Secretary of State for the Home Department v Watson MP & Ors

On 20 November 2015 this court gave judgment in these proceedings ([2015] EWCA Civ 1185) referring preliminary issues to the Court of Justice to the European Union (“CJEU”). We refer to that judgment for the history of the proceedings and the issues in the domestic proceedings. The principal purpose of the reference was to obtain clarification of the judgment of the CJEU in Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Limited v Minister for Communications, Marine and Natural Resources & Others and Seitlinger and Others delivered on 8 April 2014 (“Digital Rights Ireland Limited”). We referred the following questions.

“1.

Does the judgment of the Court of Justice in Joined Cases C293/12 and C-594/12 Digital Rights Ireland and Seitlinger, ECLI:EU:C:2014:238 (“Digital Rights Ireland”) (including, in particular, paras 60-62 thereof) lay down mandatory requirements of EU law applicable to a Member State’s domestic regime governing access to data retained in accordance with national legislation, in order to comply with Article 7 and 8 of the EU Charter (“the EU Charter”)?

Does the judgment of the Court of Justice in Digital Rights Ireland expand the scope of Articles 7 and/or 8 of the EU Charter beyond that of Article 8 of the European Convention on Human Rights (“ECHR”) as established in the jurisprudence of the European Court of Human Rights (“ECtHR”)?”

The President of the CJEU granted an application that the reference be expedited and that it be joined to the reference made by the Stockholm Administrative Court of Appeals then pending as Case C-203/15 Tele2 Sverige AB.

Following a hearing on 12 April 2016, the Grand Chamber of the CJEU gave judgment on 21

It appears that the first paragraph of the dispositif reflects the language of the Swedish legislation which was the subject of the reference by the Swedish court, whereas paragraphs 2 and 3 of the dispositif reflect the questions referred by this court.

Following the handing down of the judgment of the CJEU, a considerable delay occurred before the matter was listed before this court for further hearing. At the prompting of the court it was listed for hearing on 7 June 2017 but that hearing was vacated because of the non-availability of certain counsel. The case has now been relisted for hearing before us.

There have been several developments since the judgment of the CJEU.

It is now for this court to seek to apply the decision of the CJEU to the challenge brought against DRIPA in the national proceedings. As Mr Jaffey QC, on behalf of the First Respondent, pointed out in the course of his oral submissions, the fact that DRIPA has now been repealed does not make this a pointless exercise. Nevertheless, I regret to say that the task now facing this court is far from easy in view of the fact that the preliminary ruling from the CJEU is lacking in clarity. This is apparent from the disputes between the parties before us as to its effect and from the fact that it has already given rise to a further reference by the IPT.

We have heard competing submissions as to whether, in these circumstances, it is appropriate for this court to grant declaratory relief and, if so, what form such relief should take. We note

It is common-ground amongst the parties before us that the judgment of the CJEU establishes, at the very least, that where the purpose is the prevention, investigation, detection and prosecution of criminal offences:-

Article 15(1) of Directive 2002/58/EC permits Member States to adopt legislative measures to restrict the scope of the rights and obligations of the Directive “when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection, and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC”. It provides that, to that end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on those grounds. The reference made by the IPT raises squarely the question whether the judgment of the CJEU in the present case and, in particular, the mandatory requirements identified in that judgment (“the Watson requirements”) apply where the purpose is that of national security. (See the judgment of the Investigatory Powers Tribunal at paragraphs 23 and 54.) The IPT stated at paragraph 69 of its judgment making the reference:-

“We have carefully considered the evidence before us, both from the Claimant and the Respondents, and we are persuaded that if the Watson requirements do apply to measures taken to safeguard national security, in particular the [Bulk Communications Data] regime, they would frustrate them and put the national security of the United Kingdom, and, it may be, other Member States, at risk. It is to be hoped that, whether by reconsideration, or clarification, of paragraph 119 of the Judgment, or otherwise, the Grand Chamber will take the opportunity to consider whether any further statement than that the safeguarding provisions of the ECHR should apply is required.”

On behalf of the Secretary of State, Mr Eadie QC submits that the reasoning of the CJEU, in particular at paragraphs 102, 103, 108, 110-112, 119-120 and 125, is limited to the purpose of fighting crime. He makes the point that, apart from a reference to public security at paragraph 111, the only reference in the judgment of the CJEU to national security is at paragraph 119. In that regard, he also refers to the terms of the dispositif. That submission is not accepted by the respondents or the interveners.

