Generalised data retention: a blow to mass surveillance!

Paris, 22 December 2016 — The European Court of Justice published a very important decision last 21 December, condemning the principle of generalised data retention by operators, including when mandated by Member States implementing this principle on issues linked to security or fight against crime. Data retention must be the exception and not the rule and can only be used with strong safeguards due to the very serious violation that such retention constitutes for privacy. La Quadrature du Net welcomes this very positive decision and is asking French government to acknowledge European decisions by cancelling all legislation linked to the exploitation or conservation of internet users data.

The decision of 21 December follows a very important ECJ decision: Digital Rights Ireland. In April 2014, the ECJ invalidated the 2006 European Directive forcing Member States to organise the collection and the general retention of all connection data of European internet users. Already, the ECJ considered that this systematic retention of connection data undermined too much the right to privacy: even when not taking into account the future use of this data, the mere fact of keeping it was already a systematic breach into citizens’ lives.

This new ECJ decision is a consequence of the 2014 one: following Digital Rights Ireland, the majority of EU Member States abrogated their legislation, which La Quadrature du Net welcomed. But a number of other countries still have not, among which the United Kingdom, Sweden and France.

Concerning France, the Exegetes Amateurs, a policy workgroup encompassing FDN, the FFDN federation and La Quadrature du Net, brougth legal challenge before the French Council of State, but it considered that France was not concerned by the Digital Rights decision and declined to officially consult with the ECJ on the matter, despite an explicit request from the Exegetes. Yesterday’s decision put the French Council of State in front on its contradictions and will be an important step for the cases opposing the Exegetes and France and in the fight against mass surveillance.

Concerning Sweden and the United Kingdom, two national challenge have been brought before the ECJ, and thus yielded this decision. The European Union Court of Justice decided on 21 December that Member States must not impose generalised data retention to operator, lest they disproportionately undermine the privacy of their customers. Data retention by service providers must thus be limited and in no case be generalised. It is, for the ECJ, a matter of respect of European Union’s fundamental rights and especially the right to privacy, to the protection of personal data but also the right to freedom of speech. The Court reasserts that connection data have a important place in our lives and that systematic collection of connection and localisation data is a form of surveillance:

“That data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as everyday habits, permanent or temporary places of residence, daily or other movements, activities carried out, social relationships of those persons and the social environments frequent by them”.

“The interference entailed by such legislation in the fundamental rights […] is very far-reaching and must be considered particularly serious. The fact that the data is retained without the subscriber or registered user being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance”.

“Even if such legislation does not permit retention of the content of a communication and is not, therefore, such as to adversely affect the essence of those rights (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgement, paragraph 39), retention of traffic and location data could nonetheless have an effect on the use of means of electronic communication and, consequently, on the exercise by the users thereof of their freedom of expression, guaranteed in Article 11 of the Charter”.

This decision is extremely positive. It strengthens what is now shaping as a firm position by the European Court of Justice regarding the impact of systematic data collection: data collection is a form of surveillance in and of itself, regardless of any exploitation of these data. Because data collection is a surveillance tool, it must be very strictly regulated and used only in specific and serious cases, in a targeted and proportioned manner.

This decision is a striking blow to all surveillance policies being deployed within the European Union. It especially is for France, which has passed a number of surveillance laws over the past few years, and has constantly refused to feel concerned by the many signals sent by the highest European jurisdiction – even as these signals were getting clearer and clearer.

However, the European Court of Justice decision leaves a few points unresolved or unclear, and those will have to be clarified by future policies, which are bound to be passed in the near future, including in France:

• the ECJ asked for prior control by an independent authority. La Quadrature du Net and civil rights defence organisations have always asked for this control to be implemented under the authority of an independent justice system. It should be ensured that neither the CNCTR ¹Oversight authority of Intelligence techniques — on Intelligence matters –, nor the Council of State could be used in France as pseudo-oversight authorities. Those two organisations, whatever their good intentions, do not feature the necessary guarantees of independence.
• beyond the issue of the surveillance of citizen through retention of connection data, it will be necessary to look into the practices of the justice system, that massively resort to the use of those connection and localisation data, including in investigations that are not related to serious crime nor to terrorism²Report of France’s lower chamber delegation on Intelligence 2014, p. 77, gives the number of 650 000 requisitions in 2012 for 35 000 judicial interceptions .

More generally, this decision of the ECJ will yield the political questions needed in our era, after two decades dedicated to the race towards surveillance through data retention: how to rebuild a system where the balance of rights is respected? The highest European jurisdiction is demanding an end to the massive use of connection data, including on issues advertised as linked to security. There are new methods to invent, a new balance to find, political choices to make based upon the absolute necessity to respect civil rights including in troubled periods where political decisions-makers readily sacrifice those fundamental rights for security-driven policies which have not proved any more efficient with surveillance. La Quadrature du Net hopes that this ECJ decision will steer French law into the right direction, and will weight on the numerous legal actions brought by the Exegetes Amateurs before French and European jurisdictions: “even as we have been living 15 years during which invoking — often misleadingly — security sufficed to justify permanent undermining of the Rule of Law, up to to allowing all and everyone to be put under constant and omnipresent surveillance, the ECJ reminds Member States of the Law. We will strive in all our actions — judicial with the Exegetes Amateurs, and also political — to make it so that no one forgets it.” said Philippe Aigrain, co-founder of La Quadrature du Net.