CJEU rules mass surveillance by member states must respect privacy, even in context of national security
The Court of Justice of the European Union (CJEU) has ruled that when the UK, French and Belgian authorities use mass surveillance technology, they are obliged to have respect for the privacy of others, even in the context of national security.
The Court made it clear that national security concerns do not exclude Member States from the need to comply with general principles of European Union law such as proportionality and respect for fundamental rights to privacy, data protection and freedom of expression.
In the UK case, Privacy International challenged the bulk acquisition and use of communications data by the Security and Intelligence Agencies which comprise of GCGQ, MI5 and MI6, arguing that their methods fall outside the scope of EU Law. These agencies are granted broad powers to intercept and retain digital communications under the UK’s Investigatory Powers Act 2016.
The data identifies who is using the telephone or internet, the location of the device used, and information on users’ financial activities, communications, and travel. The agencies then filter and aggregate the content.
The Court addressed concerns that the ePrivacy Directive usurps the power of Member States to employ national legislation to safeguard national security. The Court explained that the ePrivacy Directive does apply, “in principle,” when electronic services providers are required by law to retain their subscribers’ data and to allow public authorities access to such data. According to the Court, “[t]his position remains unchanged where the requirements are imposed on providers for reasons of national security.”
The Court looked the exception found in Article 15(1) (the national security exception) and held that it cannot be read so broadly as to exempt legislation requiring transmission and retention of communications data from the scope of EU law guaranteeing the right to privacy. In other words, Member State legislation that attempts to restrict rights of confidentiality and privacy offered by the ePrivacy Directive must also comply with the general principles of EU law, including the principle of proportionality and the rights guaranteed by the Charter of Fundamental Rights of the European Union.
The CJEU press release is available here, the judgment in Case C-623/17 here, and the judgment in joint Cases C-511/18, C-512/18, and C-520/18, only available in French, here.