However, it is not necessary for this court to come to a conclusion on that point because the respondents agree that, in order to avoid pre-empting matters which will have to be considered on the reference by the IPT, any declaratory relief granted in these proceedings should be expressly limited to the application of the Watson requirements to cases concerned with fighting crime. (I should point out that Ms Simor QC who appeared on behalf of the First and Second Interveners did not agree to such a course but expressly stated that she would not seek to persuade us to take a different course). I consider that this is the most appropriate course. In view of the controversy over this issue before the IPT and the fact that

In these circumstances I consider that it is appropriate to grant declaratory relief, limited to the context of the prevention, investigation, detection and prosecution of criminal offences, to the effect that DRIPA was inconsistent with EU law to the extent that it permitted access to retained data, where the objective pursued by that access was not restricted solely to fighting serious crime, or where access was not subject to prior review by a court or an independent administrative authority.

In these proceedings, the First Respondent contends that DRIPA does not contain adequate safeguards against communications data leaving the European Union. It is submitted that the Divisional Court rightly identified that domestic law is deficient in this respect but wrongly concluded that on a proper interpretation of Digital Rights Ireland it is not necessary for restrictions on passing on information about communications data outside the EU to be embodied in statute. The First Respondent submits that the Divisional Court should have held that the deficiency in domestic law was a further reason for holding that section 1 of DRIPA is inconsistent with EU law (see Respondent’s skeleton argument before the Court of Appeal, paragraphs 75, 76). Accordingly, the First Respondent issued a Respondent’s Notice to that effect. I understand that this is also the position of the Second and Third Respondents.

The dispositif of the judgment of the CJEU in the present case expressly refers to such a requirement stating that national legislation governing the protection and security of traffic and location data is precluded “where there is no requirement that the data concerned should be retained within the European Union”. This may be taken as reflecting paragraph 122 of the judgment where the Court states that the providers of electronic communications services must, in order to ensure the full integrity and confidentiality of data, guarantee a particularly high level of protection and security by means of appropriate technical and organisational measures. It then states:

“In particular, the national legislation must make provision for the data to be retained within the European Union and for the irreversible destruction of the data at the end of the data retention period …”

On this basis we are urged by the Respondents and the Interveners to grant declaratory relief to that effect.

Mr Eadie, however, submits that there is a deep uncertainty as to the precise meaning and scope of these passages in the judgment of the CJEU. On their face, they appear to impose an absolute, unconditional requirement. By contrast the argument before the national courts in these proceedings has, to date, been on the basis that there was a lack of adequate safeguards. Furthermore, it is clear from the IPT judgment that it is the position of Privacy International, the claimant in those proceedings, that the obligation is not an absolute one. At paragraph 65 of its judgment the IPT records the submission of Privacy International in those proceedings.

“However, the Claimant submits that it is not an absolute bar, because of the interpolation of paragraph 123 between paragraphs 122 and 125. That paragraph provides for there to be a review by an independent authority of compliance with the level of protection guaranteed by EU law, and Mr. De la Mare submitted that, by virtue of the reference to Article 8(3) of the Charter, this was to be seen as an independent authority supervising the transfer of data out of the European Union, thus making the bar not absolute.”

I also note that it was common-ground among the parties before the IPT that there was uncertainty as to the scope of this obligation.

The IPT also referred to an alternative submission of the claimant in those proceedings that the requirement is only for the data itself to remain in the European Union and not the product of the data. The Tribunal, while noting that, if that is so, it is less of a restriction, observed (at paragraph 65) that the reference in paragraph 123 to a potential claim by a person “seeking the protection of their data” would not appear to support this reading. The Tribunal went on to observe (at paragraph 67) that a requirement imposing an absolute bar would appear to be in clear conflict with earlier decisions of the CJEU in Joined Cases C-317/04& C-318/04 Parliament v Council (EU:C:2006:346) as approved in Case C-301/06 Ireland v Parliament (EU:C:2009:68) and with the opinion of AG Mengozzi relating to the draft agreement between Canada and the European Union on the transfer and processing of passenger name record data (Opinion 1/15 (EU:C:2016:656), 8 September 2016). It further observed that this would also appear to be in conflict with Article 25 of the Data Protection Directive under Chapter IV of the directive, entitled “Transfer of Personal Data to Third Countries”. As a result this issue now features large in the reference made by the IPT to the CJEU.

