3.2 Data protection – Page 11 – European Area of Freedom Security & Justice

Data Retention: a landmark Court of Justice’s ruling.(6) Are national data retention laws within the scope of the Charter?

ATTENTION !!!REBLOGGED FROM EU LAW ANALYSIS

Sunday, 20 April 2014

By Steve Peers

Following the annulment of the EU’s data retention Directive by the CJEU, an obvious important question arises: are national data retention laws subject to the same ruling of the Court? The purpose of this post is to set out the reasons why they are.

The starting point for this analysis is Article 51 of the EU’s Charter of Fundamental Rights, which states that the Charter applies to the EU institutions and other EU bodies, but to the EU’s Member States ‘only’ when they are ‘implementing’ EU law. What does that mean?

On the narrowest interpretation, Member States ceased to be implementing EU law on data retention from the moment that the data retention Directive became invalid. After all, from that point, there was no EU data retention law to implement. However, it is arguable that Member States can still be regarded as ‘implementing’ EU law where their national legislation was introduced to implement an EU obligation. It’s a novel point, because it’s rare for the CJEU to annul EU laws on substantive grounds. And where the Court has done so, it has more often annulled only a small part of those EU laws (in the Test-Achats judgment, for instance).

But that is merely an alternative argument that the EU Charter continues to apply to national data retention law. The main argument is based on solidly established case law of the CJEU regarding the scope of EU human rights protection where Member States derogate from EU law.

EU human rights rules and national derogations from EU law Continue reading “Data Retention: a landmark Court of Justice’s ruling.(6) Are national data retention laws within the scope of the Charter?”

April 8th 2014 : A dawn of a new european data protection era ?

ORIGINAL PUBLISHED ON THE INTERNET SITE OF
Réseau universitaire européen dédié à l’étude du droit de l’Espace de liberté, sécurité et justice(ELSJ)

La Cour de justice et la protection des données : quand le juge européen des droits fondamentaux prend ses responsabilités
9 AVRIL 2014
par Henri Labayle, CDRE

(English translation will follow)

C’est par deux grandes décisions que la Cour de justice aura marqué de son empreinte le droit de la protection des données à caractère personnel. Rendus le même jour en grande chambre, le 8 avril 2014, ces deux arrêts méritent d’être rapprochés : ils témoignent à tous égards de la volonté de la Cour de marquer un coup d’arrêt en assumant pleinement ses responsabilités de juge des droits fondamentaux.
Le premier d’entre eux pouvait paraître anecdotique par ses circonstances, sinon par son contexte. Frappant un Etat membre, sa décision Commission c. Hongrie (C 288/12) lui permet cependant de rappeler la nécessaire indépendance de ceux qui, dans les Etats membres, veillent au respect de la directive 95/46 relative à la protection des données.
Le second, éclatant et retenant à ce titre l’attention de tous, la conduit à prononcer de manière inusitée par sa généralité l’invalidité de la directive 2006/24 relative à la conservation des données, dans les affaires jointes Digital Rights Ireland (C 293/12) et Seitlinger (C-594/12).
Calée sur son office de protection des droits fondamentaux, prenant pour référence quasi-exclusive la Charte des droits fondamentaux et pour méthode de raisonnement celle qui est de mise à Strasbourg, la Cour de justice s’avère alors un garant résolu des droits individuels.

1 – De la nécessaire indépendance des organes nationaux de protection des données à caractère personnel

Le premier ministre Viktor Orban n’a guère eu le temps de savourer sa victoire aux législatives, deux jours avant l’arrêt de la Cour. Celles-ci étaient observées avec attention en Europe, au vu de la tendance fâcheuse des autorités hongroises à prendre l’Union et ses valeurs pour « un paillasson » ainsi que Daniel Cohn Bendit l’avait vertement indiqué à Viktor Orban au Parlement européen en janvier 2012.
Parmi les mesures reprochées au régime hongrois en matière de droits fondamentaux (voir le rapport Ruiz Tavares A7-0229:2013 au Parlement européen), de sa modification constitutionnelle à ses atteintes à l’indépendance des juges, sa décision de mettre brutalement fin aux fonctions du commissaire hongrois à la protection des données était passée relativement inaperçue des non spécialistes.
Avec le Parlement, la Commission en avait fait cependant l’un des griefs justifiant l’engagement de trois procédures en constatation de manquement en mars 2012. La Cour avait donc à en connaître.
Les faits ne prêtaient guère à discussion : la directive 95/46 sur la protection des données à caractère personnel fait obligation aux Etats membres de désigner une ou plusieurs autorités chargées de veiller à son respect. Elle précise dans son considérant 62 que « l’institution, dans les États membres, d’autorités de contrôle exerçant en toute indépendance leurs fonctions est un élément essentiel de la protection des personnes à l’égard du traitement des données à caractère personnel », ce que traduit son article 28 §1 en ces termes : « ces autorités exercent en toute indépendance les missions dont elles sont investies ».
En Hongrie, un commissaire à la protection des données élu en 2008 pour une durée de six ans jouait ce rôle. Au prétexte de réformer ce système, le Parlement hongrois avait décidé de remplacer cette institution par une nouvelle autorité chargée de la protection des données et de la liberté de l’information, d’où la cessation des fonctions du commissaire en question, M. Iori, et son remplacement pour un nouveau président de ladite autorité, pour neuf ans.
Ajoutée à l’évidente ingérence de l’exécutif hongrois dans cette nouvelle autorité, cette cessation forcée du mandat du commissaire hongrois justifiait donc la saisine de la Cour de justice par la Commission, appuyée par le Contrôleur européen de la protection des données.
Sans remettre en cause le droit souverain de l’Etat hongrois de modifier sa législation interne et son système de contrôle de la protection des données, la Commission refusait à la fois d’avaliser le fait que cette réforme aboutisse à la cessation du commissaire en poste mais aussi qu’elle puisse ne pas garantir l’indépendance totale de l’autorité exerçant ce contrôle. Celle-ci va au-delà de la simple indépendance fonctionnelle et prohibe toute forme de sujétion, qu’elle soit de nature institutionnelle, personnelle ou matérielle.
La jurisprudence a du reste eu l’occasion de trancher la question sur ce point (CJUE, 9 mars 2010, Commission c. Allemagne, C-518/07; 16 octobre 2012, Commission c. Autriche, C-614/10), particulièrement attentive à la condition d’un exercice des fonctions en « toute » indépendance, figurant dans la directive 95/46.
L’affaire était jugée suffisamment sérieuse pour que l’avocat général Melchior Wathelet, dans ses conclusions, ajoute « qu’un arrêt de la Cour constatant le manquement dans la présente affaire aurait une très grande importance non seulement pour les autorités créées en application de l’article 28 §1 de la directive, mais aussi pour toute autre autorité indépendante instaurée en application du droit de l’Union. En assurant ces autorités indépendantes de l’inamovibilité de leur mandat jusqu’à l’échéance prévue, sauf raisons graves préétablies par la loi et objectivement vérifiables, cet arrêt aurait pour effet de limiter considérablement le risque nuisible d’«obéissance anticipée» à des acteurs externes, publics ou privés. Un tel arrêt écarterait «l’épée de Damoclès» que représente le risque paralysant de cessation anticipée de leur mandat » (point 83).
C’est bien ainsi que la Cour l’entend, manifestement.
A « titre liminaire », et outre la directive, elle relie expressément et très utilement l’exigence d’un contrôle par une autorité indépendante du respect des règles de l’Union relatives à la protection des personnes physiques à l’égard du traitement des données à caractère personnel au droit primaire de l’Union et plus particulièrement à l’article 8 §3 de la Charte des droits fondamentaux de l’Union européenne et de l’article 16 §2 TFUE.
On conçoit alors qu’elle fasse de cette exigence un « élément essentiel » de ce droit à la protection.
Elle a déjà jugé dans les affaires précitées que le seul risque que les autorités de tutelle de l’État puissent exercer une influence politique sur les décisions des autorités de contrôle suffit pour entraver l’exercice indépendant des missions de celles-ci. En effet, d’une part, il pourrait en résulter une «obéissance anticipée» de ces autorités eu égard à la pratique décisionnelle de l’autorité de tutelle et, d’autre part, « considérant le rôle de gardiennes du droit à la vie privée qu’assument les autorités de contrôle » (point 53), leurs décisions comme elles-mêmes doivent être au-dessus de tout soupçon de partialité.
Il restait à cerner l’étendue de l’obligation pesant sur les Etats membres concernant le respect de la durée du mandat de ces autorités jusqu’à leur terme. Elle ne s’y dérobe pas.
Leur accorder le droit de mettre fin au mandat d’une autorité de contrôle avant son terme sans respecter les règles et les garanties préétablies à cette fin par la législation applicable constituerait, de son point de vue une menace potentielle qui « planerait alors sur cette autorité tout au long de l’exercice de son mandat » et pourrait conduire à une forme d’obéissance de celle-ci au pouvoir politique, incompatible avec ladite exigence d’indépendance. Que la fin anticipée du mandat résulte d’une restructuration ou d’un changement de modèle n’y changerait rien.
Elle délivre alors son interprétation : l’exigence d’indépendance mentionnée par la directive 95/46 doit être « nécessairement être interprétée comme incluant l’obligation de respecter la durée du mandat des autorités de contrôle jusqu’à son échéance et de n’y mettre fin de manière anticipée que dans le respect des règles et des garanties de la législation applicable » (point 55). Le droit de l’Union en pouvait raisonnablement être compris comme autorisant la Hongrie à adopter un comportement différent.
D’où la constatation du manquement commis par les autorités hongroises à leurs obligations, que la Cour de justice n’accepte pas d’atténuer en faisant droit à la demande la Hongrie de limiter dans le temps les effets de son arrêt.

2 – De la proportionnalité de l’ingérence des pouvoirs publics dans la conservation des données

L’arrêt rendu dans les affaires jointes Digital Rights Ireland et Seitlinger (C-293/12 et 594/12) est d’une importance plus grande encore. Par la radicalité de la solution de la Cour, l’invalidation entière d’une directive, comme par le raisonnement mené pour y parvenir et par l’impact de sa solution sur les pratiques nationales, il doit être salué. A une question de principe, la Cour apporte sans se dérober une réponse de même nature.

Une question de principe

C’est par la voie préjudicielle que la High Court Irlandaise, d’une part, et la Cour constitutionnelle autrichienne, d’autre part, interrogeaient la Cour de justice sur la validité de la directive 2006/24 sur la conservation des données générées ou traitées dans le cadre de la fourniture de services de communications électroniques accessibles au public ou de réseaux publics de communications. La première, à l’occasion de litiges nationaux concernant son application tandis que l’autre devait trancher une série impressionnante de contestations prenant la forme de recours en constitutionnalité faisant suite à la transposition de la directive en droit interne.
Etait principalement en cause l’obligation faite aux opérateurs économiques de collecter, conserver et rendre disponibles pendant un temps déterminé un nombre considérable de données à caractère personnel recueillies lors des communications individuelles dans l’ensemble de l’Union, ce afin de lutter contre des activités criminelles graves.
L’occasion était rêvée pour la Cour de justice de se prononcer sur les conditions dans lesquelles l’Union européenne peut juridiquement limiter l’exercice des droits fondamentaux, en l’espèce ceux du respect de la vie privée et de la protection des données à caractère personnel garantis par les articles 7 et 8 de la Charte des droits fondamentaux de l’Union.

L’article 52 §1 de cette dernière reprend en effet la logique qui anime les droits conditionnels de la Convention européenne des droits de l’Homme en affirmant que « toute limitation de l’exercice des droits et libertés reconnus par la présente Charte doit être prévue par la loi et respecter le contenu essentiel desdits droits et libertés. Dans le respect du principe de proportionnalité, des limitations ne peuvent être apportées que si elles sont nécessaires et répondent effectivement à des objectifs d’intérêt général reconnus par l’Union ou au besoin de protection des droits et libertés d’autrui ». Les « explications » accompagnant la Charte et son article 7, abondamment citées dans le prétoire du Kirchberg, soulignent cet équilibre nécessaire.

La Cour était donc invitée à ce calcul de proportionnalité, derrière les questions des juges irlandais et autrichiens, pour évaluer la validité de la directive 2006/24.

