Big Brother Watch v UK: the ECtHR Grand Chamber rules on mass surveillance

 

 

Lorna Woods, Professor of Internet Law, University of Essex

 

Introduction

 

This is the Grand Chamber’s take on a challenge to the UK’s RIPA regime originally decided by a chamber (judgment 13 September 2018). It is the culmination of a long series of challenges to the UK regime, following the publication of information revealing that the UK (and other Governments) had engaged in bulk surveillance of people’s communications as well as in intelligence sharing. The judgment arose from three applications originally filed before the Strasbourg Court: Big Brother Watch and Others v. the United Kingdom (App no. 58170/13); Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (App no. 62322/14); and 10 Human Rights Organisations and Others v. the United Kingdom (App no. 24960/15) (and on which I commented).  Similar questions were also in issue in Centrum för Rättvisa v. Sweden (App no. 35252/08), another Grand Chamber judgment handed down on the same day but based in a longstanding challenge to Swedish surveillance laws from 2008 which had been found by a chamber of the court not to violate Article 8 ECHR (the right to privacy). 

 

It raises questions about the extent to which such surveillance is permissible and under what conditions – and is about the extent to which the safeguards identified before digitization and which were generally applied in relation to interception of communications can apply to intelligence gathering based on data analytics, where issues of meta data are directly considered as well as concerns about the content of communications. The particular problem is that surveillance has historically been considered from the perspective of individual surveillance, where a person may be the subject of surveillance when there are reasonable grounds for suspicion. The very nature of bulk data acquisition and intelligence gathering means that there is no such suspicion.

 

As many commentators have remarked, it is the first mass electronic surveillance case to be decided against the UK after the Edward Snowden revelations and, significantly, it also considered meta data (communications data) as well as content. While the Court found the UK government to be in violation of Article 8 on some points, it is not a complete ‘win’ for privacy activists. Notably, this judgment and that in Centrum för Rättvisa, sets the conditions for bulk collection of data; in so doing, has it – as the Court of Justice of the EU apparently has following La Quadrature du Net (Case C-511/18) -accepted the possibility the principle of mass survellance, with the loss of anonymity not just online but – with smart homes, cars and cities – potentially everywhere?

 

Facts

 

The UK Government Communications Headquarters (GCHQ) was running three surveillance systems:

 

-          bulk interception of (foreign) communications (which was then winnowed down through automated means to sets of information that would be analysed by the security services);

-          intelligence sharing among the ‘Five Eyes’ (the United States, Canada, Australia, New Zealand as well as the UK), specifically in collaboration with the PRISM and Upstream programs run by the American NSA; and

-          acquisition of communications data from internet service providers.

 

The regime at that time was based on the Regulation of Investigatory Powers Act 2000 (RIPA), which has now been replaced by the Investigatory Powers Act 2016 (IPA); the Court decided matters on the basis of the law as was and not in the light of the IPA (though the IPA shares some features with the RIPA regime). In addition to statutory provisions, RIPA envisaged that codes of practice would provide more detail as to actual practice. As regards the sharing of intelligence, the Counter Terrorism Act 2008 allowed for the disclosure of information to each arm to exercise any of their functions, subject to any limitations imposed by virtue of the Data Protection Act 1998 (now itself replaced by the Data Protection Act 2018) and the Human Rights Act. The Official Secrets Act also applies.  The U.K.-U.S. Communication Intelligence Agreement governs the exchange of intelligence information relating to “foreign” communications between the UK and the US, with the code of practice containing more detail as to treatment of foreign intelligence.

 

The applications – which included journalists and human rights organisations and which might be understood to be particularly affected by the threat of surveillance -were heard together. The 10 Human Rights Organisations had started their action in the IPT; the other applicants claimed there was no effective remedy.  The Chamber decision found a violation of Article 8 and Article 10 in relation to the bulk interception regime in s 8(4) RIPA, and the regime for obtaining communications data, but found no violation as regards the information sharing.

 

 

Judgment

 

There are three aspects to the judgment regarding Article 8. The consideration  of the bulk interception (and the possibility of analysing associated communications data); the receipt of data from foreign intelligence services; and the acquisition of communications data from service providers. These also gave rise to claims under Article 10.

 

Bulk Intercept

 

The analysis of the bulk communications involves a number of stages, each one narrowing the dataset but at the same time, intensifying the level of scrutiny on that information. The Court identified the following stages (para 325):

 

-          the interception and initial retention  of communications and related communications data;

-          the application of specific ‘selectors’ (whether stong selectors – eg an email address - or complex queries);

-          the examination of the resulting selected communications and communications data and retention of data;

-          use of ‘final product’, including sharing that information.

