of Justice of the EU (“CJEU”) ruling, the bill would dramatically and dangerously expand the government’s surveillance powers. In proposing this legislation, GCHQ, civil service, and Coalition and Opposition leaders have shown a flagrant disregard for parliamentary procedure and have failed to allow an informed and public debate to take place on this bill which proposes to treat all citizens, in the UK and abroad, as suspects. This legislation is antithetical to basic principles of human rights and international law and we urge Members to prevent this bill from moving forward.
On April 8, 2014, the Grand Chamber of the European Court of Justice (“CJEU”) invalidated the EU Data Retention Directive, holding that it exceeded the bounds of the EU Charter, specifically in regard to the principle of proportionality as to the Directive’s interference with the rights to privacy and data protection as set out in Articles 7 and 8.
On July 10, 2014, three months after the Directive was invalidated, the DRIP was introduced in the UK Parliament, allowing just days of debate. With this emergency legislation, the bill’s proponents have not left adequate time for democratic processes to take hold and shape the proposed rules. The CJEU ruling is decisive, highlighting the need for, at the very least, greater public debate on mandatory data retention and mass surveillance, given its adverse, unnecessary, and disproportionate impacts on fundamental rights.
Adopted by the European Union in 2006, the Data Retention Directive mandated that all telecommunications data – including mobile and landline phones, fax, and email – are to be indiscriminately collected and retained by providers for a minimum period of six months, and up to two years. To implement the Directive, the UK passed Regulations in 2009 requiring that communications data “generated or processed in connection with the provision of publicly available electronic communications services or public communications networks” be retained for a period of twelve months. The invalidation of the Directive had the substantive impact of nullifying the UK Regulations and similar laws in other EU member states. Despite this, the Minister of State for Immigration at the Home Office explained in May that it was of the view that “the UK Data Retention Regulations … remain in force.”
Alarmingly, the DRIP is being considered under “emergency” or “fast track” procedures, which greatly diminish the public involvement and the time available for debate or consideration of alternative proposals. Instead of using established process, the UK Government is bypassing established procedures in order to not only retain its previous authority, but to greatly expand the UK surveillance state.
By its terms, the DRIP not only re-enacts the previous Regulation, with no attempt at conforming to the CJEU judgment, but also grants significant new authority to “extend the territorial scope of the broad interception and communications acquisition powers under the [Regulation of Investigatory Powers Act 2000 (“RIPA”)].” In practice this would open up companies to increased obligations to retain and share data with the UK government and impede on the rights of users around the world.
In the wake of the CJEU ruling, Finland and Luxembourg have already announced that their national laws on data retention would be reviewed. In a separate decision concerning a controversial surveillance program revealed in June 2013, the U.S. government considered and expressly rejected mandatory data retention as a tenable solution.
The DRIP runs contrary to the CJEU’s April judgment as well as international law and established human rights principles. In line with the Charter of Fundamental Rights of the EU, any restrictions on fundamental rights are to be subject to the principle of necessity and proportionality. All surveillance programs and authorities should be demonstrably necessary, proportionate, and transparent. Additionally, “data retention or collection should never be required of service providers.”
As you consider more broadly how to reform communications surveillance laws in the wake of this ruling, we urge you and your colleagues to turn to the International Principles on the Application of Human Rights to Communications Surveillance. The Principles provide a framework for assessing how human rights obligations apply in the context of communications surveillance. The Principles have been endorsed by more than 400 civil society organizations and over 50 legal experts and academics from around the world.
The UK, along with the United States, is already facing international pressure due to revelations of broad, secret, and unaccountable surveillance programs. Any provision that presumes to replace the invalidated Regulation needs to respect the gravity of the CJEU’s precedent and comply with international human rights norms and law. The DRIP fails to do so. Members of Parliament must provide for an opportunity for meaningful public review and debate of any proposed surveillance law. Anything less is unacceptable.
Sincerely,
Amie Stepanovich
Senior Policy Counsel
1.888.414.0100 ext. 702