Pour y parvenir, plusieurs clarifications étaient nécessaires. Déterminer la pertinence de l’invocation de la Charte en la matière était la plus simple, tant il allait de soi que la collecte et la conservation par les autorités nationales de données aussi sensibles pour la vie privée relevaient de son champ d’application.
Cerner la fonctionnalité exacte de la directive 2006/24 posait en revanche une question plus sensible.
On sait à cet égard la propension grandissante des institutions, telles que la Commission par exemple à propos de la migration ou de la justice, à réduire le fonctionnement de l’Espace de liberté, sécurité et justice à un prolongement du marché intérieur, accompagnée en cela par une doctrine ignorante de sa genèse et de sa charge politique. Négligeant celle-ci en mettant en avant une logique économique, cette approche est contraire à la réalité de l’Union comme au droit issu d’un traité qui garantit la sécurité à ses citoyens.
L’avocat général Cruz Villalon s’en faisait l’écho dans ses conclusions, multipliant les explications relatives à la « dualité fonctionnelle » de la directive 2006/24, adoptée « dans l’objectif de protéger le bon fonctionnement du marché intérieur, de mettre un terme à l’évolution hétérogène des réglementations existantes, tout en y faisant obstacle pour le futur ». La Cour de justice, dans son arrêt Irlande c. Parlement et Conseil de 2009 (C-301/06), avait d’ailleurs expressément rejeté une contestation portant sur la base juridique de cette directive, l’article 95 TCE, prétendant que l’unique objectif de la directive était en fait celui de la lutte contre le terrorisme réglée dans le titre VI du TUE de l’époque.
La Cour de justice n’en reste pas à cette lecture formelle et, de manière éclatante, elle relie la problématique à la politique de sécurité intérieure de l’Union européenne.
Il lui fallait en effet, dans le premier terme de son raisonnement visant à établir la légalité de la directive, identifier l’existence d’un intérêt public susceptible de justifier l’intervention de l’Union dans la vie privée des citoyens de l’Union c’est-à-dire vérifier que ces ingérences éventuelles répondent effectivement à des objectifs d’intérêt général reconnus par l’Union ou au besoin de protection des droits et libertés d’autrui, en vertu de l’article 52 §1 de la Charte.
Sans démentir ses affirmations précédentes relatives au besoin d’harmonisation des droits nationaux en matière de conservation des données, elle y apporte néanmoins un bémol qui contraste avec sa jurisprudence péremptoire de 2009 : « l’objectif matériel de cette directive vise, ainsi qu’il découle de son article 1er, paragraphe 1, à garantir la disponibilité de ces données à des fins de recherche, de détection et de poursuite d’infractions graves telles qu’elles sont définies par chaque État membre dans son droit interne. L’objectif matériel de cette directive est, dès lors, de contribuer à la lutte contre la criminalité grave et ainsi, en fin de compte, à la sécurité publique » (point 41). Fermez le ban …

On sait en effet depuis la jurisprudence Kadi que la lutte contre le terrorisme constitue un « objectif d’intérêt général de l’Union » tout comme l’est la lutte contre la criminalité grave afin de garantir la sécurité publique (CJUE, Tsakouridis, C‑145/09). De façon intéressante, la Cour souligne ici du reste que l’article 6 de la Charte énonce le droit de toute personne non seulement à la liberté, mais également à la sûreté (point 42).
Apportant ainsi un fondement à la politique sécuritaire de l’Union, dans la logique du préambule de son traité et des articles 3 §2 TUE et 67 §3 TFUE, la Cour n’avait plus alors qu’à évaluer la proportionnalité de l’ingérence ainsi constatée.

Une réponse de principe

Constater l’existence d’une ingérence dans les droits fondamentaux consacrés par les articles 7 et 8 de la Charte n’était guère compliqué et la Cour se livre sans difficulté à cet examen. Tant l’obligation de conservation des données à caractère personnel que l’accès des autorités nationales à ces données ou leur traitement constituent une ingérence flagrante dans les droits fondamentaux des individus et la Cour souligne à la suite de son avocat général qu’elle « s’avère d’une vaste ampleur et qu’elle doit être considérée comme particulièrement grave » (point 37).
De plus, la conservation des données et l’utilisation ultérieure de celles-ci étant effectuées sans que l’abonné ou l’utilisateur inscrit en soient informés est « susceptible de générer dans l’esprit des personnes concernées, ainsi que l’a relevé M. l’avocat général aux points 52 et 72 de ses conclusions, le sentiment que leur vie privée fait l’objet d’une surveillance constante ».
La seule question posée consistait donc à trancher le point de sa proportionnalité.
Le contrôle juridictionnel du principe de proportionnalité n’est pas étranger à la Cour de justice, chacun le sait. Néanmoins, et elle appréciera ce coup de chapeau tardif, la Cour européenne des droits de l’Homme est passée maîtresse dans l’examen du jeu de la balance des intérêts en présence.
C’est donc très heureusement que la Cour de justice se réfère par analogie à l’article 8 CEDH et à la jurisprudence S. et Marper c. Royaume Uni, arrêt fondateur s’il en est, pour signifier que l’étendue du pouvoir d’appréciation du législateur de l’Union peut être strictement limitée en fonction d’un certain nombre d’éléments, parmi lesquels figurent, notamment, le domaine concerné, la nature du droit en cause garanti par la Charte, la nature et la gravité de l’ingérence ainsi que la finalité de celle-ci.

Elle délivre en fait ici sa grille de lecture.
Certes, les données conservées en application de la directive 2006/24 permettent aux autorités nationales compétentes en matière de poursuites pénales de disposer de possibilités supplémentaires d’élucidation des infractions graves. Elles constituent donc un instrument utile pour les enquêtes pénales et leur conservation de telles données peut être considérée comme apte à réaliser l’objectif poursuivi par ladite directive. Or, la lutte contre le terrorisme et la criminalité est d’une importance primordiale dont l’efficacité peut dépendre de l’utilisation de ces techniques modernes d’enquête.
Néanmoins, cet « objectif d’intérêt général, pour fondamental qu’il soit, ne saurait à lui seul justifier qu’une mesure de conservation telle que celle instaurée par la directive 2006/24 soit considérée comme nécessaire aux fins de ladite lutte ».
Prenant en considération, d’une part, le rôle important que joue la protection des données à caractère personnel au regard du droit fondamental au respect de la vie privée et, d’autre part, l’ampleur et de la gravité de l’ingérence dans ce droit que comporte la directive 2006/24, le pouvoir d’appréciation du législateur de l’Union ne saurait qu’être réduit et il appelle un contrôle juridictionnel strict.
Mentionnant la jurisprudence de la CEDH, la CJUE souligne que « la réglementation de l’Union en cause doit prévoir des règles claires et précises régissant la portée et l’application de la mesure en cause et imposant un minimum d’exigences de sorte que les personnes dont les données ont été conservées disposent de garanties suffisantes permettant de protéger efficacement leurs données à caractère personnel contre les risques d’abus ainsi que contre tout accès et toute utilisation illicites de ces données ».
Tel n’est manifestement pas le cas et la Cour parvient rapidement à une conclusion cruelle : « la directive 2006/24 ne prévoit pas de règles claires et précises régissant la portée de l’ingérence dans les droits fondamentaux consacrés aux articles 7 et 8 de la Charte. Force est donc de constater que cette directive comporte une ingérence dans ces droits fondamentaux d’une vaste ampleur et d’une gravité particulière dans l’ordre juridique de l’Union sans qu’une telle ingérence soit précisément encadrée par des dispositions permettant de garantir qu’elle est effectivement limitée au strict nécessaire ».

Comment ne pas la suivre ?

En premier lieu, la directive 2006/24 couvre de manière généralisée et indifférenciée l’ensemble des individus, des moyens de communication électronique et des données relatives au trafic, indépendamment de son objectif de lutte contre les infractions graves.
Deuxièmement, la directive ne prévoit aucun critère objectif permettant de garantir que les autorités nationales compétentes n’aient accès aux données et ne puissent les utiliser qu’aux fins qui leur sont assignées. Elle renvoie de manière générale aux « infractions graves » définies par chaque État membre dans son droit interne, sans précision procédurale ni contrôle préalable d’une juridiction ou d’une entité administrative indépendante.
Pire, la durée de conservation des données est d’au moins six mois et de 24 mois au maximum, sans encadrement des catégories de données en fonction des personnes concernées ou de l’utilité éventuelle des données par rapport à l’objectif poursuivi, ni critère objectif ni protection contre une utilisation abusive.
Enfin, et la précision est de taille au regard des échanges de données dans la lutte internationale contre la criminalité, la Cour met en cause le fait que la directive n’impose pas une conservation des données sur le territoire de l’Union.
Ainsi, la directive ne garantit pas pleinement le contrôle du respect des exigences de protection et de sécurité par une autorité indépendante, comme cela est pourtant explicitement exigé par la charte.
Or, un tel contrôle, effectué sur la base du droit de l’Union, constitue un élément essentiel du respect de la protection des personnes à l’égard du traitement des données à caractère personnel.
Dans un tel contexte, l’invalidation de la directive 2006/24 coulait de source, au détail près de son ampleur et de son effet dans le temps.
La Cour de justice n’y va pas par quatre chemins, négligeant toute opération de chirurgie juridique visant à sauvegarder certains pans de la législation ou la face de ses auteurs. Le texte est invalidé dans son ensemble, créant de ce fait un vide juridique considérable.

A cela, la Cour aurait pu répondre en suivant la suggestion de son avocat général l’incitant à faire usage de la faculté que lui offre l’article 264 TFUE de limiter dans le temps les effets de sa déclaration d’invalidité.

Ce dernier faisait état d’une prudence nécessaire : « la mise en balance des différents intérêts en présence doit faire l’objet d’une pondération très attentive ». Si la violation des droits fondamentaux ne souffrait pas de doute, les invalidités constatées relevaient d’un simple défaut d’encadrement et les États membres avaient « de façon générale, ainsi qu’il ressort des éléments fournis à la Cour, exercé leurs compétences avec modération pour ce qui est de la durée maximale de conservation des données » point 157).

La Cour s’y refuse, invitant de la sorte les institutions de l’Union à remédier au plus vite aux effets de leur inconséquence, terme faible s’il en est au vu des enjeux en cause.

Data Retention: a landmark Court of Justice’s ruling.(5) From now on, no more “just in case ” retention of data…

By Peter Schaar
(translated by Douwe Korff)

The judgment of the CJEU on compulsory data retention is remarkable for two reasons.
First, the Court essentially agrees with the critics of data retention: The general, suspicion-less retention of telecommunication data is incompatible with both the fundamental right to respect for private life, and with the fundamental right to data protection.
The second, broader message is that the CJEU sees itself as the guardian of the civil and political rights enshrined in the EU Charter of Fundamental Rights, and will correct the European legislator if the latter exceeds the limits set by the Charter.

The Court does not deny that it is in the public interest to fight against serious crime, in particular organised crime and terrorism. However:

such an objective of general interest, however fundamental it may be, does not, in itself, justify a retention measure such as that established by Directive 2006/24 [the Data Retention Directive] being considered to be necessary for the purpose of that fight. (para. 51)

As the Court puts it, with reference to its settled case-law:

derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary. (para. 52)

So far, one could think that the Court – like the German Constitutional Court – felt that all-encompassing data retention is not fundamentally contrary to human rights.
However, the Luxembourg Court goes further than that, when it notes that:
Directive 2006/24 affects, in a comprehensive manner, all persons using electronic communications services, but without the persons whose data are retained being, even indirectly, in a situation which is liable to give rise to criminal prosecutions. It therefore applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. …

Moreover, whilst seeking to contribute to the fight against serious crime, Directive 2006/24 does not require any relationship between the data whose retention is provided for and a threat to public security and, in particular, it is not restricted to a retention in relation
(i) to data pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime, or
(ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offenses. (paras. 58 – 59, emphasis added)

In the above, the Court clearly rejects suspicion-less mass retention of data “just in case” they may be useful in future. By contrast, the judgment does not reject the possibility of limited, targeted retention of data.
This corresponds to a green light for the “quick-freeze” model of data retention, under which judicial court orders can be issued to retain specific categories of relevant data for specified, limited periods, when there are concrete indications that a serious crime is being planned or in process.

The Court points to a series of other serious defects in the Data Retention Directive, that had also already been noted by the German Constitutional Court: lack of clarity in the definition of “serious crime”; unclear, insufficiently precise rules on the access to and use of the retained data; and a lack of rules on technical and organisatorial measures needed to ensure the security of the data.
The Directive also failed to contain provisions to protect data that are subject to special rules on confidentiality, such as attorney – client communications.

The judgment of the CJEU dramatically changes the legal landscape: all of a sudden Germany is the only EU Member State with national legal rules that meet the European requirements, simply because the German rules do not allow for “just in case” data retention (Vorratsdatenspeicherung).

Hopefully, the EU institutions will draw the right conclusions from the message of the Court.
The judgment points the way for other measures that would also lead to massive, suspicionless data retention “just in case”: the planned European Passenger Name Records (PNR)- and Entering-Leaving Registers should be scrapped, as should the introduction of suspicionless mass data retention, envisaged in the German Grand Coalition Agreement.

Notes:
BVerfG, 1 BvR 256/08 vom 2.3.2010, available here.
See Peter Schaar: “Quick Freeze” instead of data retention, Federal Commissioner for Data Protection and Freedom of Information, 15 June 2010, here.
The German Government endorsed this suggestion but it was highhandedly rejected by the European Commission. See here.
On 10 April 2014, a Swedish ISP announced it had deleted all retained customer data in response to the CJEU judgment; and the relevant Swedish regulatory authority informed the government that it will not take action against the ISP for non-compliance with the Swedish law implementing the Directive – thus effectively suspending the application of the law. See here and here.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (4) .. will this saga continue and how ?..

FROM EUANALYSYSBLOG
by Professor Steve PEERS Tuesday, 8 April 2014

The data retention judgment: The CJEU prohibits mass surveillance

On July 7, 2005 a relative of mine started her journey to work on a London tube train. Within half an hour, bombs on that train left by terrorists exploded, in conjunction with three other bombs across London. Dozens of people died (although my relative was not injured).
Understandably, public concern about terrorist incidents, following on from the earlier outrages of 9/11 and the Madrid bombings, led to further EU anti-terrorist legislation.
In particular, the British Presidency of the EU Council made it a top priority to adopt legislation providing for retention of a large amount of communications data. But according to the Court of Justice of the European Union (CJEU), in a crucial judgment today, that legislation was essentially an over-reaction to these terrorist atrocities. The Court has effectively prohibited mass surveillance in the EU, and thus taken significant steps to entrench itself as the EU’s constitutional court.