 

While the mere holding of such information by the State in and of itself has long been held to be an intrusion into Article 8 rights, the Court portrayed the four stages as a process in which the degree of interference increases as the analysis progresses (paras 330-331). While bulk surveillance was not per se prohibited by the ECHR, the entire process must be subject to “end-to-end safeguards”.

 

The Court considered whether there was a need to develop the case law given the developments in technology.  In Weber and Saravia and Liberty & Ors the Court had applied the principles developed in relation to targeted interception – targeted interception, however, has a much narrower impact that bulk surveillance.  The Court identified a number of differences between targeted and bulk interception:

 

-          bulk interception was predominantly directed towards international communications (para 244);

-          bulk interception was predominantly aimed at intelligence gathering (rather than investigating crime) (para 345);

-          insofar as individuals were targeted, there devices were not monitored but rather ‘strong selectors’ were used to fish out their communications from the mass of communications intercepted (para 346).

 

This meant that the safeguards already in place, although they provide a useful framework, should be adapted. Specifically, rules that envisaged a particular person or group of persons would not work here – eg the  requirement  to  define  clearly  in  domestic  law  the  categories  of  people  liable  to  have  their  communications  intercepted  and  the  nature  of  offences  which  might  give  rise  to  such  an order or the requirement to have “reasonable suspicion” of the persons put under surveillance (para 348). Nonetheless, domestic law should still set out with sufficient clarity and detail the grounds upon which bulk interception might be authorised and any circumstances in which an individual’s communications might be intercepted. Supervision and review become more important (para 349). The domestic regime should ensure that an assessment of necessity and proportionality is made at each stage of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the bulk operation are being defined; and that the operation at each stage should be subject to supervision and independent ex post facto review (para 350). Affected individuals should have access to an effective remedy. When assessing a regime, the Court would take into account its operation in practice including instances of actual abuse (para 360).

 

Note that the Court was not persuaded that the acquisition of related communications data through bulk interception was necessarily less intrusive than the acquisition of content. The same safeguards should therefore be used to assessed bulk collection and analysis of communications data as content.

 

The starting point for analysis is the typical three stage test (lawful, legitimate aim and necessary in a democratic society), but the Court blends the lawful and necessity questions together which it claims is established (citing Roman Zakharov – a Grand Chamber decision discussed here - and Kennedy). The Court produced a framework that was wider -in the assessment of the Court - than the six Weber criteria (para 361):

 

-          the grounds on which bulk interception may be authorised;

-          circumstances in which an individual’s communications may be intercepted;

-          the procedure for granting authorisation;

-          procedures for selecting, examining and using intercept material;

-          precautions when communicating material to other parties;

-          limits on duration of interception, storage of intercept material and circumstances in which that material must be erased/destroyed;

-          supervision by an independent authority (with powers to address non-compliance);

-          independent ex post review.

 

The Court also took the opportunity to provide more detail on data sharing. Any data shared must have been collected and stored in a Convention compliant manner. Additional safeguards relating to the transfer must be in place: the circumstances in which data are to be shared should be set out in domestic law; the receiving state should have safeguards in place capable of preventing abuse, including secure storage and restriction on onward disclosure. Heightened safeguards are required as regards material requiring special confidentiality (eg journalistic material). In principle the same tests apply to communications data, which it viewed as no less intrusive as content, though the safeguards need not be exactly the same given the different way content and communications data were likely to be analysed.

 

The UK regime did not provide sufficient “end to end” safeguards. In assessing the safeguards, the Court took into account the breadth of the grounds on which surveillance could take place; the UK’s rules ‘were formulated in relatively broad terms’ (para 371). The Court specifically focussed on the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant (which had implications for the necessity assessment), and the failure to subject selectors linked to an individual to prior internal authorisation both as regards content but also related communications data. Although the Court assessed the oversight provided by the Commissioner and the IPT as effective and robust respectively, these did not compensate for the shortcomings.

 

Note that in the parallel Swedish case, the Court applied a similar framework to find that the Swedish regime was also deficient. So, it found ‘the absence of a clear rule on destroying intercepted material which does not contain personal data, the absence of a requirement in the Signals Intelligence Act or other relevant legislation that, when making a decision to transmit intelligence material to foreign partners, consideration is given to the privacy interests of individuals; and the absence of an effective ex post facto review’ (Centrum för Rättvisa, para 369).

