Data privacy battle plays out before European court
As Snowden revelations put retention and use of data in the spotlight, case will determine whether European directive is legal
Personal data: focus of global attention
Just as surveillance and data privacy have become a focus of global attention, the European Court of Justice (ECJ) is this week examining an Irish challenge to the Government’s data retention law requiring the long term storage of Irish citizens’ call and internet data.
The hearing, held on Tuesday, starts the process under which the court will decide whether the European Directive on data retention (2006/24/EC) is legal, or should be struck down.
The directive underlies Irish data retention legislation, which requires that phone companies and internet service providers retain detailed data of customers’ phonecalls and email, as well as internet usage, for two years.
Whatever the outcome – which is unlikely to be known for up to six months – the Irish case will have significant implications for Irish citizens’ internet and phone privacy and potentially, for half a billion people across Europe as well.
The case, launched in 2006 and referred the the ECJ by the Irish High Court in 2012, comes weeks after US whistleblower Edward Snowden revealed the extent of the surreptitious gathering of call and internet data by the US National Security Agency (NSA) and Britain’s GCHQ. This may, or may not, influence an opinion, but public and legislative awareness of the issues at stake has probably never been higher.
On Tuesday, the Grand Chamber of the European Court of Justice in Luxembourg heard two joined cases on the validity of the data retention Directive. One is a case brought by privacy advocate Digital Rights Ireland (DRI) against the Irish State. The second is a more recent, but similar case from the Austrian Constitutional Court.
Together, the two cases ask whether the European data retention directive is in conflict with articles of the Charter of Fundamental Rights of the European Union. The ECJ told the parties in the case that it would focus on articles 7 and 8, which address personal data, the right to private correspondence and general privacy principles.
There are 17 parties, including the solicitors for both cases, the European Parliament, the Council of Ministers, the European Commission, the European Data Protection Supervisor, and nearly a dozen other European countries.
Each party made a written submission in response to a set of questions from the ECJ. On Tuesday, each party also made a 10-15 minute oral submission.
What is the Irish case about?
Going under the lengthy title Digital Rights Ireland Limited v the Minister for Communications, Marine and Natural Resources, the Minister for Justice, Equality and Law Reform, the Commissioner of An Garda Síochána, Ireland and the Attorney General, the DRI case, brought by McGarr Solicitors, challenges the constitutionality, and the implementation, of Ireland’s data retention legislation, both the Criminal Justice (Terrorist Offences) Act 2005 and the State’s 2006 implementation of the European data retention Directive.