Summary of the judgment

As discussed in detail by Chris Jones’ post on this blog (EUANALYSYSBLOG), the Directive requires Member States to require telecommunications service providers to retain significant amounts of data on the use of all forms of telecommunications by all individuals within the EU, for a period of between 6 months and 2 years. This data is collected for the use of law enforcement agencies as regards investigations into serious crime or terrorism, but there are no detailed rules in the Directive governing the access to and use of the data by those authorities.
The CJEU only found it necessary to address the question of the validity on the Directive in light of the Charter rights to privacy and data protection (Articles 7 and 8 of the Charter).

First of all, the Court unsurprisingly had no difficulty finding that the Directive interfered with the protection of those two rights. Its analysis focussed instead on whether such an interference could be justified.

The rules on justifying interferences with Charter rights are set out in Article 52 of the Charter. Any limitation upon Charter rights must be laid down by law, respect the essence of the right, and subject to the principle of proportionality, limit rights and freedoms only if it is necessary and genuinely meets public interest objectives and the rights and freedoms of others.
The Court easily found that there was a public interest justification (public safety) for the restriction of the Charter rights at issue.
It also found that the ‘essence’ of the rights was not affected, because (as regards the right to privacy) the content of communications was not recorded, and (as regards the right to data protection) certain data processing and data security rules had to be respected.

Therefore the key issues in the Court’s ruling were the proportionality of the interference with Charter rights.
The Court indicated that judicial review of the EU legislature’s discretion should be ‘strict’ in this case, applying factors such as the area of law concerned, the nature of the right, the nature and seriousness of the infringement and the objective pursued. Here, it followed from the nature of the right and the nature and seriousness of the infringement that the EU legislature’s discretion was reduced; the CJEU took no account expressly of the objective being pursued.

The first aspect of proportionality (the appropriateness of the interference with the right for obtaining the objective) was fulfilled, because the data concerned might be useful to investigations. However, the CJEU found that the Directive was problematic as regards the second facet: the necessity of the measure in question.
Crucially the Court ruled that the important objective of investigating serious crime and terrorism did ‘not, in itself’ justify data retention. So for the CJEU, the safety of the people is not the supreme law.
Its analysis proceeded by setting out the general importance of safeguards as regards the protection of privacy and data protection rights (building upon the case law of the European Court of Human Rights). These safeguards are even more necessary when data is processed automatically, with a risk of unlawful access.

Applying this test, the Court gave three reasons why the rules on data retention in the Directive were not strictly necessary.

First of all, the Directive had an extremely broad scope, given that it applied to all means of electronic communication, which have ‘widespread and growing importance’ in everyday life, without being sufficiently targeted.
Indeed, it ‘entails an interference with the fundamental rights of practically the entire European population’. In other words (the Court does not use the term), it amounts to mass surveillance.

Secondly, besides the ‘general absence of limits’ in the Directive, it failed to limit access to the data concerned by law enforcement authorities, and the subsequent use of that data, sufficiently precisely. In particular: it referred generally to ‘serious crime’ as defined in national law; it did not restrict the purpose of subsequent access to that data; it did not limit the number of persons who could access the data; and it did not control access to the data by means of a court or other independent administrative authority.

Thirdly, the Directive did not set out sufficient safeguards, as regards: the data retention period, for instance as regards the categories of data to be retained for the whole period; the protection of the data from unlawful access and use (here the CJEU criticises the possible limits on protection measures due to reasons of cost); the absence of an obligation to destroy the data; and the omission of a requirement to retain the data within the EU only.

Comments

The CJEU reached the same conclusion as the Advocate-General’s opinion, but for different reasons.
In the Advocate-General’s view, the Directive was invalid because it breached the ‘quality of law’ requirement applicable to interferences with Charter rights, having failed to establish sufficient safeguards relating to access to and use of the data. It also was disproportionate for failing to explain why storage periods of up to two years were necessary.
The Court’s ruling appears to go further, by ruling out mass surveillance in principle.

The opinion discussed some interesting and important issues that the Court does not directly address, in particular: the existence of a ‘quality of law’ requirement as regards breaches of the Charter; whether the EU or the Member States have responsibility for ensuring the satisfaction of that requirement in this case; and the complications of the ‘legal base’ issue, ie the awkward point that inserting safeguards relating to law enforcement authorities might go beyond the ‘internal market’ legal base of the legislation.
It might be deduced that the CJEU has a view on these issues: there is a ‘quality of law’ rule; the EU is responsible for upholding that requirement in this case; and the ‘legal base’ point is not a barrier to the EU adoption of rules regulating law enforcement authorities. But unfortunately, the Court did not expressly spell out its reasoning on these issues.
It is certainly peculiar that, having ruled previously that the Directive was validly based on EU internal market powers, the CJEU rules here that its interference with Charter rights is justified by the objective of public safety.

As for the reasoning which the Court did provide, as usual it was easy to find public interest objectives for the interference with rights.
The most important part of the reasoning is therefore the analysis of the interference with the ‘essence’ of the right, and of proportionality.
It is very significant that the Court makes clear that these are two different issues: even if the essence of a right is respected, legislation can be disproportionate. Earlier case law on restriction of rights often seemed to suggest that respecting the essence of rights was sufficient.

Another important aspect of the judgment is the development of a doctrine indicating when strict scrutiny of the EU legislature’s interference with fundamental rights should apply.
This is based upon Strasbourg case law, not the standards of national constitutional courts, which have of course addressed this issue in their own way.
Obvious questions arise as to whether the same standards should apply to national implementation of EU law, or to Charter rights not based upon the ECHR.

While many data protection specialists argue that there is a fundamental distinction between the right to privacy and the right to data protection, the Court’s judgment only reflects that distinction to a limited degree. It assesses separately whether there is an interference with Articles 7 and 8 of the Charter, and whether the essence of each right has been affected. However, it made no distinction between the rights when assessing the required intensity of judicial review, and linked the two rights together when assessing the proportionality of the interference with them.

Consequences of the judgment

First and foremost, the data retention Directive is entirely invalid.
The Court did not in any way rule that it could continue in force. So the immediate consequence is that we return to the status quo before 2005.
This means that Member States have an option, not an obligation, to retain data pursuant to the e-privacy Directive (see further Chris Jones’ post on the background to the data retention Directive). However, Member States’ exercise of this option will still be subject to the requirements set out in this judgment, since their actions will fall within the scope of the Charter, given that the e-privacy Directive regulates the issue of interference with telecommunications.

Would it be possible for the EU to adopt a new Directive on mandatory data retention? In other words, can the Directive in some way be ‘fixed’?

First of all, since the 2006 Directive is entirely invalid, the EU legislature has to start from scratch, rather than amend it.
Secondly, it is clear from the Court’s judgment that some form of mandatory data retention in order to combat serious crime and terrorism is acceptable from the perspective of the EU Charter.
How would such a new Directive differ from the measure the Court has just struck down?
The Court sets out unusually detailed guidelines for the legislature (and, in the meantime, for national legislature) in its judgment.

First of all, any new Directive would have to be in some sense targeted upon communication which has a particular link with serious crime and terrorism. Very simply, mass surveillance is an unjustifiable infringement of Charter rights.

Secondly, a new Directive would have to contain rules on: the definition of ‘serious crime’; the purpose of subsequent access to the data; limits on the number of persons who could access the data; and control of access to the data by means of a court or other independent administrative authority.

Thirdly, the new Directive would have to include stronger rules on the data retention period, for instance as regards the categories of data to be retained for the whole period, as well as the protection of the data from unlawful access and use. It would also have to contain rules on the absence of an obligation to destroy the data, and require that data be retained within the EU only. The Court did not rule on whether subsequent processing of the data in third States would be acceptable, but logically there must be some rules on this issue too.
Probably it would be simplest to extend the external processing rules in the main EU data protection legislation to this issue.

Depending on the timing of a proposal for a new Directive (assuming that there is one), it might possibly get mixed up with the conclusion of negotiations over main the main data protection package being negotiated by the EU institutions. Alternatively, if those negotiations have concluded, they will establish a template that the negotiation of the new Directive can take account of.

Final comments

The Court’s judgment can be seen in the broader context of continued revelations about mass surveillance.
Its reference to the retention of data by third States is a thinly-disguised allusion to the spying scandals emanating from the United States.
It also responds, sotto voce, to the very great concerns of national constitutional courts about this Directive, discussed in detail in Chris Jones’ post on this issue.

More broadly, the CJEU has seized the chance to give an ‘iconic’ judgment on the protection of human rights in the EU legal order. Time will deal whether the Digital Rights judgment is seen as the EU’s equivalent of classic civil rights judgments of the US Supreme Court, on the desegregation of schools (Brown) or criminal suspects’ rights (Miranda). If the Charter ultimately contributes to the development of a ‘constitutional patriotism’ in the European Union, this judgment will be one of its foundations.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (3) ..a contentious saga…

National legal challenges to the Data Retention Directive
by Chris Jones, Researcher for Statewatch

This post, which examines the numerous legal challenges against the EU’s Data Retention Directive at both national and EU level (not including today’s judgment), is the third post in a series examining the EU’s mandatory data retention legislation, which was struck down today by the Court of Justice of the European Union (CJEU). It is based on work undertaken by Statewatch as part of the SECILE project (Securing Europe through Counter-terrorism: Impact, Legitimacy and Effectiveness).

EU Court of Justice legal basis challenge

The first legal challenge to the Data Retention Directive came when Ireland, supported by Slovakia, asked the EU Court of Justice to annul the Directive on the grounds that it had the wrong legal basis. They argued that the correct legal basis for data retention resided “in the provisions of the EU Treaty concerning police and judicial cooperation in criminal matters,” rather than those on the internal market. The ECJ dismissed the case in February 2009, stating that:“Directive 2006/24… regulates operations which are independent of the implementation of any police and judicial cooperation in criminal matters. It harmonises neither the issue of access to data by the competent national law-enforcement authorities nor that relating to the use and exchange of those data between those authorities… “It follows that the substantive content of Directive 2006/24 is directed essentially at the activities of the service provides in the relevant sector of the internal market, to the exclusion of State activities coming under Title VI of the EU Treaty”.

Bulgaria

The first ruling on national laws transposing the Directive came from Bulgaria in proceedings launched by the NGO Access to Information Program. In December 2008 the country’s Supreme Administrative Court annulled an article of the transposing legislation permitting the Ministry of Interior “passive access through a computer terminal” to retained data, as well as providing access without judicial permission to “security services and other law enforcement bodies”. The court found that:“[T]he provision did not set any limitations with regard to the data access by a computer terminal and did not provide for any guarantees for the protection of the right to privacy stipulated by Art. 32, Para. 1 of the Bulgarian Constitution. No mechanism was established for the respect of the constitutionally granted right of protection against unlawful interference in one’s private or family affairs and against encroachments on one’s honour, dignity and reputation.”The court also found the legislation failed to make reference to other relevant laws – the Penal Procedure Code, the Special Surveillance Means Act and the Personal Data Protection Act – “which specify conditions under which access to personal data shall be granted.”

Hungary

In June 2008 the Hungarian Civil Liberties Union (HCLU or TASZ, Társaság a Szabadságjogkért) requested “the ex-post examination” by the Hungarian Constitutional Court of the amendment of Act C of 2003 on electronic communications, “for unconstitutionality and the annulment of the data retention provisions.”According to the HCLU, Act C “already comprised numerous restrictive data retention provisions prior to the directive. The only changes brought in by the amendments were the retention of Internet communications data and the elimination of the lax – but at least pre-defined – legal purposes of the data processing”. The HCLU argued that “the amendments completely disregarded the provisions of the directive [stating] that data should be ‘available for the purpose of investigation, detection and prosecution of serious crimes’.” Despite being filed in 2008, the case is yet to be heard. According to Fanny Hidvégi of the HCLU, this is because as of 1 January 2012 new restrictions were placed on submitting cases to the Constitutional Court, and “every pending case submitted by a person or institution which no longer has the right to do so were automatically terminated”. The HCLU has begun a new and lengthy procedure that requires the exhaustion of all other remedies before the Constitutional Court can examine the Hungarian data retention measures.

Romania

In October 2009, the Romanian Constitutional Court found that proposed national legislation implementing the Data Retention Directive violated Romanian constitutional provisions protecting freedom of movement; the right to intimate, private and family life; secrecy of correspondence; and freedom of expression. The court found that the government’s attempt to justify the mandatory retention of telecommunications data by invoking undefined “threats to national security” was unlawful. The Court also referred to the 1978 ECHR ruling in Klass v Germany, which stated that “taking surveillance measures without adequate and sufficient safeguards can lead to ‘destroying democracy on the ground of defending it’.”

