Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others
European Court of Justice of the European Union (ECJ)
Case number: C-623/17
On 8 September 2017, the Investigatory Powers Tribunal (IPT) referred questions concerning the collection of bulk communications data (BCD) by the Security and Intelligence Agencies (SIAs) from mobile network operators (or electronic communications network) to the European Court of Justice of the European Union (ECJ).
The initial case was brought by Privacy International before the IPT on 8 June 2015. Privacy International challenges the acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets (BPDs) and bulk communications data (BCDs) by the UK Security and Intelligence Agencies (SIAs) – specifically Government Communications Headquarters (GCHQ), Security Service and Secret Intelligence Service.
In the course of this case, Privacy International claimed that the regime was unlawful under EU law because it failed to provide various safeguards identified as required in the ECJ judgment in Watson/Tele2 cases. The Government argued that the regime was outside the scope of the EU given that it related to national security (and not serious crime purposes at issue in Watson/Tele2) and alternatively that Article 8, ECHR provided sufficient safeguards and the implementation of Watson safeguards would cripple the SIAs ability to operate the BCDs and should not apply. The IPT referred both topics (in relation to the BCD regime only not BPD) to the CJEU. The documents containing legal arguments from the relevant hearing are listed below.
The ECJ is now asked to decide, first, whether requiring an electronic communications network to turn over communications data in bulk to the SIAs of a member state falls within the scope of Union law and the e-Privacy Directive. Second, if the answer to the first question is yes, do any of the Watson/Tele2 requirements apply to that bulk access to data?
The ECJ decided to hold a joint hearing with two other cases, the joined cases C-511/18 and C-512/18 (La Quadrature du Net and Others) from France, where Privacy International is also a party, as well as case C-520/18 (Ordre des barreaux francophones et germanophone and others) from Belgium.