 

The complaint under Article 10 was considered separately, with the Court’s starting point being the importance of journalism. It emphasised the detrimental impact of compelled source disclosure, as well as the more serious intrusion of searching of journalists’ homes and workplaces. Safeguards must ‘be attended with the right to protection of journalistic sources must be attended with legal procedural safeguards commensurate with the importance of the principle at stake’, referring back to its decision in Sanoma Uitgevers (para 444). Crucially, independent review must take place prior to disclosure. In the older case of Weber, the interference with the journalist’s expression rights had not been seen as particularly serious; the journalists had not been targeted by the surveillance. The court determined that confidential journalistic material could have been accessed by the intelligence services either intentionally, through the deliberate use of selectors or search terms connected to a journalist or news organisation, or unintentionally, as a “bycatch” of the bulk interception operation. While the former category must be authorised in accordance with the approach in Sanoma Uitgevers, for the latter category because interference with journalistic material was not intended, it could not be predicted and therefore ex ante authorisation would not be possible.

 

The Court noted the technological developments since Weber, finding that the intrusion now would be more significant than at the time of Weber. Robust safeguards are therefore required so that when it becomes apparent that confidential journalistic material is in issue, that material could only continue to be stored and examined by an analyst if authorised by a judge or other independent and impartial decision‑making body with the power to determine whether its continued storage and examination was “justified by an overriding requirement in the public interest” (para 450). In both aspects, despite specific provisions in the relevant code of practice, the UK regime was deficient.

 

Data-sharing

 

The complaint was considered from the perspective of solicited intercept material from the NSA. The applicants did not challenge the Chamber’s decision as regards the effectiveness of the IPT. Avoiding questions about Article 1 ECHR and the issue of a State’s jurisdiction, the Court focused on the initial request and subsequent receipt of intercept material, together with any subsequent use thereof. The Court noted the risk of States seeking to circumvent controls; there must be a clear basis in domestic law for such requests (found in the Code), and guarantees against the risk of abuse specifically relating to examination, use and storage, any onward transmission as well as erasure/destruction.  The Grand Chamber found that, since the treatment of foreign intelligence was essentially the same as the treatment accorded to domestically generated material, the United Kingdom had in place adequate safeguards for the examination, use and storage of the content and communications data received from intelligence partners, as well as for the onward transmission of this material and for its erasure and destruction. It also noted the extra layer of protection provided by the Commissioner and the IPT. It found no violation of Article 8. The claims under Article 10 were likewise dismissed.

 

Communications Data

 

The Chamber’s finding that a regime which suffers the same flaws as a regime accepted to be incompatible with EU law, then having priority over domestic law, must also fail the in accordance with the law test was not challenged as regards Article 8. The Grand Chamber also agreed with this reasoning. An Article 10 challenged had also been brought against the regime. This was also considered not to be in accordance with the law; again the Grand Chamber followed this reasoning to find a violation of Article 10.

 

Dissent

 

While the findings of violation were unanimous, the Court was not unanimous as regards to the finding of no violation being split by 12 votes to 5. Three judges shared a partly concurring opinion; judge Pinto De Albuquerque wrote a partly concurring but partly dissenting opinion and  Judges Lemmens, Vehabovic, Ranzoni and Bosnjak produced a partly dissenting opinion.

 

Comment

 

Most of the commentary has focussed understandably on the fact that the Court did not state that the bulk interception of communications was in itself contrary to Article 8 and on the safeguards.  These are – obviously – important points, but there is a prior issue regarding the lawfulness test, which relates to the complexity and availability of domestic law. The Grand Chamber followed the Chamber in accepting that the Codes of Practice satisfied this requirement. While Codes are now public documents, this assessment does not fully take into account that for a considerable period much now in those codes were “below the waterline” and information was only forthcoming as a result of litigation.

 

Another question is the extent to which the judgment takes into the impact of digitalization. The Chamber judgment has suggested the different rules applied in different contexts, and that not all data would have the same impact. The Grand Chamber recognised that some updating of the analytical framework from Weber would be required (which turns out to be both a good and bad thing), and specifically notes the impact of meta data (probably a good thing).  It is open at least to argument to state however that the negative consequences of the revision of Weber outweighed the good.

 

Looking at the good, it is indubitably true that some recognition of the change in techniques of state surveillance facilitated by changes in technology and computing power is an important prerequisite for ensuring effective protection of individuals’ rights.  There is some way to go however before we can state confidently that the Court has appreciated the ramifications of the digitalisation of life and particularly data profiling. The key positive is that the Court does not think that meta data is less sensitive than content (para 363). It emphasises that

 

any intrusion occasioned by the acquisition of related communications data will be magnified when they are obtained in bulk, since they are now capable of being analysed and interrogated so as to paint an intimate picture of a person through the mapping of social networks, location tracking, Internet browsing tracking, mapping of communications patterns, and insight into who a person interacted with (para 342)