In October 2011 the European Commission asked the Romanian government to bring forward new laws transposing the Directive, issuing a “reasoned opinion” under Article 258 of the TFEU, which carries the threat of full infringement proceedings at the European Court of Justice if the request is not met. A new law was duly drafted, but was rejected by the Romanian Senate. The law was heavily criticised in the media prior to the vote and the country’s Data Protection Authority had refused to endorse it, claiming that articles relating to the security services were “still vague”. Civil society organisations also opposed it and even the government refused to sponsor it, leaving the Minister of Communications and Information Society to propose it in his role as MP rather than minister. Strong support from the Minister of European Affairs fuelled criticism that it was motivated solely by the need to escape sanction by the European Court of Justice.

Ultimately the Senate vote was not decisive and the law continued its journey to the Chamber of Deputies, where at the end of May 2012 it was adopted with 197 votes for and 18 against, with many abstentions amongst the 332 deputies. There was no substantive discussion of fundamental rights issues in the Chamber of Deputies or the main two committees that debated the law and critics have argued that the provisions on access to retained data are even more problematic than the original statute. On 21 February 2013 the European Commission withdrew the infringement procedure that it had opened in 2011.

Cyprus

In February 2011 the Supreme Court of Cyprus ruled that aspects of the national transposing legislation breached the Cypriot constitution and case law on surveillance. The case was brought by individuals whose telecommunications data had been disclosed to the police in accordance with District Court orders. They argued that the laws underlying the orders were based (Articles 4 and 5 of Law 183(I) 2007, that sought to harmonise Cypriot law with the Directive), and therefore the District Court orders themselves violated their rights to privacy and confidentiality of communications. The Supreme Court found that petitioners had indeed been subject to a violation of their rights and annulled provisions it said went beyond the requirements of the Data Retention Directive. However, the legality of the Directive itself was not called into question.

Germany

Legislation transposing the Data Retention Directive into the Telecommunication Act and Code of Criminal Procedure was passed by the Bundestag on 9 November 2007 and entered into force on 1 January 2008. The day before, 31 December 2007, 35,000 German citizens (represented by the NGO AK Vorrat) filed a complaint against the legislation at the Federal Constitutional Court. On 2 March 2010 the Court ruled that the transposing provisions were a disproportionate interference with Article 10 (confidentiality of communications) of the Basic Law (Grundgesetz), and contravened legal standards on purpose limitation, data security, transparency and legal remedies.

However, the Court made no ruling on the actual Directive, stating that data retention is in principle proportionate to the aim of investigating serious crime and preventing imminent threats against life, body, freedom of persons, and the existence and security of the Federal Republic or one of its states. The Court found that the new domestic law failed to comply with legal standards on purpose limitation (restrictions on use of the retained data), data security, transparency and legal remedies.

In January 2011 the Ministry of Justice (MoJ) presented a paper proposing an alternative to data retention – a “quick freeze” system of limited data preservation for criminal investigations. The police and/or public prosecutors would issue a “quick freeze” order seeking access to metadata already held by telecommunications providers, for example for billing purposes. To actually access the “frozen”’ data would require the approval of a judge. In addition, the MoJ proposed an obligation for ISPs to store internet traffic data for seven days, allowing criminal investigators to identify persons behind (already known) IP addresses in particular in cases of child pornography. Criminal investigators would request the traffic and communications data via service providers without having direct access to these traffic data. This paper reflected proposals made in June 2010 by the Federal Commissioner for Data Protection, as well as the suggestions of more pragmatic privacy advocates.

More radical activists claim that any mandatory storage of communications data should be prohibited. The Interior Ministry rejected these proposals and insisted on full implementation of the Directive, arguing that the Constitutional Court had already shown that it is possible to implement the Directive and ensure individual privacy through high data security standards, including encryption and the “four eyes principle” (approval by at least two people) as prerequisite for accessing data and log files; strict purpose limitation; and the protection of professions whose confidentiality must be ensured.

The MoJ produced a “quick freeze” bill in April 2012 but continued opposition from the Interior Ministry meant that it was never tabled in Parliament. The Interior Ministry was unhappy with the length of the proposed freezing periods, demanding three months instead of the one month suggested by the Ministry of Justice. Moreover, the Interior Ministry wanted to include crimes such as fraud and hacking. The controversy continues and no new legislation has yet been introduced.

By this time the European Commission had initiated infringement proceedings and took its case to the European Court of Justice in July 2012. The Commission is seeking to impose a daily fine of €315,000.

Czech Republic

On 13 March 2011 the Czech Republic’s Constitutional Court declared national legislation implementing the Directive unconstitutional. It found that the retention period exceeded the requirements of the Directive, and that use of the data was not restricted to cases of serious crime and terrorism. “The national legislation lacked, according to the constitutional court, clear and detailed rules for the protection of personal data as well as the obligation to inform the person whose data has been requested.” As in Germany, the Court stated that it could not review the Directive itself, but noted there was nothing in principle preventing implementation in conformity with constitutional law.

A second Constitutional Court decision in December 2011 examined the procedures put in place for obtaining access to retained data and found the “procedure in question to be too vague, in breach of [the] proportionality rule (its second step) and thus unconstitutional due to interference with right to privacy and informational self-determination.” In the meantime the Czech government revised the implementing legislation with modifications that took account of the judgment.The NGO Iuridicum Remedium has lodged fresh proceedings against the revised legislation on the grounds that regulation remains inadequate and that the new decree could provide for the “monitoring of contents of Internet communications”.

Slovakia

In August 2012 a group of Slovakian MPs, supported by the European Information Society Institute, lodged a legal complaint against the legislation implementing the Data Directive. The complaint asks the Slovak Constitutional Court to examine whether the laws implementing the Directive and dealing with access by the authorities to retained data are compatible with constitutional provisions on proportionality, the rights to privacy and data protection, and the provision granting freedom of speech. It also argues that the measures infringe provisions guaranteeing privacy, data protection and freedom of expression in Slovakian human rights law, the European Convention on Human Rights and the Charter of Fundamental Rights of the European Union. The complaint has not yet been resolved.

Sweden

The European Commission has engaged in a lengthy battle to try to bring Sweden’s domestic legislation into line with the Directive. After the country missed the initial September 2007 deadline, the Commission brought infringement proceedings, with the European Court of Justice finding Sweden guilty of failing to fulfil its obligations in February 2010. A proposal for transposing legislation was put forward in December 2010 and adopted in March 2012. The new law should have taken effect in May 2012 but despite an overwhelming vote in favour of the new measures in the Swedish parliament (233 MPs voted in favour with 41 against and 19 abstaining), the Left Party and the Greens invoked a constitutional provision allowing the entry into force of new measures to be delayed by a motion of one sixth of the parliament’s members.

In May 2013, the European Court of Justice ordered Sweden to pay a €3 million fine for its delay in implementing the legislation. The Court rejected Swedish pleas regarding the domestic controversy over the implementation of the law:“As the Court has repeatedly emphasised, a Member State cannot plead provisions, practices or situations prevailing in its domestic legal order to justify failure to observe obligations arising under European Union law… The same is true of a decision, such as the one made by the Swedish Parliament, to which paragraph 8 of this judgment makes reference, to postpone for a year the adoption of the draft bill intended to transpose that directive.”

The Court of Justice of the European Union (CJEU)

The most serious challenge to the implementation of the Data Retention Directive has come from joined cases brought by the NGO Digital Rights and the plaintiffs in a case referred from the Austrian Constitutional Court. The Advocate General’s opinion on the case, published in December 2013 following a hearing in July, proposed that the Court declare the Directive as a whole incompatible with EU Charter articles 52(1) (limitations on rights “must be provided for by law and respect the essence of those rights and freedoms”) and 7 (right to privacy). The case focuses on the compatibility of the Directive with Articles 7 (respect for private and family life) and 8 (protection of personal data) of the European Union Charter of Fundamental Rights. At the hearing the representatives of those who brought the cases argued that the Directive is fundamentally incompatible with the Charter and that there is still no evidence to demonstrate that its necessity or proportionality.

On behalf of Austrian privacy group AK Vorrat, Edward Scheucher argued that:“[T]he cumulative effect of fundamental rights restrictions need to be taken into consideration when judging the legitimacy of a single measure. Given the revelations regarding PRISM, this cumulative effect now clearly provides a different result [than] at the time when the German [Constitutional] Court took its decision [to annul certain provisions of German transposing legislation]. Furthermore, he stated that the Austrian implementation of the directive clearly showed that a Charter-compatible national implementation of the Data Retention Directive is not possible. This argument is bolstered by the fact that the main author of the Austrian implementation is among the 11,139 Austrian plaintiffs who challenged data retention before the Austrian Constitutional Court.”

In response to requests for evidence demonstrating the necessity of the Directive, the Austrian and Irish governments presented new statistics on the use of retained data at the hearing. Also arguing in favour of the Directive were representatives of Italy, Spain and the UK, as well as the Commission, the Council and the Parliament. However, the Directive’s advocates still “had to acknowledge a lack of statistical evidence”, with the UK admitting that “there was no ‘scientific data’ to underpin the need” for data retention. Judge Thomas von Danwitz, the Court’s main rapporteur for the hearing, asked for information that had led to the adoption of the Directive in 2006, given that “the Commission in 2008 claimed not to have enough information for a sound review”. The Council’s lawyers, meanwhile, “implored the Court not to take away instruments from law enforcement”.

Ultimately, Advocate-General Cruz Villalón concluded that the Court answer the cases in the following way:“(1) Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC is as a whole incompatible with Article 52(1) of the Charter of Fundamental Rights of the European Union, since the limitations on the exercise of fundamental rights which that directivecontains because of the obligation to retain data which it imposes are not accompanied by the necessary principles for governing the guarantees needed to regulate access to the data and their use.“(2) Article 6 of Directive 2006/24 is incompatible with Articles 7 and 52(1) of the Charter of Fundamental Rights of the European Union in that it requires Member States to ensure that the data specified in Article 5 of that directive are retained for a period whose upper limit is set at two years.”

Today’s Grand Chamber judgment, which is analysed in Steve Peers’ separate post, ultimately agreed with this recommendation. The EU has finally been forced to redraft its mandatory data retention rules.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (2) ..a bit of history…

Monday, 7 April 2014
Background to the EU Data Retention Directive
By Chris Jones, Researcher for Statewatch

As the fallout from the Snowden leaks rumbles on, the Court of Justice of the European Union (CJEU) will today decide a case (Digital Rights Ireland, Seitlinger and Others that could spell the end for the EU’s Data Retention Directive in its current form. The Directive mandates the mass storage by private companies of individuals’ telecommunications data, in case it is required by law enforcement authorities to investigate cases of serious crime or terrorism.

The judgment follows the handing down of a critical opinion by Advocate General Cruz Villalón in December 2013, which proposed that the Court declare the Directive as a whole incompatible with EU Charter articles 52(1) (limitations on rights “must be provided for by law and respect the essence of those rights and freedoms”) and 7 (right to privacy). This post, based on work undertaken by Statewatch as part of the SECILE project (Securing Europe through Counter-terrorism: Impact, Legitimacy and Effectiveness), outlines the history of the 2006 Data Retention Directive; the key points of the legislation; and its problematic national implementation, which has been the subject of legal challenges across Europe. Two further posts will examine the implementation of the Directive and the challenges to it.

The Data Retention Directive: a brief overview

The 2006 Data Retention Directive obliges Member States to ensure that telecommunications and Internet Service Providers (ISPs) retain various types of data generated by individuals through the use of landline phones, fax machines, mobile phones, and the internet, “in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime”.The data that must be retained are:

The source of a communication;
The destination of a communication;
The date, time and duration of a communication;
The type of a communication;
Users’ communication equipment or what purports to be their equipment; and
The location of mobile communication equipment.

The retention period is a minimum of six months and a maximum of two years.
Member States decide exact duration as well as the conditions under which it may be accessed.

The European Data Protection Supervisor has called the Directive “without doubt the most privacy-invasive instrument ever adopted by the EU in terms of scale and the number of people it affects,” and it ranks among the most controversial pieces of counter-terrorism legislation the EU has ever adopted. Fierce debate as to its legitimacy and effectiveness has raged since the earliest stages of its drafting to the present day.

The policy-making process

According to the preamble of the Data Retention Directive, the terrorist attacks in Madrid in March 2004 and in London in July 2005 “reaffirmed… the need to adopt common measures on the retention of telecommunications data as soon as possible.” However, law enforcement agencies had been seeking data retention legislation long before the destruction of the World Trade Centre on 11 September 2001, and the Directive does not limit data retention to combating terrorism.

Demands for data retention can be traced back to the “International Law Enforcement and Telecommunications Seminars” (ILETS) held at the FBI academy in Quantico, Virginia, which commenced in 1993 with the aim of developing global “interception requirements” – standards for telephone-tapping by police and security agencies to be provided in all telephone networks.
Following the first ILETS meeting, the very first EU Council of Justice and Home Affairs (JHA) Ministers adopted a Resolution in November 1993 – which was not published – calling on experts to compare the needs of the EU vis-à-vis the interception of telecommunications “with those of the FBI”.

