Over 60 Organizations Want Sanctions For EU Nations' Failure To Repeal 'Invalid' Data Retention Laws
from the attacking-the-data-retention-zombie dept
We recently wrote about a slight setback in the fight against mass surveillance in Europe. But in general, there have been some good decisions in this field by the EU’s top court. In 2014, the Court of Justice of the European Union (CJEU) ruled that the region’s Data Retention Directive was “invalid“, in what is generally known as the “Digital Rights Ireland” case. In 2016, the CJEU took a similarly dim view of the UK’s Data Retention and Investigatory Powers Bill (DRIPA), in the “Tele-2/Watson” judgment. Under EU law, those decisions had to be implemented by all the EU Member States. But a report by Privacy International published in September last year showed that compliance has been dismal (pdf):
in an alarmingly large number of Member States (roughly 40% of all countries surveyed in this report) the pre-Digital Rights Ireland regime transposing Directive 2006/24 is still in place.
That is, the national laws that implemented the Data Retention Directive had not been repealed, despite the CJEU’s ruling that they were invalid, nor had new legislation been passed. The research also showed something interesting about the other countries that had repealed or amended their data retention laws:
What has emerged from our analysis is that as a rule of thumb repeal or amendments to data retention legislation have mainly occurred as a result of challenges in national courts, predominately by human rights NGOs, while Governments and legislators have been largely inactive.
In other words, governments have to be kicked into doing something, otherwise they just ignore the CJEU’s ruling. Based on that fact, dozens of NGOs, community networks, academics and activists have decided to increase the pressure on Member States that are slacking:
60 organisations, community networks and academics in 19 EU Member States are sharing their concerns to the European Commission, to demand action, and to stand for the protection of fundamental rights enshrined in Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union, as interpreted by the Grand Chamber of the CJEU. We call for the application of sanctions for non-compliant Member States by referring to the CJEU, which should logically strike down all current data retention national frameworks.
As the dedicated web site stopdataretention.eu indicates, there are now over 60 organizations backing the move and signatories to the formal letter of complaint sent to the European Commission (pdf). Given the CJEU’s clear ruling against the earlier data retention frameworks, it seems likely that it will also strike down the national implementations of them. Whether the European Commission will send these cases to the CJEU, and how long it will take if it decides to do so, is less clear. If nothing else, the latest move underlines just how important it is for digital rights organizations to keep up the pressure — and how hard it is to kill off bad EU laws once they are passed.
Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+
Filed Under: cjeu, data retention, eu, privacy
