The landmark European Court of Justice ruling on Tuesday that the current scheme for storing EU citizens' call data - the European Data Retention Directive -is invalid with immediate effect, justifies years of work and initial court challenges by privacy advocates Digital Rights Ireland.
In a true David v Goliath action, the tiny Irish organisation, represented by McGarr Solicitors, brought the case at the centre of the judgment.
For over a decade, the Irish state and successive ministers for justice dismissed privacy and human rights concerns about Irish data retention laws - some of the most onerous in the EU.
But, in line with arguments by Digital Rights Ireland, the court said it “takes the view that, by requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data.”
The court also argued that the fact that “retained data are accessed and used without the individual being informed likely to generate in the persons concerned a feeling that their private lives are the subject of constant surveillance.”
The decision to invalidate the directive, which forms the basis for Irish law, could not come at a more relevant, if ironic, moment here.
In the midst of a furore over the secret, routine taping of conversations at some garda stations without warrants, and unresolved questions of surveillance at the Garda Síochána Ombudsman Commission, Europe’s justice court has stated that all of Europe must do much, much better at defining what information law enforcement should have access to, and under which circumstances.
And, critically, it has also declared that systems of oversight must be significantly improved.
The case will have major privacy implications for citizens and businesses, and for political and commercial relationships with the United States. There's no doubt that the shadow of whistleblower Edward Snowden, and his revelations of widespread covert data gathering, lie across this judgment, and influenced the decision.
The court is careful to clarify that it does not believe all forms of data retention are a violation, primarily because it is the data about communications, and not the contents, that are retained. And it also acknowledges that law enforcement needs well-defined access to data for particular investigations.
But the ECJ has firmly declared that the wholesale hoovering up and long-term storage of all citizens’ call data for widely varying time periods and storage regimes across the EU states, goes against all notions of proportionality and lacks adequate protections- and must end.