A second EU Resolution based on ILETS’ work was adopted in January 1995 and introduced obligations on telecommunications companies to cooperate with law enforcement agencies in the “real-time” surveillance of their customers. This was never actually discussed by the Council of Ministers. It was adopted instead by “written procedure” (where legislative texts are circulated among ministries and adopted if there are no objections). The Resolution, which was not published in any form until November 1996, formed the basis of the provisions on the interception of telecommunications in the EU Convention on Mutual Legal Assistance of 2000.
ILETS continued every year and in 1999 identified a new problem. Valuable “traffic data” – particularly mobile phone and internet usage records – were being erased by service providers after customers had been billed, a particularly acute issue in the EU because of the recently enacted EC Directive on privacy in telecommunications, which obliged service providers to delete traffic data after its use for billing purposes (usually within three months).
ILETS thus introduced the principle of mandatory data retention regimes that would oblige service providers to keep data for much longer periods. This demand then surfaced in other intergovernmental fora concerned with police and judicial cooperation, such as the G8. The American Civil Liberties Union, Privacy International and Statewatch would later dub this process “policy laundering”: “the use by governments of foreign and international forums as an indirect means of pushing policies unlikely to win direct approval through the regular domestic political process.”

In 2000 the EU decided to update the aforementioned 1997 Directive on privacy in telecommunications to take into account “new technologies” and proposed what would become known as the “e-Privacy” Directive. The draft Directive proposed scrapping the clause obliging service providers to delete traffic data after billing use. As a First Pillar matter (dealing with the functioning of the internal market), the European Parliament had what was then a rare vote on what was effectively a Justice and Home Affairs or Third Pillar issue (police surveillance). Following an extensive campaign by privacy advocates the proposal was rejected. However in 2002, with the events of 11 September 2001 providing a fresh justification, a left-right alliance of the European Socialist Party (PSE) and the European People’s Party (PPE) agreed the e-Privacy Directive and the “data retention amendment”, with the liberals, greens and left parties opposed. This paved the way for Member States to introduce their own optional national data retention regimes.
Yet no sooner was the ink dry on the e-Privacy Directive than a confidential draft Framework Decision on the compulsory retention of subscriber and traffic data for 12-24 months across the EU was circulated among Member States and leaked by Statewatch.
Following widespread criticism of the proposal in European media, the then-Danish presidency of the EU was moved to issue a statement saying that the proposal was “not on the table”.
If not ‘on the table’, the proposal appears to have remained close at hand – following the Madrid train bombings in March 2004, the ‘EU Declaration on combating terrorism’ endorsed the principle of mandatory data retention across the EU.
One month later the UK, France, Sweden and Ireland submitted a revised draft Framework Decision on data retention to the Council. By now, a majority of EU Member States had also introduced national data retention regimes. The EU proposal suffered another major setback when Statewatch published the confidential legal advice of the EU Council and Commission Legal Services, both of which had been withheld from MEPs and the public despite stating that the Framework Decision was unlawful because it had the wrong legal basis. Data retention, said the EU’s lawyers, was a First Pillar issue because it regulated the activities of service providers in the single market.

The European Commission, despite previously opposing data retention, redrafted the proposal as a Directive. This complicated things further. Whereas the European Parliament was only consulted on the draft Framework Decision, with the EU Council free to ignore its opinion, it would now enjoy full powers of “co-decision”. Moreover, during the consultation process on the Framework Decision, the Parliament had voted to reject mandatory data retention because it was “incompatible with Article 8” of the ECHR (protection of personal data).

However, between the defeat of the proposal for a Framework Decision and the publication of the proposal for a Directive, the July 2005 London tube bombings happened. These were used as a fresh justification for an EU data retention law, although the UK prime minister suggested at the time that “all the surveillance in the world” could not have prevented the attacks.

The UK then used its presidency of the EU Council to impose a deadline of the end of 2005 for the European Parliament to agree the measure, with Charles Clarke, UK Secretary of State, lecturing the EP on the need to adopt the proposal. Home Office officials were reported to have told MEPs in private that if parliament failed to do this they “would make sure the European Parliament would no longer have a say on any justice and home affairs matter.”
Led by Privacy International and the European Digital Rights Initiative, 90 NGOs and 80 telecommunications service providers wrote to MEPs, imploring them to reject the measure.
Despite their efforts, the EP finally agreed the measure on 14 December 2005, with another PSE-PPE alliance reversing the position on the draft Framework Decision that the parliament had taken just eight months earlier. The Directive completed its passage through parliament following a single reading, meeting the UK’s demands on the timeframe.
The Council of the EU adopted the legislation by qualified majority, with Ireland and the Slovakia voting against, and the Directive passed into law in March 2006.

Two further observations are relevant to any substantive consideration of the policy-making process.
The first concerns the role of the UK government, which took its attempts to enforce data retention to EU institutions after it had been prevented from a domestic mandatory data retention regime by the houses of parliament. In what appears to be a clear case of “policy laundering”, the subsequent EU Directive, championed by the UK government, was binding on the UK and implemented by statutory instrument, in the form of the Data Retention (EC Directive) Regulations 2007 and 2009.

The second observation concerns the role played by the US government in pushing for mandatory data retention in Europe, bilaterally in its discussions with the European Commission and EU Presidency, and in multilateral fora like the G8. This is noteworthy because at that time there were no corresponding powers in the USA, nor any intention to introduce them.
In place of blanket “data retention”, US law enforcement and security agencies are obliged to seek “preservation orders” from special surveillance courts.
However, recent leaks such as that of the FISA court order imposed on Verizon, demonstrate that US agencies and their special “surveillance court” have interpreted these principles so widely as to cover entire telephone networks and all of their users.

Nevertheless, a more principled implementation of such a regime would be more privacy-friendly than the EU’s current blanket approach.
Opposition to the Data Retention Directive in Europe included advocacy from civil society organisations for the development of this model as an alternative, with judicial supervision to try and ensure that access to private data is necessary and legitimate. This is still the preferred option of the Ministry of Justice in Germany, where implementation of the Directive has been highly controversial and the subject of a Constitutional Court ruling that demanded its redrafting.

DATA RETENTION: A LANDMARK COURT OF JUSTICE’s RULING (1)

SOURCE : EUROPEANLAWBLOG
Written by Orla Lynskey

JOINED CASES C-293/12 AND 594/12 DIGITAL RIGHTS IRELAND AND OTHERS: THE GOOD, THE BAD AND THE UGLY

In its eagerly anticipated judgment in the Digital Rights Ireland case, the European Court of Justice held that the EU legislature had exceeded the limits of the principle of proportionality in relation to certain provisions of the EU Charter (Articles 7, 8 and 52(1)) by adopting the Data Retention Directive. In this regard, the reasoning of the Court resembled that of its Advocate General (the facts of these proceedings and an analysis of the Advocate General’s Opinion have been the subject of a previous blog post). However, unlike the Advocate General, the Court deemed the Directive to be invalid without limiting the temporal effects of its finding. This post will consider the Court’s main findings before commenting on the good, the bad and the ugly in the judgment.

The Court’s Findings

In reaching this conclusion, the Court reasoned as follows. It first narrowed the multiple questions referred by the Irish and Austrian courts down to one over-arching issue, whether the Data Retention Directive is valid in light of Articles 7, 8 and 11 of the Charter (setting out the rights to privacy, data protection and freedom of expression respectively). It then conducted its assessment in three parts.

First, it examined the relevance of these Charter provisions with regard to the validity of the Data Retention Directive. Although the Court recognised the potential impact of data retention on freedom of expression, it chose not to examine the validity of the Directive in light of Article 11 of the Charter. It noted that the Directive must be examined in light of Article 7 as it ‘directly and specifically affects private life’ and in light of Article 8 as it ‘constitutes the processing of personal data within the meaning of that article and, therefore necessarily has to satisfy the data protection requirements arising from that article’[29].

Second, it considered whether there was an interference with the rights laid down in Articles 7 and 8 of the Charter. It noted that the Data Retention Directive derogates from the system of protection set out in the Data Protection Directive and the E-Privacy Directive [32]. It cited Rundfunk as authority for the proposition that an interference with the right to privacy can be established irrespective of whether the information concerned is sensitive or whether the persons concerned have been inconvenienced in any way [33]. The Court therefore held that the obligations imposed by the Directive to retain data constitutes an interference with the right to privacy [34] as does the access of competent authorities to that data [35]. The Court also held that the Directive interferes with the right to data protection on the mystifyingly simplistic grounds that ‘it provides for processing of personal data’ [36]. It observed that these interferences were both wide-ranging and particularly serious [37].

The Court then, thirdly, assessed whether these interferences with the Charter rights to privacy and data protection were justified. According to Article 52(1) of the Charter, in order to be justified limitations on rights must fulfil three conditions: they must be provided for by law, respect the essence of the rights and, subject to the principle of proportionality, limitations must be genuinely necessary to meet objectives of general interest.
The Court held that the essence of the right to privacy was respected as the Directive does not permit the acquisition of content data [39] and the essence of the right to data protection was respected as the Directive requires Member States to ensure that ‘appropriate technical and organisational measures are adopted against accidental or unlawful destruction, accidental loss or alteration of data’ [40].
With regard to whether the interference satisfies an objective of general interest, the Court distinguished between the Directive’s ‘aim’ and ‘material objective’: it noted that the aim of the Directive is to harmonise Member States’ provisions regarding data retention obligations while the ‘material objective’ of the Directive is to contribute to the fight against serious crime [41].
The Court observed that security is a right protected by the EU Charter and an objective promoted by EU jurisprudence [42]. It therefore held that the Data Retention Directive ‘genuinely satisfies an objective of general interest’ [44] and proceeded to analyse the proportionality of the Directive.

The Court effectively adopted a two-pronged proportionality test, considering whether the measure was appropriate to achieve its objectives and did not go beyond what was necessary to achieve them [46].
Applying the ECtHR’s Marper judgment by analogy, it noted that factors such as the importance of personal data protection for privacy and the extent and seriousness of the interference meant the legislature’s discretion to interfere with fundamental rights was limited [47-48]. It held that the data retained pursuant to the Directive allow national authorities ‘to have additional opportunities to shed light on serious crime’ and are ‘a valuable tool for criminal investigations’ [49]. Therefore, it found that the Directive was suitable to achieve its purpose.

With regard to necessity, it noted that limitations to fundamental rights should only apply in so far as is strictly necessary [52] and that EU law must lay down clear and precise rules governing the scope of limitations and the safeguards for individuals [54]. It held that the Directive did not set out clear and precise rules regarding the extent of the interference [65]. It highlighted several elements of the Directive which fell short in this regard.
By applying to all traffic data of all users of all means of electronic communications the Directive entailed ‘an interference with the fundamental rights of practically the entire European population’ [56] and did not require a relationship between the data retained and serious crime or public security [58-59].
Moreover, no substantive conditions (such as objective criterion by which the number of persons authorised to access data can be limited) or procedural conditions (such as review by an administrative authority or a court prior to access) determined the limits of access and use to the data retained by competent national authorities [60-62]. Nor did the Directive determine the time period for which data are retained on the basis of objective criteria [64-65].

The Court also held that the Directive did not set out clear safeguards for the protection of the retained data. This finding was supported by the Court’s observation that the rules in the Directive were not tailored to the vast quantity of sensitive data retained and to the risk of unlawful access to these data [66]. Rather, the Directive allowed providers to have regard to economic considerations when determining the technical and organisational means to secure these data [67]. Moreover, the Directive did not specify that the data must be retained within the EU and thus within the control of national Data Protection Authorities [68]. For these reasons, the Directive was declared invalid by the Court [69].

The Good, the Bad and the Ugly

The Good The judgment is to be welcomed for its end result – the invalidity of the Directive – as well as for many other reasons. It is a victory for grassroots civil liberties organisations and citizen movements: the preliminary references stemmed from actions taken by Digital Rights Ireland – an NGO – and just under 12,000 Austrian residents. More of these types of initiatives are needed in order to assure effective privacy and data protection. From a more substantive perspective, the judgment also recognises the dangers posed by aggregated meta-data – that it may ‘allow very precise conclusions to be drawn concerning the private lives’ of individuals [27] – and by data retention more generally – that it ‘is likely to generate in minds of the persons concerned the feeling that their private lives are the subject of constant surveillance’[37]. It also acknowledges that such data retention may have a chilling effect on individual freedom of expression [28].

The Bad Nevertheless, some aspects of the judgment are less welcome. Most notably here, the Court glosses over the fact that it assesses the proportionality of the Directive in light of its ‘material objective’ – crime prevention – rather than its stated objective – market harmonisation. This sits uncomfortably with the Court’s finding in Ireland v Council that the Directive was enacted on the correct legal basis as its predominant purpose was to ensure the smooth functioning of the EU internal market. The Court also incorrectly applies Article 8 of the EU Charter. Not only does it consider that there is an interference with this right every time data are processed [36], it also fails to consider how the application of this right can be applied to a piece of legislation which pursues law enforcement objectives. The Data Protection Directive excludes data processing for law enforcement purposes from its scope (Article 3(2)) and the right to Data Protection should, pursuant to Articles 51(2) and 52(2) of the Charter, be interpreted in light of and reflect the scope of the Directive. This conundrum is conveniently overlooked by the Court.

And the Ugly However, the most disappointing element of the judgment, like the Opinion of the Advocate General, is that it does not query the appropriateness of data retention as a tool to fight serious crime [49]. Given the prominence of this issue in both the EU and the US in the post-PRISM period, empirical evidence is needed to justify this claim.