In this, the Court joins the Court of Justice (see eg. Tele2/Watson, para 99).  While the Court goes someway to recognise the always-on aspect of digital surveillance (para 341), and certainly does not go down the route of the Chamber in suggesting some data are less impactful than others, it does not acknowledge the possibility of combining communications data with data from other sources. The range of data available is wide, especially given the range of smart devices. These include for example, biometric data from fitness trackers, biometric based systems proposed for cars note the driver’s blood pressure, heart rate and other vital to detect, if the driver is impaired in any way. At home detail from smart energy meters could be shared. Nor does it question the basis on which those analyses and interrogations take place. While in its safeguards it does suggest oversight over the circumstances in which data are chosen, it seems to take the tools as given.  This is worrying given the emphasis that has previously been placed on the need for special safeguards in related to automated tools and processing techniques, a point the Court of Justice of the EU has also made (e.g Digital Rights Ireland, para 55).

 

While the emphasis on the significance of meta data is good, it should not be forgotten that the first part of the case concerned bulk interception – so interference with content. Against this context, the Court’s assessment that the first stage of the surveillance process – the data gathering stage – does not constitute a particularly serious interference is worrying (and arguably not in line with previous case law). It certainly underplays the threat to privacy that is implicit in the acquiring and holding of data (and Judges Lemmens, Vehabovic and Bosnjak discuss this in their concurring opinion, paras  3-8).  A further question arises in relation to other forms of surveillance; what if smart city devices (eg lampposts) can record our conversations as we pass by (UK installation of microphones have apparently not been for this purpose but to detect aggression). How comfortable are we about data acquisition then? This reasoning may be the top of the slippery slope. 

 

Within the EU context it should be remembered that the Court of Justice has repeatedly emphasised that “access on a generalised basis to the content of electronic communications” undermined the essence of the relevant EU Charter right (article 7) and could not be therefore be justified (see e.g. Schrems I, para 94). This then suggests a difference in approach between the two European courts. It would be unfortunate if the recognition of the impact of meta data led to a lowering of standards as regards content. 

 

The more problematic development is the approach to reasonable suspicion. The Court acknowledges that these surveillance practices do something different from other more traditional forms of surveillance, which tend to be reactive (ie somebody has done something bad) and more focussed (as opposed to diffuse), most likely based on existing evidence which suggests suspicion of specific individuals. This mass surveillance is about intelligence gathering, and about predicting – thus severing the link between an individual’s choices and actions and the likelihood of that person being the subject of surveillance. Rather than assess the surveillance by reference to existing standards – for example, the presumption of innocence and the impact of a State carrying out surveillance (which is recognised through the case law on the mere storing of data), the Court abandons these standards as part of its updating in order to fit round state choices. In so doing, it gives some legitimacy to the idea that the State may carry out surveillance on individuals without any grounds related to that person (para 317, 348).

 

This is based on the Court’s deference to the State’s assessment that these are necessary for national security reasons – though this assessment is not really critically examined. Indeed, when it re-emphasised that the choice of adopting certain surveillance techniques fell to the States, it emphasised the valuable nature of the technique (para 386, emphasis added). Judge Pinto De Albuquerque writes critically of the Court’s “self-imposed evidential and adjudicatory limitation” which “leads the Court to assume the inevitability of bulk interception and, even more so, that of a blanket, non-targeted, suspicion-less interception regime (Opinion, para 5). He also points to the fact that previous cases – including Zakharov – have involved bulk intercept of communications and yet still sought to apply the first two Weber criteria that the Court here has abandoned.

 

 

While of course a State may be free to make these choices about approaches to surveillance in principle they should be assessed to ensure that they are lawful and necessary in a democratic society.  The test of lawfulness and the proportionality test implied in the ‘necessary in a democratic society’ actually ask different questions – but blending them together, as the Court has done here, dilutes the protective nature of the proportionality test. Rather than ask whether this is disproportionate and should not be done, the question becomes how to put oversight in place, which accepts the fact of the interference with the right in the first place. This criticism has been levelled at the Court’s approach before; the Court here (in referring to Zakharov and Kennedy to justify this approach) implies that this blurring of the three part test is both well-established and non-problematic. The Court has in some previous cases suggested that a test of “strict necessity” should be used for mass surveillance (Szabo and Vissy v. Hungary, para 73) – that sort of reasoning is not evident here.

