United Kingdom legislation
The Data Retention and Investigatory Powers Act 2014 (also known as DRIP or DRIPA) was an Act of the Parliament of the United Kingdom, repealed in 2016. It received Royal Assent on 17 July 2014, after being introduced on 14 July 2014.[1][3] The purpose of the legislation was to allow security services to continue to have access to phone and internet records of individuals following a previous repeal[dubious – discuss] of these rights by the Court of Justice of the European Union.[4] The act was criticised by some Members of Parliament for the speed at which the act was passed through parliament,[4] by some groups (such as the Open Rights Group and Liberty) as being an infringement of privacy.[5]
Following legal action, in July 2015, the High Court of Justice issued an order that sections 1 and 2 of the Act were unlawful, and to be disapplied, suspended until 31 March 2016, thereby giving the government a deadline to come up with alternative legislation which would be compatible with EU law.[6][7][8]
As of 4 November 2015[update] an investigatory powers parliamentary bill was being drafted providing new surveillance powers, requiring records to be kept by Internet Service Providers tracking use of the internet from the UK, accessible by the police and security services without judicial oversight.[9]
The Data Retention and Investigatory Powers Act 2014 was repealed on 31 December 2016 and replaced by the Investigatory Powers Act 2016.
Revocation
On 1 August 2014, the Data Retention Regulations 2014 came into force, completing the framework introduced by the DRIP. They provide that a communications service provider can be required to retain data only when target of a notice of the Secretary of State. In December 2014, in R (on the application of David Davis MP and Tom Watson MP) v Secretary of State for the Home Department, Mr Justice Lewis (High Court) granted the Claimants permission to proceed to a substantive hearing, thus agreeing that the DRIP can be challenged by judicial review. As a reaction, the Government proposed using the Counter-Terrorism and Security Bill (CTSB) to extend their remit to cover data generated as a result of internet communications.
On 4 June 2015 a legal challenge against the law was brought to the High Court by two MPs, Labour's Tom Watson and the Conservative David Davis represented by the civil liberties organisation Liberty. They claimed that the act was rushed through parliament and was incompatible with the Human Rights Act and the European Union Charter of Fundamental Rights.[10]
On 17 July 2015 the High Court upheld the challenge, finding sections 1 and 2 of the Act to be unlawful.[11][12] The court found that the section 1 of the Act was contrary to EU law as a result of breaches of the Charter of Fundamental Rights of the EU by virtue of the rights under Article 7 to a "private and family life, home and communications" and under article 8 which provides rights of the data held on an individual. The court found that these rights were breached based on the conclusions reached in Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and others and the conjoined case of Kärntner Landesregierung.[8] The court issued an order that sections 1 and 2 be disapplied, suspended until 31 March 2016, thereby giving the government a deadline to come up with alternative legislation which is compatible with EU law.[6][8]
In October 2015, the Court of Appeal began hearing the Home Secretary's appeal against the ruling.[13] The Court of Appeal accepted, on a provisional basis, the arguments put forward by the Home Secretary and decided to refer certain aspects of the judgement to the Court of Justice of the European Union for a preliminary ruling. In particular, the Court of Appeal found that the Digital Rights Ireland case did not result in mandatory requirements applicable to all Member States' data retention regimes.[14] The Court of Appeal referred questions to the Court of Justice of the European Union as to whether the Digital Rights Ireland case should law down mandatory requirements for the national legislation of member states and whether this resulted in an expansion of the effects of Articles 7 and 8 of the EU Charter beyond the effect of Article 8 of the European Convention on Human Rights.[15]
On 21 December 2016 the European Court of Justice (ECJ) ruled in joined cases that the Data Retention and Investigatory Powers Act 2014 was unlawful. The court found on the first question referred by the Court of Appeal that the Charter of Fundamental Rights of the European Union does preclude legislation which provides for access to retained traffic and location data by certain national authorities where this is not restricted to fighting serious crime or where the right to access is not subject to a prior court review. The ECJ found that the second question referred by the Court of Appeal was inadmissible.[16]
The Data Retention and Investigatory Powers Act 2014 (DRIPA) was repealed on 31 December 2016 and replaced by the Investigatory Powers Act 2016.
Following the EU judgement (and after the repeal of the act) the matters was again referred to the Court of Appeal. In this judgement the Court of Appeal granted declaratory relief in respect of the areas in which it was found that the Data Retention and Investigatory Powers Act 2014 was incompatible with EU law. The relief was limited to the context that making use of data collected under the act in prosecuting crimes was only admissible where it had been restricted to fighting serious crime or access had been subject to court review.[17]
Overview
The main provisions of the act were:[18]
- To allow the security services through the Secretary of State to retain the powers to require a public telecommunications operator to retain communications data in line with the purposes of the Regulation of Investigatory Powers Act 2000.[19]
- The creation of a new privacy and civil liberties board to act as an independent watchdog overseeing the security services' use of these powers.[20]
- To enforce the annual publication of a report of the amount of data intercepted under the regulations[20]
- To restrict the length of time such data can be held to 12 months[20]
- To ensure that the relevance of the Regulation of Investigatory Powers Act 2000 is reviewed biennially[20]
- To reduce the number of public bodies that can access the data collected under the legislation[20]
- To limit the data which can be accessed under the regulations to only data that is relevant[20]
- To provide for fresh legislation to supersede this legislation in 2016[20]
- To ensure that such data can no longer be gathered solely for the interest of the UK economic wellbeing[20]
- To appoint a diplomat to negotiate data transfers of such information with the United States.[20]