Written by Orla Lynskey Posted in EU constitutional law, Fundamental rights, General, Internal Market, Proportionality and Subsidiarity Tagged with article 7 Charter, article 8 Charter, data retention directive, Directive 2002/58/EC, directive 2006/24/EC, Joined Cases C-293/12 and 594/12 Digital Rights Ireland ltd and Seitlinger and others, personal data, Privacy, proportionality, right to data protection
– See more at: http://europeanlawblog.eu/?p=2289#more-2289

EU gives US six months to come clean on visa policy

Published on EurActiv (http://www.euractiv.com)

Source URL: http://www.euractiv.com/justice/eu-gives-usa-deadline-reciprocat-news-533275

Published: 05 February 2014

EXCLUSIVE / The European Commission has told the United States to lift visa requirements on Poland, Romania, Bulgaria, Cyprus and Croatia, whose citizens still need an entry permit to travel to the country.

Background

Back in 2008, when the nationals of twelve EU countries were subject to the visa requirement to travel to the US, the Commission warned that it may force American diplomats to apply for visas to travel to the European Union.

At that time, nationals of Bulgaria, the Czech Republic, Estonia, Greece, Cyprus, Latvia, Lithuania, Hungary, Malta, Poland, Romania and Slovakia were excluded from the US Visa Waiver Programme, which allows visa-free travel. Washington has been refusing to grant visa-free access to US territory on a bloc-wide basis, saying it had to first ensure that each individual country fulfils its stringent security requirements.

At that time, EU officials have accused the US of attempting to undermine the Union’s common visa policy and force individual countries to agree to additional security measures that are in violation with Union rules on aviation security and data protection. [more]

The citizens of most EU countries travel without visas to a list of foreign countries, listed in annex II of Council Regulation No 539/2001. But the nationals of some new EU member states still need a visa to travel to countries such as the United States, Canada or Australia. A regulation which entered into force on 20 December requires EU countries to “react in common” on visa matters, especially in cases where foreign countries “subjects [EU] citizens to differing treatment”.

If within six months the problem is not solved, the EU could introduce visas for US diplomats, the Commission warned. But diplomats of the countries concerned told EurActiv they would continue to negotiate bilaterally to solve the problem.

New EU regulation on visa matters

According to the new regulation, the Commission can temporarily suspend the EU’s own visa exemptions on foreign countries if they have not lifted their visa requirements within six month. The Commission has warned in the past that such rules may force American diplomats to apply for visas to travel to the European Union, if Washington doesn’t lift the visa requirement for individual EU countries (see background).

The new legislation is an initiative of the European Parliament, which in a 2012 report drew a list of third countries maintaining visa requirements on some EU countries. Canada requires visas for nationals of Bulgaria and Romania, while Australia in theory applies a unified system of treatment of visa requests to all EU countries, but its visa grant to nationals of Bulgaria and Romania is by far the lowest. According to MEPs, the Lisbon Treaty gives new powers to the Union to request that its member countries are treated as a whole and that the USA reciprocates on visa policy.

US pressure on data exchange

The four EU countries were reportedly asked by Washington to sign certain bilateral agreements as a precondition for benefitting from the US Visa Waiver Program. One of them is a 2003 provision for the exchange of terrorism screening information (HSPD-6), which called for the establishment of a single consolidated watchlist to improve the identification, screening, and tracking of known or suspected terrorists and their supporters [more].

Another is the agreement on Preventing and Combating Serious Crime (PSCS), requiring signatory countries to share biometric and other data of individuals, for the purpose of preventing, detecting and investigating serious criminal activity and terrorism, on a query basis. The US has signed such agreements with a number of EU countries already.

But the European Commission is reportedly not happy that individual countries sign data exchange agreements with the USA in the absence of a so-called EU-US Umbrella Agreement on data protection, which ensures EU citizens keep their rights when their data is processed in the US.

Diplomats from the countries lacking reciprocity in their visa affairs told EurActiv that their capitals would notify the Commission of their situation with third countries before the deadline of 9 February. According to the new regulation, if the US still applies visas for those countries 90 days following notification, the Commission may decide to suspend EU visa exemption for “certain categories of US nationals”, a jargon term referring to holders of diplomatic passports.

However, diplomats said they would pursue bilateral negotiations as well, suggesting they did not put too much hope in the EU common effort. Indeed, when the new regulation was adopted in December, it was accompanied by a statement by several member states who said that while raising the issue, the EU countries would also “take into account potential adverse political consequences that might arise from such proposals or decisions for the external relations, both of the Union and its Member States”. “This applies in particular to external relations with strategic partners,” says the statement, signed by Belgium, Germany, Estonia, Greece, Spain, France, Italy, Cyprus, Latvia, Lithuania, Luxembourg, Hungary, Malta, the Netherlands, Austria, Portugal, Slovenia, Slovakia, Finland, Sweden, but also Poland, a country under US visa requirement.

Next Steps

9 Feb.: Deadline for the EU countries who are still under visa requirement to notify the Commission on their situation;
March: EU countries can ask the Commission that the EU suspends the visa exemption for certain categories of US nationals;
June: At the latest six months after publication of the regulation, the Commission may decide that the suspension of the visa obligation should take effect.

Data protection: the European Parliament still fighting on two fronts

by Luca Boniolo

Data protection remains a hot issue in parliamentary works…

On November 11^th the European Parliament Civil Liberties, Justice and Home Affairs Committee (LIBE) held its 9th hearing on Electronic Mass Surveillance of EU Citizens in the framework of its enquiry on the so-called “PRISM” case.[1] In a rather exceptional move even a Member of the US Congress was among the speakers; Microsoft, Google and Facebook representatives were also heard by the Brussels lawmakers during the same hearing.

Exceptional presence: US Congressman Rep. Jim Sensenbrenner

Representative Jim Sensenbrenner, Chair of the US Congress Subcommittee on Crime, Terrorism, Homeland Security, and Investigations, member of the Republican Party and co-author of the Patriot Act, stated: “I hope that we have learned our lesson and that oversight will be a lot more vigorous”, adding that abuses by the NSA could had been carried out outside congressional authority.

In a previous statement Rep. Jim Sensenbrenner said that the intelligence community could had also misused its powers by collecting telephone records also on Americans citizens, and claimed the time has come “to put their metadata program out of business” (section 215 of the Patriot Act). Consistently with this position he worked on a bipartisan bill, the “Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-Collection and Online Monitoring Act” (named for its acronym: the “USA Freedom Act”), which should constrain NSA abuses. However this bipartisan initiative is still far from making unanimity; the democratic Senator Dianne Feinstein, Chair of Selected Committee on Intelligence in the US Senate, for instance, tabled a bill, the “FISA Improvements Act of 2013”, which is attracting plenty of critics because it is considered as a way to enshrine the current NSA data collection activities into law by granting formal Congressional approval to these widespread surveillance programs. “The Feinstein bill puts what the NSA has been doing into law and says it’s Ok… To me, that’s scary”, stated Sensenbrenner and added: “They’ve [senators] become cheerleaders for whatever the intelligence agencies want”.

Facebook, Google and Microsoft declared their innocence

Then executives from three of the world’s biggest IT firms – Facebook, Google and Microsoft – took centre stage at the hearing. The three companies, as well as Apple, AOL, PalTalk and Yahoo, have been accused by the press, on the basis of files leaked by whistleblower Edward Snowden,[2] to give direct access to personal data and/or to routinely hand over these data to the US’ National Security Agency (NSA). Even if this happens in compliance with US subpoenas ordered by the so-called Fisa (Foreign Intelligence Surveillance Act) Court, it has to be noted that the works and jurisprudence of this Court are not public and doubts can be raised on the efficiency of its oversight if, according to official figures, FISA Court approved 99.95% of warrants filed by security services between 2001 and 2012. Moreover, from other Snowden’s files it appears that NSA and GCHQ,[3] might have hacked Google servers and tapped undersea cables, (which carry 90% of internet and phone data between America and Europe).

Facebook Director Richard Allan and Microsoft VicePresident Ms Dorothee Belz, both in charge of of Europe, Middle East and Africa (EMEA) and Google Director Nicklas Lundblad, in charge of Public Policy and Government Relations, all denied in strong terms giving US intelligence services “unfettered” access to people’s private data. According to them only specific information on individual suspects have been subpoenaed by US intelligence and police services. Mr Allan noted that in the six months ending 31 December 2012, US agencies made between 11,000 and 12,000 queries, while EU countries made another 10.000, but they affected only “a tiny fraction of 1% of all Facebook accounts”. The three representatives also denied having any knowledge of the PRISM programme: “We do not know PRISM, we do not take part in it, and we do not give the government access to our data”, reiterated Ms Belz. Nevertheless all the three declared that they would reveal more on the content and scope of US intelligence requests, but the FISA Court banned them from diffusing this kind of information. The speakers also appeared worried about the new European draft Regulation on Data Protection (Rapporteur Mr Jan ALBRECHT, DE, Greens) notably on the limits surrounding international transfers of personal data, which could lead to real conflict of law and to legal insecurity that “we will not be able to resolve”.

The EP is pushing for the suspension of the transatlantic “SWIFT” agreement…

The LIBE Committee Inquiry has in the meantime on Electronic Mass Surveillance is a response to the US National Security Agency’s alleged tapping of EU citizens’ bank data as shared in the framework of the EU-USA transatlantic agreement on the Terrorist Finance Tracking Program (TFTP).[4] On the basis of the elements already emerged during the Committee inquiry, the European Parliament plenary has already voted on October 23^rd a request of suspension of that agreement.[5]

To grant the protection of EU citizens’ privacy, MEPs believe that it has to be clarified whether NSA has had direct access to financial messaging data managed by Swift beyond the allowed cases, in other words if there has been a violation of the agreement. The non-binding resolution, tabled by the S&D, ALDE and Greens/EFA groups, was approved by 280 votes to 254, with 30 abstentions, only a slightly majority. These groups believe that is impossible to maintain the agreement as it stands, while EPP group proposed a resolution demanding clarifications too, but without mentioning the suspension of the agreement.

The European Parliament does not legally have the power to suspend an international agreement such as SWIFT and this action remains simple symbolic, committing the Council and Commission to nothing. However paragraph 11 of the Resolution states: «Considers that, although Parliament has no formal powers under Article 218 TFEU to initiate the suspension or termination of an international agreement, the Commission will have to act if Parliament withdraws its support for a particular agreement; points out that, when considering whether or not to give its consent to future international agreements [such as the much bigger EU-US free trade agreement currently under negotiations], Parliament will take account of the responses of the Commission and the Council in relation to this Agreement», followed by article 12: «Asks the Commission, in the light of the above, to suspend the Agreement». Moreover EU Parliament asks the Council and the Member States to authorise an investigation by the Europol Cybercrime Centre into the allegations of unauthorised access to financial payment data governed by the Agreement.

…however the Commission is reluctant…

European Commissioner for Home Affairs Cecilia Malström stated already during a plenary in Strasbourg at the beginning of October, that in the framework of previous consultations the US side has provided detailed explanations and assurances: the agreement had not been violated. On Thursday 23 October the answer of the Commission was the same, i.e. negative; in a press release Commissioner Malström stated: “We will follow up our request for written assurance with the US without delay and keep the European Parliament fully informed. In the meantime, the provisions of the TFTP Agreement that clearly regulate the transfer of personal data, and that provide effective safeguards to protect the fundamental rights of Europeans, will remain in place”. The Commission appeared to be satisfied with the US assurances, deciding, for the time being, not to take in account the EP request. Considering that EP’s approval was necessary for the entry into force of the TFTP agreement, and that the Agreement do not require even a specific wrongdoing justifyng the suspension, this position of the Brussels executive looks quite inappropriate.

In the meantime the EU Data Protection general reform.. Continue reading “Data protection: the European Parliament still fighting on two fronts”

After “Prism” (and US Patriot Act section 215): EDRI and FREE submission to US and EU Institutions.

Submission

the European Digital Rights Initiative (EDRi) &

Fundamental Rights European Experts Group

(FREE Group)

the United States Congress,

the European Parliament and Commission

& the Council of the European Union,

& the Secretary-General & the Parliamentary Assembly

of the Council of Europe

the surveillance activities of the United States and certain European States’ national security and “intelligence” agencies

August 2013

Note on the choice of addressees:

EDRi and FREE are submitting this appeal to the addressees mentioned on the cover page for the following reasons:

– The US Congress is ultimately responsible for providing democratic oversight over the activities of the US Executive. It has established a Privacy and Civil Liberties Oversight Board (PCLOB) consultation on FISA and the PATRIOT Act. However, while we are sending a copy of this submission to that consultation, this document is addressed to the Speaker of the House of Representatives and the President pro tempore of the Senate because we argue that the issues raised can only be addressed properly by the establishment of a special investigation committee of Congress, with appropriate support and powers. We also wish to stress that, whatever the defects in the scope of protection afforded to non-US citizens under the US Constitution, the USA, as parties to the UN International Covenant on Civil and Political Rights and the Council of Europe Cybercrime Convention, are bound under international law to extend privacy protection to non-US citizens and to observe the principles of legality, necessity and proportionality also in their surveillance activities.

