The European Court of Justice has ruled the Data Retention Directive would be a violation of the European Convention on Human Rights, and the Data Retention Directive is therefore invalid.
The ECJ’s line of reasoning is that metadata paints such a detailed picture of a given person’s life that the right to privacy under the Human Rights Act (or the European Convention of Human Rights) would become a joke. It’s also generalised enough that it would conceivably give citizens the feeling they were constantly under surveillance, and applied broadly enough that it no longer qualifies as a valid exception to the ECHR.
Of course, being a ham fisted power grab, the Data Retention Directive lacked the safeguards to prevent the data being improperly accessed and misused.
Data Retention Directive: Invalid, but not quite dead yet
For readers who are wondering how significant the ECJ ruling actually is, here’s my understanding of how things work: Basically the European Union consists (at least) of the European Council and the European Parliament. A proposition is made by the European Parliament, submitted to the EC, then voted on in the European Parliament. Sometimes laws can originate from the EC itself. In any case, the outcome is often a ‘Directive’, basically an order for the EU ‘states’ to implement it as legislation. In the UK, the Directives are eventually enacted as legislation by Westminster.
The bad news is the ECJ ruling itself wasn’t a defeat of the data retention thing. While the directive was ruled invalid, it would have to be repealed along with each country’s implementation of it – a process that realistically takes several years. In other words, the directive still exists and the Electronic Communications Bill could still be passed through Westminster. Of course, someone might take the matter to court, but how would such a legal challenge be framed?
Neither is data retention specifically illegal. The ECHR itself comes with this huge, but very subtle caveat – any part of the EHCR can be nullified for the purpose of ‘preventing crime’. Or data retention could be done rather effectively under the guise of foreign intelligence gathering, knowing the vast majority of our Internet traffic enters and leaves the United Kingdom.
The ECJ’s ruling does, however, set a nice precedent and qualifies our arguments of how increasing surveillance powers can be incompatible with the concept of human rights. For whatever it’s worth.