The ECJ has issued a preliminary opinion that would limit the ability of national security agences to force internet providers and telecoms firms to retain the personal data of citizens and consumers. This is another landmark case in the battle over privacy vs national security
1/ It might also have implications for how the EU and UK work out a data protection "adequacy" deal by the end of this year...
2/ The advocate general has issued an opinion that the ability for security agencies to oblige companies to retain personal data must be limited, and that since such companies operate in the single mkt then EU data protection rules must still apply
3/ This is a long running dispute over data privacy and national security. Member states have long argued national security and combatting terrorism should be exempt from EU data privacy law
4/ The issue has seen a raft of court cases, including @maxschrems' seven year legal battle against Facebook over the transfer of EU data to the US
5/ AG Campos Sánchez-Bordona said that a national court could permit its security agencies to force telecoms to retain personal data only “on an exceptional and temporary basis”...
6/ ...and only if it was justified by “overriding considerations relating to threats to public security or national security.”
7/ The ECJ has in several recent cases curtailed the right of national security agencies in Europe to oblige companies to engage in the “indiscriminate” retention of personal data.
8/ Today’s ECJ opinion states that EU data protection rules already exclude certain activities relating to national security. Such activities are carried out by public authorities and do not oblige telecoms companies and internet providers to hold on to citizens’ data.
9/ The opinion holds that when such companies are under an obligation from law enforcement agencies, the activities in question are “brought…into an area governed by EU law.” Such EU laws afford citizens the protection of privacy, which can be enforced against private companies
10/ The EU data privacy directive still applies “irrespective of whether those obligations are imposed on such providers for reasons of national security,” the advocate general held.
11/ As always, this opinion is not binding, but in 80pc of cases the advocate general opinion is upheld by the full court
12/ What does this have to do with Brexit? The EU + UK are due to negotiate an "adequacy" agreement, meaning the EU would recognise the UK's data protection standards as sufficient to allow the transfer of EU personal data to the UK, as the UK will no longer be bound by GDPR
13/ However, if the full court upholds this ruling it wd create a potentially higher standard of data protection on the EU side - privacy campaigners have long held that UK spy agencies use data to carry out surveillance on individuals just as much as the US does
14/ Once the UK is a third country, privacy campaigners may argue that an adequacy agreement is not sufficient (the UK would no longer be subject to such ECJ rulings) and take legal action against it.