– The European Parliament is responsible for providing democratic oversight over the activities of the European Union, and has taken a keen interest in the issues raised, as has the European Commission, which forms the executive branch of the EU. However, the European Council (representing the governments of the EU Member States) has been less demanding. We are calling for all of them to seek to establish the full truth about the relevant laws and practices, in both Europe and the USA. We are aware of the “national security” exemptions in the main EU treaties, but these are not and should not be absolute, or seen as granting Member States total exemption from scrutiny in this regard. The EU Charter on Fundamental Rights, which has fundamental status in the EU (even in relation to UN Security Council decisions) and explicitly demands full protection of personal data, cannot be simply ignored in this context. Ultimately, it is for the European Court of Justice to determine the scope of the exemption, but we already note that the US’ NSA’s activities are manifestly not limited to national security as defined in international law. We are therefore urging the EU bodies to address the issues to the fullest extent possible within their legal competences.

– The Council of Europe (CoE), as the oldest, broadest European institution, has the main responsibility for upholding human rights and the rule of law throughout the territory of its 47 Member States. Its mandate, in particular in relation to human rights and the upholding of the European Convention on Human Rights, does not exclude matters relating to national security. On the contrary, the standards that we cite in our submission have been mainly developed by the European Court of Human Rights in its case-law under the Convention. All European States are legally obliged to “secure” full protection of these rights and freedoms. Within the Council of Europe, responsibility for the upholding of these standards is shared between the Secretary-General and the Committee of Ministers (representing the CoE Member States), the Parliamentary Assembly of the Council of Europe (PACE), and the Court.

Effective action on the issues addressed in this submission will require the involvement of all of the above. For that reason, we address this submission to all of them.

I. General:

1. The activities of national security agencies in Europe and the USA, and the arrangements under which they cooperate, have been outside the scope of effective democratic oversight and outside clear legal frameworks for too long; they must be brought under the Rule of Law.

2. For Europe, that means those activities must be made to comply, in law and in practice, with the relevant minimum European human rights standards developed by the European Court of Human Rights under the European Convention on Human Rights (ECHR) summarised below, at II, and in Attachment 1. At present, it appears that several European States are not complying with these standards.

3. These European constitutional standards are in line with the global (UN) standards enunciated by the Human Rights Committee acting under the UN International Covenant on Civil and Political Rights (ICCPR) and others, briefly noted in Attachment 2. All European States and the USA are parties to the ICCPR in particular.

4. For the USA, this means that it, too, should bring its activities in line with these standards. As a first step, US surveillance law and practice (in relation to surveillance of both US citizens and non-US/European citizens) must be made totally clear, and any divergence from those standards must be made public. Only that will allow for sensible discussions on how to bring those activities into line with international standards. Current US law as far as currently known is summarised below, at IV, and in Attachment 3.

II. European requirements:

(For more detail, see Attachment 1)

5. If an agency of any European State is given powers under the laws of that State to gather information on (the communications- or other data of) anyone, be that within Europe or not, then that activity must be regarded as being done “within the jurisdiction” of the State concerned.^{^[1]} This means that, in relation to any surveillance activity by any European State, on anyone, wherever they are, the State in question must comply with the minimum European standards, set out in Attachment 1, which are directly derived from the ECHR case-law.

6. Moreover, from a European perspective, any spying on Europeans and non-Europeans living in Europe, by any non-European State, anywhere in the world, should meet the same minimum European-constitutional and the similar UN standards, set out in Attachment 2.

7. Non-European national security agencies should not seek or gain direct access to any personal data held in Europe (e.g., by asking US companies to “pull” data from their Europe-based servers, or to allow US agencies to query the data in Europe, and hand over the results): that infringes the sovereignty of the relevant European States (PCIJ, Lotus judgment, pp. 18-19).[2] Instead, they should seek such access through bi- or multilateral assistance treaties, under arrangements similar to Mutual Legal Assistance Treaties (MLATs) for law enforcement agencies; and those treaties should in substance and process conform to the minimum European-constitutional and international standards.

8. Failure of a European State to prevent improper spying by non-European countries constitutes a breach of that country’s “positive obligations” under the ECHR. Active support for, complicity in, or even passive condoning of such spying would breach the State’s primary obligations under the ECHR.

9. In addition, European States and the European Union should ensure that personal data on Europeans and non-Europeans living in Europe, if held on US-based “cloud” servers, will be accessible to the US national security agencies only on the basis of clear and published provisions of treaty arrangements that also meet those European-constitutional and international standards.

III. USA requirements:

(For more detail, see Attachment 3)

10. The First and Fourth Amendments to the US Constitution in principle guarantee the right to free speech and freedom from unreasonable searches to US citizens. However, even domestically, this protection is weakened by the “third party” doctrine on personal data and the relaxed “pen/trap” rules on searches. Secret rulings of the FISA Court reportedly further erode these rights, arguably in unconstitutional ways. Those rulings are being challenged in the US courts. Here, we may note that current US law and practice, even with regard to spying on US citizens, falls short of European and international standards.

11. Moreover, it has become clear that non-US citizens outside the USA do not enjoy even the limited protections of the First and Fourth Amendments: they can be spied upon arbitrarily by US agencies, without any meaningful substantive or procedural limitations, in clear breach of international standards on privacy generally, and on privacy and freedom of expression on the Internet in particular. Under international human rights law, those guarantees should be afforded to “everyone” affected by the measures.

IV. How to address the issues: our demands

12. The ultimate aim should be for both the US and the European legal systems to offer high-level privacy/data protection to “everyone”, in line with the established European minimum standards (set out in Attachment 1), that are also in line with UN standards (set out in Attachment 2); and for those standards to be adhered to in practice by the USA, all European States, and the EU, whether acting independently or jointly.

To this end, we demand urgent action from both the US and the European institutions.

Demands for review and redress from the USA:

i. Clarity about the law, and honesty about practice:

13. We demand complete transparency in relation to the scope and detail of US spying activities, and of the bi- and multilateral arrangements between the USA and other States and international organisations, in particular “5EYES”[3], Atlantic and/or European ones, relating to this activity, under which data on the communications and Internet activities of European citizens are intercepted, held, recorded and/or monitored and analysed.

14. We demand complete clarity about the limitations of the US legal system, and in particular as concerns the apparent fact that it provides insufficient protection to US citizens, and effectively none to non-US citizens. Following such a full clarification, urgent measures should be taken to bring the US surveillance system fully into line with international human rights- and privacy/data protection standards.

ii. The way to achieve this:

15. While we appreciate the establishment of the PCLOB consultation, we do not believe that this is the appropriate forum or process to achieve the required full transparency, or that it will lead to US law and practice being brought fully into line with the requirements of international law.

16. To be more specific: we are joining US civil liberty organisations in calling on the US Congress to establish a properly staffed special investigatory committee, on the lines of the 1970s CHURCH Commission, with the power to subpoena witnesses and documents; and to make arrangements to ensure that European institutions, States and NGOs can fully participate in the investigation carried out by this special committee, and indeed in the drawing up of the mandate for this committee.

iii. The changes to be made

17. Senior European politicians have called for the extension of US legal protections afforded under US constitutional and federal law to (communications) data on US citizens, to (communications) data on European citizens held in the USA or accessed from the USA by US agencies, just as data on US citizens, held in Europe, is already protected under European human rights- and data protection law.

18. Reciprocity is indeed an important element in international relations. However, in the present context, this fails to recognise that while, in respect of their data, Europeans currently enjoy hardly any protection under US laws, the protection accorded to US citizens under those laws is also deficient, and falls below European and wider international minimum requirements. Raising the level of US legal protection for data on Europeans to the level of protection of data on US citizens therefore still leaves European citizens and US citizens subject to a regime that falls short of international standards. That is not enough.

19. We are joining civil liberty organisations in the USA in calling for fundamental changes in US law, to ensure proper protection under the law against non-transparent and undemocratic surveillance. New laws must be introduced at federal level to provide much stricter rules, open judicial warrants and rulings, and full democratic control, in accordance with international human rights and privacy/data protection standards. Specifically, we demand that when such laws are in place, they should afford equal protection to US and non-US citizens.

20. Until this is achieved, the USA cannot be said to offer “adequate” protection to data, in relation to any of the areas for which the European Commission has (wrongly) held it to offer such protection: the “Safe Harbor”, the disclosure of PNR data, and the making available of SWIFT data (see below, para. 29).

Demands for review and redress from Europe:

i. Clarity about the law, and honesty about practice:

21. European States are not blameless when it comes to surveillance: in spite of a much stronger legal regime on paper (under the ECHR), it appears that practice in some (perhaps many) European States also fall seriously short of the European-legal (ECHR) requirements. Several States, in particular the UK, also seem to have worked closely with the USA (in particular, in ECHELON) in establishing a global surveillance network that appears to blatantly violate European and international law. We need complete clarity about the laws in the EU- and Council of Europe Member States, and complete clarity about the treaties entered into by European States, and full, honest disclosure about the practices of the national security agencies and –bodies of the EU- and Council of Europe Member States too.

ii.

The way to obtain this: EU:

22. The European Parliament has a crucial role to play. We welcome the European Parliament’s decision to establish a committee of enquiry within the Civil Liberties Committee, and urge it to be broad, to encompass all the threats posed to the rights of European citizens by foreign and EU Member States’ surveillance activities.

23. We also – but very cautiously and with serious reservations – note the establishment of an EU-US “expert group” to look at these matters. However, we oppose the excessively limited mandate of this group, and demand full transparency about its composition and activities. We demand civil society involvement and complete openness for the work of this group. Without that, its findings and the arrangements it might propose are likely to be incomplete, will lack credibility and, consequently, will be unacceptable.

24.

Although this should be obvious, for the avoidance of any doubt, the EU should make clear, as a matter of urgency, that any disclosure of data on European citizens that is subject to European data protection law (such as financial or airline data, or Europol/Eurojust/etc. data) to, or any access to such data by, national Member States’ national security agencies (NSAs), and a fortiori by third country agencies, is subject to the European data protection rules governing the processing of such data.

Council of Europe

25. We note the fact that the Council of Europe, which Europe’s main human rights guarantor, is not excluded from addressing matters relating to national security that may affect the human rights of European citizens and indeed of “everyone” affected by measures of CoE Member States. On the contrary, the European standards set out in Attachment 1 have been developed by the European Court of Human Rights in what is now established case-law, applicable to all Council of Europe Member States (which includes all EU Member States), and indeed to the EU itself (albeit, for now, still indirectly, through “general principles of Union law” and the EU Charter).

26. Specifically, we call on the Secretary-General of the Council of Europe to exercise his power under Article 52 ECHR to demand of all CoE Member States full disclosure of “the manner in which [their] internal law[s] ensure[s] the effective implementation of” Article 8 of the ECHR in relation to surveillance of electronic communications- and Internet data by their national security agencies; and on the CoE Commissioner of Human Rights, PACE, and NGOs to be fully involved in this enquiry.

iii. The changes to be made

27. Until the full truth has been established, and full, appropriate remedial action has been taken to bring the activities of all relevant US agencies in line with international standards, there can be no close cooperation between US and European agencies, or between US and European State’s agencies on the previous, essentially unregulated basis.

28. Immediate changes: Given that, as noted above, in para. 20, in the light of the recent revelations, the USA cannot be said to offer “adequate” protection to data in relation to the “Safe Harbor”, the disclosure of PNR data, and the passing on of SWIFT data, the current arrangements are in clear and blatant breach of the primary law of the European Union and, consequently, the EU is legally obliged to immediately suspend all US-related European data protection “adequacy” decisions.

29. Changes to the General Data Protection Regulation: Pending adoption of adequate legislation in the USA, European data protection law should ensure that European citizens are clearly warned that, if they provide data to US companies, or to global Internet companies that have links to the USA, use servers in the USA, or are otherwise subject to US FISA and other surveillance orders, their data will not be safe from arbitrary, intrusive surveillance by US agencies. This is already proposed by senior EU officials and legislators in relation to the General Data Protection Regulation currently in the process of being adopted. We endorse that proposal.

30. New treaty arrangements on cooperation between national security agencies: The post-WWII treaties and arrangements on “national security” and “intelligence” cooperation (including the definitions of these matters) are totally outdated. We need a complete overhaul of the national and inter-State arrangements on “national security” and “intelligence” cooperation. The old treaties – UKUSA, 5EYES, NATO and others – should be openly discussed and reviewed, and fundamentally changed to bring them into line with the international standards we have adduced. Without that, we do not live in the free and democratic societies we are made to believe we live in.

– o – O – o –

EDRi and FREE are grateful to Professor Douwe Korff of London Metropolitan University for drafting this paper.

Rue Belliard 20, B-1040 Brussels,

Tel:+32 2 274 25 70

E-Mail: brussels@edri.org, http://www.edri.org

European Digital Rights (EDRi)

European Digital Rights is an association of 35 digital civil rights organisations from 21 European countries. We work together to defend civil rights in the information society.

11 Rue Darwin
1190 Bruxelles

E-Mail: edecapitani@gmail.com
http://www.eafsj.org

The Fundamental Rights European Experts Group (FREE Group)

The Fundamental Rights European Expert Group is an NGO whose focus is on monitoring, teaching and advocating in the European Union freedom security and justice related policies.

Attachment 1:

SUMMARY OF EUROPEAN HUMAN RIGHTS STANDARDS ON NATIONAL SECURITY SURVEILLANCE:

The case-law of the European Court of Human Rights under the European Convention on Human Rights (ECHR) shows the following considerations and requirements of European human rights law relating to surveillance:[4]

– A system of secret surveillance for the protection of national security may undermine or even destroy democracy under the cloak of defending it.