 

As regards the safeguards themselves, it is unclear which grounds justify bulk surveillance (and contrast the position here with the EU position). It should be noted that that prior judicial authorisation is not a prerequisite for such surveillance, even if it might be best practice (para 320). The Court cites authorities to suggest that ex post oversight compensates for lack of ex ante control; this is like saying it is all right to drop an egg on the floor provided you have bucket and mop to clean up afterwards. The end result is not the same (and Judges Lemmens, Vehabovic and Bosnjak remind the Court of the significant harms that may eventuate from a lack of protection in their partly concurring opinion). Significantly, it seems that despite calling these various safeguards fundamental, a global assessment may be made, suggesting that some regimes may be weaker on some issues (perhaps not deal with them at all?) than others (para 370).

 

The approach to the sharing of data is also worrying. On the one hand, the Court recognises the threat posed by intelligence sharing, and the risk that safeguards may be circumvented. Yet, it seems to imply that a lesser standard of safeguards is acceptable in this context, and in so doing accepts the practice as well as the lower standards applicable (contrast viewpoint of Judge Koskelo joined by Judge Turković in the chamber judgment).  It should be noted that the Court only considers one aspect of intelligence sharing – the receipt by the UK security and intelligence services of information. The issue of proportionality is dealt with relatively briefly. Notably, the Court states that the requirement for safeguards:

 

“... does not necessarily mean that the receiving State must have comparable protection to that of the transferring State; nor does it necessarily require that an assurance is given prior to every transfer” (para 362).

 

How oversight is supposed to function against what seems to be a highly flexible framework is uncertain. It is also questionable whether or to what extent this fits with the EU’s approach – admittedly relating to the export rather than as here import of data – under the GDPR and Articles 7 and 8 of the Charter.  Judges Lemmens, Vehabovic, Ranzoni and Bosnjak suggested that the same “end-to-end” safeguards should apply here.

 

In sum, the outcome of this case while certainly restraining some of the potential excesses of the RIPA regime (and possibly therefore its younger sibling, IPA), it is by no means an unqualified victory for privacy activists.

 

Photo credit: Adrian Drycuk, via Wikimedia Commons

The AG Opinion in Schrems II: Facebook, national security and data protection law

Lorna Woods, Professor of Internet Law, University of Essex

Last week a CJEU Advocate-General gave an opinion in the case of Schrems II, the latest challenge to US national security rules as they apply to transfers of personal data from the EU (via Facebook). The original Schrems case (discussed here) shocked the data protection world when the Court of Justice of the EU (ECJ) ruled that the adequacy decision with regards to the United States (which simplified personal data transfers between the EU and the US) was invalid and – effectively - that US practices were incompatible with the EU Charter. Companies transferring data to the US turned to other legal mechanisms to legitimise the transfer of data and Schrems II (Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (Case C-311/18)) concerns one of these mechanisms: standard contractual clauses (SCCs). Surely, given the similar context and the fact that those under US jurisdiction must comply with US law, the outcome must be the same?

The Facts

Max Schrems aimed to stop the transfer of his personal data from the EU to the US under SCCs, following on from the finding in Schrems I that US law did not provide sufficient safeguards for individuals’ privacy rights in the context of bulk surveillance. This resulted in an action being brought by the Irish Data Protection Commissioner (DPC). The DPC took the view that her assessment of whether the transfers were valid depended on whether the model SCCs (established by the European Commission by Decision 2010/87/EU) were valid and she brought an action before the Irish courts, which resulted in an 152 page judgment and a reference to the ECJ, to determine this.

The reference comprised 11 questions, which the Advocate General bundled into a number of topics:

-          the applicability of EU law when data transferred is processed for national security purposes in third countries;

-          the level of protection required;

-          the impact of the non-binding nature of an SCC on the authorities of a third country on the validity of Decision 2010/87;

-          the validity of Decision 2010/87 in the light of the EU Charter; and

-          an assessment of the Privacy Shield decision (the replacement adequacy decision for transfers to the US, following the finding in Schrems I that the previous decision, known as ‘Safe Harbour’, was invalid).

The Opinion

The first issue was whether the fact that the concerns regarding privacy occur in the policy space of national security (an area outwith EU competence) affects the applicability of the data protection directive (DPD) or the replacement law, the GDPR. Those rules are designed for the commercial sphere. As the Advocate General noted,

The significance of that question … lies in the fact that, if such a transfer fell out side the scope of EU law, all the objections raised ...would be rendered baseless [101].

Given the Court’s approach in Schrems I, it is unsurprising that the answer here was that the locus of regulation was the commercial activity that was being undertaken. The purpose of the transfer was not that of allowing the data to be processed for national security [106]. So, ‘the possibility that the data will undergo processing by the authorities of the third country of destination for the purposes of the protection of national security does not render EU law inapplicable...’ [108].