In these circumstances there remains considerable uncertainty in relation to this further requirement for which the Respondents and the Interveners contend. It is to be hoped that these uncertainties, which inevitably affect the vital interests of Member States, will be clarified by the CJEU when it considers the reference made by the IPT. However, as matters stand, I do not consider that this court should make a definitive statement on this issue in the form of a declaration.

The Respondents and the Interveners submit that this court should also make a declaration to the effect that the failure of DRIPA to make provision for ex post facto notification to persons affected infringes EU law. They base this submission on para 121 of the judgment of the CJEU which states:

“Likewise, the competent national authorities to whom access to the retained data has been granted must notify the persons affected, under the applicable national procedures, as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities. That notification is, in fact, necessary to enable the persons affected to exercise, inter alia, their right to a legal remedy, expressly provided for in Article 15(2) of Directive 2002/58, read together with Article 22 of Directive 95/46, where their rights have been infringed …”

In my view, however, it is not appropriate to make such a declaration for the following reasons. First, this has not previously been an issue in the national proceedings. Mr Jaffey told us that this point was argued at the oral hearing of the reference in Luxembourg but he accepted that the point had only been touched on briefly in the national proceedings. Contrary to his submission, paragraph 29 of the order for reference in the present proceedings does not address this issue but the powers of the Interception of Communications Commissioner. Secondly, although the significance of this is not entirely clear, this requirement is not included in the dispositif of the CJEU judgment in the present case where the other Watson requirements are recited. Thirdly, it is clear that this will be an issue before

At paragraphs 106 – 112 of its judgment the CJEU addresses the question of the relationship between the data which must be retained and a threat to public security. In this section of the judgment it is addressing the question referred by the Swedish court on the basis of the relevant Swedish legislation. At paragraph 111 the CJEU stated:

“As regards the setting of limits on such a measure with respect to the public and the situations which may potentially be affected, the national legislation must be based on objective evidence which makes it possible to identify a public whose data is likely to reveal a link, at least an indirect one, with serious criminal offences, and to contribute in one way or another to fighting serious crime or to preventing a serious risk to public security. Such limits may be set by using a geographical criterion where the competent national authorities consider, on the basis of objective evidence, that there exists, in one or more geographical areas, a high risk of preparation for or commission of such offences.”

In paragraph 112 the CJEU then states its answer to the question referred by the Swedish court in identical terms to paragraph 1 of the dispositif.

Mr Drabble QC, on behalf of the Second and Third Respondents, submits that this court should grant declaratory relief reflecting the fact that DRIPA does not proceed by reference to objective evidence which makes it possible to identify a public whose data is likely to reveal a link, whether direct or indirect, with serious criminal offences. On behalf of the Secretary of State, Mr Eadie submits that this passage of the judgment of the CJEU is based on the Swedish legislation and that it is not appropriate for this court to move from the general principle stated by the CJEU to the conclusion that DRIPA suffers from the same vice.

I initially took the view that the general principle stated by the CJEU at paragraphs 106-112 of its judgment and in paragraph 1 of the dispositif is one of general application and that, as DRIPA did not include any such limitations, it was appropriate to grant declaratory relief reflecting this fact. However, when a draft judgment and draft order were circulated to the parties and interveners in advance of handing down judgment, counsel for the Appellant lodged further written submissions in which they drew attention to matters which had not been drawn to our attention in the course of the oral hearing. The Appellant invited the court to decline to exercise its discretion to make the proposed declaration on this point.

The procedure governing the circulation of draft judgments does not permit the making of such further submissions (R (Edwards) v. Environment Agency (Note) [2008] 1 WLR 1587). However, it appears that there was some confusion as to the procedural steps to be taken following the oral hearing, and that the Appellant was awaiting further written submissions from the First Respondent before herself making further written submissions with the court’s permission. Furthermore, in the light of the public importance of the matters raised the members of the court took the view that we should, exceptionally, invite further submissions from the Respondents and the Interveners on the matters raised by the Appellant. We have now received written submissions in response from the Respondents and the Interveners. We note, in passing, that the submissions lodged by the First Respondent do not address the current issue and those of the Second and Third Respondents simply state that the correct interpretation of paragraphs 55 to 65 of the Digital Rights judgment was and must have been anxiously considered by all the parties and the court during the current proceedings.

On further consideration, I have come to the conclusion that this court should decline to grant declaratory relief under this head for the following reasons.

In these circumstances I consider that it is appropriate to grant declaratory relief in the following terms:

I agree.

I also agree.