– The mere existence of legislation which allows a system for the secret monitoring of communications entails a threat of surveillance for all those to whom the legislation may be applied.

– In view of these risks, there must be adequate and effective guarantees against abuse.

– The first of these guarantees is that such systems must be set out in statute law, rather than in subsidiary rules, orders or manuals. The rules must moreover be in a form which is open to public scrutiny and knowledge. Secret, unpublished rules in this context are fundamentally contrary to the Rule of Law; surveillance on such a basis would ipso facto violate the Convention.

The following are the “minimum safeguards” that should be enshrined in such (published) statute law, and adhered to in practice:

· the offences and activities in relation to which surveillance may be ordered should be spelled out in a clear and precise manner;

· the law should clearly indicate which categories of people may be subjected to surveillance;

· there must be strict limits on the duration of any ordered surveillance;

· there must be strict procedures to be followed for ordering the examination, use and storage of the data obtained through surveillance;

· there must be strong safeguards against abuse of surveillance powers, including strict purpose/use-limitations (e.g., preventing the too-easy disclosure of intelligence data for criminal law purposes) and strict limitations and rules on when data can be disclosed by NSAs to LEAs, etc.;

· there must be strict rules on the destruction/erasure of surveillance data to prevent surveillance from remaining hidden after the fact;

· persons who have been subjected to surveillance should be informed of this as soon as this is possible without endangering national security or criminal investigations, so that they can exercise their right to an effective remedy at least ex post facto; and

· the bodies charged with supervising the use of surveillance powers should be independent and responsible to, and be appointed by, Parliament rather than the Executive.

Under the ECHR, these principles must be applied to anyone who is affected by surveillance measures taken by any Council of Europe Member State under domestic law.

In addition, European States have a “positive obligation” to protect their citizens from surveillance contrary to the above, perpetrated by any other State. A fortiori, they are under a legal obligation not to actively support, participate or collude in such surveillance by a non-European State.

– o – O – o –

Attachment 2:

BRIEF NOTE ON WIDER UNITED NATIONS/INTERNATIONAL STANDARDS ON NATIONAL SECURITY SURVEILLANCE:

Attachment 1 above summarises the European Court of Human Rights’ standards set for “national security” surveillance. Here, we briefly note that the same standards are also reflected in law and guidance issued at the global level by the United Nations, and by other international organisations, albeit not always in the same detail.

The primary instrument in this respect is the UN International Covenant on Civil and Political Rights (ICCPR or “the Covenant”), the most important binding global human rights treaty, to which all European States and the USA (indeed, almost all UN Member States) are parties. It is applied and interpreted by the Human Rights Committee, which has issued important relevant guidance.

Further important guidance has been provided in the 1996 Johannesburg Principles on National Security, Freedom of Expression and Access to Information (drafted by Article 19 and other NGOs but endorsed by the UN Special Rapporteur on Freedom of Opinion and Expression) and more recently in statements and reports by that Special Rapporteur and special rapporteurs from other international organisations. Also relevant is the guidance issued by the Organisation for Security and Co-operation in Europe (the OSCE), to which again all European countries and the USA (and Canada) are parties.

Here, it may suffice to note that all of these stress the same core principles as are stressed by the European Court of Human Rights:

– – “national security” must be defined narrowly (see the “Tenth Anniversary Joint Declaration” by the UN Special Rapporteur on Freedom of Opinion and Expression, together with the OSCE Representative on Freedom of the Media, the Organization of American States (OAS) Special Rapporteur on Freedom of Expression and the African Commission on Human and Peoples’ Rights (ACHPR) Special Rapporteur on Freedom of Expression and Access to Information; also the Johannesburg Principles, Principle 2(a) as well as Principle 1.2);

– – any interference with the freedom to seek, receive and impart information by any medium (including the Internet), including e-communications- and Internet surveillance, must be based on “law”, i.e., on clear and specific, published legal rules (and published legal interpretations of the rules): an interference with privacy and communications can be “arbitrary” – and thus in breach of international human rights law, including the ICCPR – even if it is in accordance with domestic law;

– – the law must limit any such the interference to what is “necessary” and “reasonable” or “proportionate”; and

– – the law must provide for an “accessible and effective remedy” against the interference.

On all of the above, see General Comment 16 on Article 17 ICCPR, paras. 3 and 4; General Comment 31 on General Legal Obligations Imposed on States Parties to the Covenant, para. 15ff.; and the reports by the Special Rapporteur passim).

– – the requirements of “law”, “necessity” and “proportionality” also apply in relation to measures taken to protect national security (Johannesburg Principles, Principles 1.1.(a) & (b), 2(a) & (b)).

Moreover, in assessing the questions of “necessity” and “proportionality” in particular, the Human Rights Committee and the UN Special Rapporteurs will take into account exactly the same kinds of factors as are listed in the case-law of the European Court of Human Rights.

Two related matters deserve special mention in the present context: the application of international human rights law to the extraterritorial accessing (or “pulling”) of data from servers in another country; and the duty to extend the rights enshrined in the ICCPR to all individuals without distinction as to nationality or other status. Specifically:

– Article 2(1) of the ICCPR requires all States Parties “to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the present Covenant, without distinction of any kind, such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status.”

– In the view of the Human Rights Committee:

This means that a State party must respect and ensure the rights laid down in the Covenant to anyone within the power or effective control of that State Party, even if not situated within the territory of the State Party. … [T]he enjoyment of Covenant rights is not limited to citizens of States Parties but must also be available to all individuals, regardless of nationality or statelessness, such as asylum seekers, refugees, migrant workers and other persons, who may find themselves in the territory or subject to the jurisdiction of the State Party. (General Comment 31, emphasis added)

– Although the Committee has not yet issued any further views or general comments on the matter, it must be assumed that if a State gives itself legal powers to access (or “pull”) data on individuals, when those data are situated outside its physical territory, that State is “exercising jurisdiction” (to be specific: “enforcement jurisdiction”) extra-territorially, in the State where those data are located. As noted in the body of this paper with reference to the Lotus case, if this happens without the consent of the other State, it violates the sovereignty of that other State. Here, it should be noticed that that aside, such extra-territorial action by the first State would also mean that that State is asserting “jurisdiction” over those data. In respect of their data, the individuals concerned are made to be “subject to [the State’s] jurisdiction”.

– In any such extra-territorial cross-border accessing (or “pulling”) of data, the State in question must therefore comply with all the general requirements of the Covenant (clear, foreseeable “law”; “legitimate aim”, “necessity” and “proportionality”), and with the requirement of Article 2(1), that it affords the protection of Article 17 to the persons affected irrespective of their nationality or other status.

In sum: The UN standards are fully concordant with the European ones set out in Attachment 1.

– o – O – o –

Attachment 3:

SUMMARY OF UNITED STATES STANDARDS ON NATIONAL SECURITY SURVEILLANCE:

In the USA, communications data and personal information on US citizens (and on some minor categories of non-US citizens living in the USA) are in principle granted protection under the First and Fourth Amendments to the US Constitution, providing protection of free speech and freedom from unreasonable searches.

However:

1. There is no general, cohesive, broadly-applicable federal privacy law. Rather, there is only a largely incoherent and sectorally-based patchwork for federal and state laws, which provide serious privacy protection only in certain areas and respects. See: Chris Hoofnagle, Country Study on the USA, prepared for a wider EU study on New Challenges to Data Protection, at:

http://ec.europa.eu/justice/policies/privacy/docs/studies/new_privacy_challenges/final_report_country_report_B1_usa.pdf

2. The Electronic Communications Privacy Act (ECPA) allows for the monitoring of communications “meta” data (data on the devices involved in the communications, time, duration, location, etc., but not the contents of communications) on the basis of a “pen register or trap and trace device” warrant, that will be issued on the basis of simple certification by a government attorney that such information is “relevant” to an “ongoing criminal investigation”; there is no need to show “probable cause”, and there is no meaningful judicial oversight. This is because in Smith v. Maryland, the Supreme Court ruled that use of a pen register does not constitute a search, and is thus not protected under the Fourth Amendment. The surveillance carried out under ECPA, even on US citizens, is extensive and includes massive amounts of e-communications data. For further details, see: Douwe Korff, Presentation on behalf of EDRi at the EU – USA Privacy Conference, Washington DC, 19 March 2012, available at:

http://edri.org/files/korff120319.pdf

3. The PATRIOT Act and FISA Acts allow even more extensive surveillance over US citizens. Even on their face, the rules in these Acts fall far short of international-legal requirements. However, the rules have been even further weakened, to the extent that they now reportedly provide hardly any constraint at all, even in respect of US citizens, in relation to national security and “foreign intelligence” matters, by means of secret rulings by the secretive FISA Court. See: New York Times, 6 July 2013, In secret, court vastly broadens powers of NSA, at:

http://www.nytimes.com/2013/07/07/us/in-secret-court-vastly-broadens-powers-of-nsa.html?nl=todaysheadlines&emc=edit_th_20130707&_r=1&

4. The constitutionality of these secret FISA Court rulings is doubtful, and they are being challenged in the US courts. See: http://www.aclu.org/national-security/fix-fisa-end-warrantless-wiretapping and http://epic.org/privacy/terrorism/fisa. 5.

In any case, and most worrying to Europeans, the First Amendment does not protect the relevant rights of non-US citizens not in the USA (so-called “excludable aliens”): “[T]he interests in free speech and freedom of association of foreign nationals acting outside the borders, jurisdiction, and control of the United States do not fall within the interests protected by the First Amendment.”

(DKT Memorial Fund Ltd. v. Agency for Int’l Dev., 1989, quoted in Chevron Corporation v. Steven Donziger et al., U.S. District Judge Kaplan order of June 25, 2013).

6. Non-US citizens not resident in the USA similarly do not benefit from the protection of the Fourth Amendment, which does no apply if the person affected by a “search” does not have a “significant voluntary connection with the United States (US v. Verdugo-Urquidez, 1979). Like the First Amendment, the Fourth Amendment only protect “the people”, i.e., US citizens and some eligible (US-resident) aliens.

7. Finally, the FISAA §1881a allows US agencies, including in particular the NSA, to capture and trawl through any data, including e-communications and Internet data, of or on any non-US citizen with essentially no constraints. All that is required is that the capturing and trawling does not inadvertently relate for more than 50% to US citizens, and that the data that are being looked for are “of interest” to “foreign affairs matters” of the USA: the exercise of these essentially arbitrary powers is not limited to serious offences or terrorism, or to threats to US (or US allies’) national security. See the report by Caspar Bowden et al. to the European Parliament, Fighting Cybercrime and Protection Privacy in the Cloud, 2012, and the subsequent article by him and Judith Rauhofer, Protecting their own: Fundamental rights implications for EU data sovereignty in the cloud, 2013, available at, respectively:

http://www.europarl.europa.eu/committees/en/studiesdownload.html?languageDocument=EN&file=79050

http://ssrn.com/abstract=2283175

In sum: The US Constitutional Amendments’ protections (as applied) and US Federal and State laws fall short of international standards. Under ECPA and the PATRIOT and FISA Acts, as further weakened by the secret rulings of the FISA Court, even US citizens enjoy little protection against widespread and intrusive surveillance by US national security agencies in relation to over-broadly-defined “intelligence” matters, in particular in relation to “meta” communications data and Internet data. In relation to US citizens, this may be unconstitutional. But non-US citizens outside the USA enjoy not even the (already too low) protection accorded to US citizens: they can effectively be spied upon arbitrarily, without any meaningful substantive or procedural limitations. Moreover, the US surveillance activities under FISAA in particular do not appear to be limited to matters of “national security”, properly (restrictively) defined, for neither US citizens or non-US citizens.

– o – O – o –

[1] Note that this is the case, even if the exercise of that jurisdiction would violate the sovereignty of another State, e.g., because it concerned data in another country (cf. the Lotus case, referred to in para. 7): the fact that the act was contrary to international law of course does not mean that the State perpetrating the act is not bound by its human rights obligations; that would be perverse. The point we make here is that in the circumstances described, the State is bound to comply with the European Convention on Human Rights, because the acts concerned are “within its jurisdiction”. While generally territorial in nature, this concept also covers acts carried out by State bodies within their home country (or territories of the State overseas) under domestic legislation that affects individuals in other countries.

[2] This is also the view of the vice-president of the European Commission, Viviane Reding, who issued a statement on 25 July 2013, saying: “The [EU’s new General Data Protection Regulation] will also provide legal clarity on data transfers outside the EU: when third country authorities want to access the data of EU citizens outside their territory, they have to use a legal framework that involves judicial control. Asking the companies directly is illegal. This is public international law.” See: http://techcrunch.com/2013/07/25/ireland-prism/ (emphasis added)

[3] The alliance of intelligence operations between the USA, UK, Australia, Canada and New Zealand.

[4] See the cases of Klass v. Germany (Judgment of 6 September 1978), Weber and Saravia v. Germany (Admissibility Decision of 29 June 2006), Liberty and Others v. the UK (Judgment of 1 July 2008), and Kennedy v. the UK (Judgment of 18 May 2010). See in particular the summaries in Weber and Saravia, paras. 93 – 95, and in Kennedy, paras. 151 – 154 (which quote Weber and Saravia, paras 93 – 95, thus reemphasising that the approach there summarised is now regarded as settled case-law).