The second issue at which the Advocate General looked was that of the level of protection. He accepted that the approach of the Court in Schrems I to adequacy decisions (under Article 25(6) DPD, and now Article 45(3) GDPR) is also relevant to SCCs so that the ‘appropriate safeguards’ envisaged by Article 46 GDPR should ensure data subjects benefit from a level of protection ‘essentially equivalent’ to that which follows from the GDPR [115]. While the adequacy decision mechanism and the SCC mechanism both aim towards the same objective, the way they each achieve it may be different: the underlying difference between the mechanisms is that the adequacy decision considers whether the protections provided by law in the destination country are adequate; the SCCs accept that they are not and provide other safeguards [120, see also 123-4].

Validity of Decision 2010/87

Moving on to the question of validity of Decision 2010/87 in the light of the EU Charter, the fact that SCCs are not binding on the third country undermines the ability of the recipient of the data always to respect the data protection safeguards contained in the SCC. The Advocate General considered this in the context of the question the Irish Court raised regarding the obligations on the national supervisory authority to suspend transfer [122]. The Advocate General proposed that:

-          SCCs may be assessed only on the ‘soundness of the safeguards’ they each provide;

-          safeguards may be reduced/eliminated as a result of the law of the third country;

-          the mechanism imposes on the exporter/controller or the national supervisory authorities, on a case-by-case basis, to prohibit or suspend transfers.

The Advocate General concluded that this did not invalidate the Decision but rather raised the question of ‘whether there are sufficiently sound mechanisms to ensure that transfers based on the standard contractual clauses are suspended or prohibited where those clauses are breached or impossible to honour’ [127]. He also highlighted the requirement in Article 46(1) GDPR that data subjects’ rights must be enforceable and remedies available.

Obligations on data controllers

The SCC imposes obligations on exporter and importer to comply with the terms of the contract. Given the obligations on the data controller (the person in control of the uses to which the data is put) imposed by the GDPR, where the exporter is aware that the importer cannot honour the terms of the SCC, the controller does not have a choice to suspend transfer but is required to do so [132]. The Advocate General also suggested that the parties should carry out an examination into whether the law of the third country would entail such a breach [135]. The rights of the data subject are ensured as against the exporter/controller under the SCC in Decision 2010/87 and the data subject may also apply to the national supervisory authorities.

Obligations on the supervisory authorities

The Advocate General proposed that national supervisory authorities are required to order the suspension of the transfer. Specifically, the right to suspend is not only to be used in exceptional cases (this follows amendment of the SCC terms in the light of Schrems I) and recital 11 of Decision 2010/87 is ‘obsolete’ [143].  The Advocate General emphasised that

‘the exercise of the powers to suspend and prohibit transfers …. is no longer merely an option left to the supervisory authorities’ discretion’ [144].

Article 58(2) GDPR, which sets out the powers of supervisory authorities, should be understood in the light of Article 8(3) EUCFR and Article 16(2) TFEU (both of which provide that compliance with data protection law should be overseen by an independent authority) – the Advocate General inferred that this meant the authorities have to act in such a way as to ensure the proper application of the GDPR. This imposes a due diligence requirement on the authorities, as well as an obligation to react appropriately to infringements. Failure to do so can lead to judicial action, and this re-emphasises that the obligation on the national supervisory authorities is ‘strict’, not discretionary [150].

The DPC had contended that this obligation is insufficient: it fails to address the systemic problems of inadequate safeguards; and that the approach leaves unprotected those whose data have already been transferred. The Advocate General disagreed; while problems existed they were not sufficient to invalidate the decision. He stated that:

EU law does not require that a general and preventive solution be applied for all transfers to a given third country that might entail the same risks of violation of fundamental rights [154].

As regards, effective redress for those already affected, the Advocate General emphasised the roles of the supervisory authorities to take corrective measures and the rights under Article 82 GDPR.

Privacy Shield

The Advocate General than took the view that it was unnecessary to consider the ‘Privacy Shield’ decision, in part because it assumes that the general level of law and protection in the recipient state need to afford adequate protection for SCCs to be available – a point which the Advocate General had already rejected.  Nonetheless the Advocate General did produce some guidance for the Court were it to consider the issue.

The finding of adequacy under the Privacy Shield does not preclude a national supervisory authority from exercising its powers. A number of parties challenged (directly or indirectly) the finding of adequacy in relation to the Privacy Shield. He suggested that when considering the comparison between the law and safeguards of the third country the appropriate comparison would be with the approach of the Member States to their own national security within the framework of the European Convention on Human Rights (ECHR) [207] and that those standards must be known in advance. The Advocate General discussed the scope of the national security exception, defined as:

activities connected with the protection of national security in so far as they constitute activities of the State or of States authorities that are unrelated to fields in which individuals are active [para 210, citing inter alia Tele2 Sverige and Watson (Cases C-203/15 and C-698/15, discussed here)].

