Parliament must change the Investigatory Powers Act in response to CJEU ruling

The judgment relates to a case brought by Deputy Leader of the Labour Party, Tom Watson MP, over intrusive data retention powers.

The ruling says that:

• Blanket data retention is not permissible 


• Access to data must be authorised by an independent body


• Only data belonging to people who are suspected of serious crimes can be accessed


• Individuals need to be notified if their data is accessed.


At present, none of these conditions are met by UK law.

Open Rights Group intervened in the case together with Privacy International, arguing that the Data Retention and Investigatory Powers Act (DRIPA), rushed through parliament in 2014, was incompatible with EU law. While the Judgment will no longer affect DRIPA, which expires at the end of 2016, it has major implications for the Investigatory Powers Act.

Executive Director Jim Killock said:

“The CJEU has sent a clear message to the UK Government: blanket surveillance of our communications is intrusive and unacceptable in a democracy.  

“The Government knew this judgment was coming but Theresa May was determined to push through her snoopers’ charter regardless. The Government must act quickly to re-write the IPA or be prepared to go to court again.”

Data retention powers in the Investigatory Powers Act will come into effect on 30 Dec 2016. These mean that ISPs and mobile phone providers can be obliged to keep data about our communications, including a record of the websites we visit and the apps we use. This data can be accessed by the police but also a wide range of organisations like the Food Standards Agency, the Health and Safety Executive and the Department of Health.

Notes to Editors

MPs Tom Watson and David Davis challenged the Government over the powers within the Data Retention and Investigatory Powers Act, which was rushed through parliament in July 2014. David Davis MP withdrew from the case after being appointed Minister for Brexit. In 2015, the High Court found that parts of DRIPA were unlawful and incompatible with EU law. The Government appealed and the case was referred to the CJEU for clarification of an earlier judgment, which saw the Data Retention Directive struck down.

DRIPA expires at the end of December 2016 but will be replaced by data retention obligations in the IPA, which come into effect on Dec 30.

For more information, email press@openrightsgroup.org