The Advocate General suggests that the exclusion covers measures ‘that are directly implemented by the State for the purposes of national security, without imposing specific obligations on private operators’ [211]. He notes that where private operators are involved the law is less clear with the earlier PNR judgment (Parliament v Council and Commission (Cases C-317/04 and C-318/04)) seemingly pointing in a different direction from more recent jurisprudence including Tele2/Watson.  He proposed a number of ways to reconcile the two lines of cases:

-          Tele2/Watson arose where operators were required to keep data; the airlines kept the data for their own commercial purposes [218];

-          Tele2/Watson arises where operators are required to cooperate as regards the access to the data, irrespective of whether there is a prior obligation to retain data - because the provision required the operators to engage in data processing [219-220].

The Advocate General favoured the second approach, suggesting it was also in line with Schrems I and that, once national authorities have the data and engage in further processing of them, such processing is not caught by the scope of the GDPR. In this view of the Advocate General, this means verification must take place by reference first to the GDPR and Charter and secondly by reference to the ECHR.

A further issue was whether continuity of protection means that measures must be in place during transit (e.g. through submarine cables). Article 44 GDPR refers to ‘after transfer’ which could mean after arrival or once transfer has been initiated. Relying on a teleological interpretation, the Advocate-General adopted the second interpretation.

Moving on to the validity of the Commission’s assessment of adequacy, the Advocate General assessed whether the Commission’s findings warranted the adoption of an adequacy decision, recalling the principles set down in Schrems I allowing for ‘a certain flexibility in order to take the various legal and cultural traditions into account’ but ‘that certain minimum safeguards and general requirements for the protection of fundamental rights that follow from the Charter and the ECHR have an equivalent ...’ [249].  It was this essential equivalence that the referring court challenged. The Advocate General re-stated case law from both Courts that recognised the existence of an interference, and as far as the ECJ is concerned it does not matter whether the data are sensitive. Further:

the obligation to make the data available to the NSA, in so far as it derogates from the principle of confidentiality of communications, entails in itself an interference even if those data are not subsequently consulted and used by the intelligence authorities [259].

As regards the requirement that interferences must be provided for by law, the Advocate General – treating the approach of the ECJ and ECtHR together states that this test means that:

regulations which entail an interference … lay down clear and precise rules governing the scope and application of the measure at issue and imposing a minimum of requirements, in such a way as provide the persons concerned with sufficient guarantees to protect their data against the risks of abuse and also against any unlawful access to or use of data [para 265, citing Digital Rights Ireland (discussed here), Tele 2 Sverige, Opinion 1/15 (discussed here), Weber and Saravia, Zakharov (discussed here) and Szabo and Vissy].

The Advocate General doubted whether the US framework met this threshold [266].  Following existing jurisprudence, however, the Advocate General accepted that the very essence of Article 7 or 8 was not compromised.  In this, the Advocate General noted that the position of the ECtHR was that such surveillance could, in principle, be capable of justification [282].

National security has long been accepted as a legitimate public interest ground justifying interferences with rights. The scope of ‘national security’ was challenged. The Advocate General accepted that some aspect of foreign affairs might fall within ‘national security’; further objectives dealt with under ‘foreign intelligence information’ could constitute other public interest objectives but that these would have a lesser weighting in a proportionality analysis. However, ‘it may be asked whether those measures are defined sufficiently clearly and precisely to prevent the risk of abuse and to permit a review of the proportionality.’ [289].

The Advocate General nonetheless considered the necessity and proportionality aspects, within the framing set down by Schrems I in particular. The Advocate General also noted the safeguards required by Article 23(2) GDPR. He doubted whether the selection criteria were sufficiently clear and precise and whether there were sufficient guarantees to prevent the risk of abuse noting in particular the difference between the requirement that an activity be ‘as tailored as feasible’ is not the same as an activity which is strictly necessary [300], nor does it necessarily forewarn data subjects [307]. There is no prior review. He therefore concluded that he had doubts about the adequacy of protection provided.

The next issue was the right to an effective remedy and the impact of the introduction of the Ombudsperson Mechanism which is intended to compensate for some of the deficiencies in the US system.  The Advocate General noted that the Article 47 right is in addition to the requirement that there be independent oversight/authorisation of surveillance activities. Re-iterating Schrems I, where there is no possibility to pursue legal remedies, the national rules do not respect the essence of the right. The right include that of receiving confirmation from national authorities whether or not they are processing data as well as being notified about an investigation once it would no longer jeopardise that investigation (though the ECtHR has not made this aspect a requirement). The US system is deficient in these aspects. The Advocate General considered whether the Ombudsperson Mechanism compensates but was not convinced. Such a body to be effective must be established by law and be independent. The Advocate General noted that the mechanism satisfied neither requirement and is not subject to judicial control.

Comment

A cursory look at the conclusion to the Opinion might suggest that there will be no change in the approach to data transfers and that in general this was a bit of a defeat for Schrems. This would mis-characterise the position (and also overlook the fact that it was the DPC that was arguing for invalidity of the SCC decision, not Schrems).  The Opinion is divided broadly into two topics: the first which deals the legality of the SCC decision and the second which deals with the Privacy Shield adequacy decision. 

The Advocate General may have suggested that the Decision underlying the SCCs should not be considered invalid but this does not mean that those transferring data to the US can ignore the privacy concerns. The response of the Advocate General - in avoiding challenging the underlying system itself - is to rely on decentralised, and ultimately private, enforcement by the exporter/data controllers, but also by the national supervisory authority.  This obligation is described in rather strong terms; certainly a data exporter cannot be passive but must investigate conditions and if it finds problems it must act to suspend transfers. A head in the sand approach – if the Court follows the reasoning of the Advocate General – is unlikely to be successful. For national supervisory authorities the obligation seems still stronger and the obligation to assess on a case by case basis potentially increases their workload. Underpinning this again is the threat of legal action by data subjects. While empowering data subjects is probably to be regarded as positive, viewing private enforcement of regulation as an essential element of that scheme is problematic.  It assumes data subjects have the energy and the resources to take action – a real weakness in this approach, despite the possibility for class actions.

It is noteworthy that while the Advocate General heads the section on the acceptability of the Decision as its acceptability under the Charter, in practice his analysis focuses on the right to a remedy. This leaves the impact of the transfers on privacy and data protection (especially against a backdrop of bulk surveillance) under-considered.  Further, the Advocate-General seems to assume that the ability to sue in the EU (under Article 80 causes of action) compensates for the difficulties in standing and lack of remedies in the relevant third country, and assumes that compensation is adequate (as opposed to more behavioural remedies such as ceasing processing).  This aspect of the analysis is in marked contrast to the considerations discussed under the Privacy Shield section.

While the ruling on the impact of national security in the early part of the Opinion may not come of much surprise, it is potentially significant for the UK. At the moment, as a member of the EU, the activities of its security and intelligence services mainly lie outside the ECJ’s purview (though note pending reference on scope of this: Privacy International v Secretary of State for Foreign and Commonwealth Affairs (Case C-623/17)); once it becomes a third country (and subject to any negotiated agreement) national security becomes a relevant consideration.  This difference between EU States and third countries did not escape the attention of those making representations before the court. On this difference, the Advocate General when discussing the comparison that must take place to come to any decision on whether a third State’s data privacy protections are essentially equivalent argues that, in regards to interferences arising in the context of national security (which falls outside EU law and therefore the scope of the Charter), the relevant standards are to be found in the ECHR. 

As noted, however, that boundary is somewhat uncertain and consequently the extent to which it is consistent with earlier jurisprudence, including Schrems I, open to question. The approach of the Advocate General does seem to move away from the approach in the PNR judgment, which was based on looking at the provision’s purpose to determine whether it fell within the national security exception. Perhaps the forthcoming cases will develop a clear and consistent line on this point going forward. The significance of drawing a boundary between the EU Charter and the ECHR lies in the extent of difference in approach of the Strasbourg and Luxembourg courts to bulk surveillance, especially that in relation to communications data. On this, the Big Brother Watch case (discussed here and here) is heading to the ECtHR Grand Chamber.

As regards the second aspect, having noted that the Advocate General seeks to avoid commenting on the Privacy Shield, some of his comments in this regard (made ‘in the alternative’) highlight some real problems for that system. In his discussion he beds his reasoning both in the ECJ’s jurisprudence but also that of the ECtHR.  The Opinion constitutes a clear statement as to the applicability of the law to ‘automated’ surveillance and also as to the requirement of legality (which is not particularly clear as regards the Strasbourg jurisprudence).  In this, as well as in the context of necessity and proportionality of the measures the Advocate General was not convinced the US framework passed the tests. This is not just one problem to fix, but many.  While the Advocate General did not the difference in the jurisprudence between the two courts, this difference did not seem to lead to a different outcome in terms of his assessment of the acceptability of the US regime.

If the Court chooses to consider this question, there will be some serious difficulties going forward for data flows.  Whether the approach will stick is a question; the ECJ has been under pressure to step back from its stance on bulk collection and automated assessment of data in particular. Some of the surveillance issues will be returning to the Court in a bevy of cases: in addition to Privacy International see La Quadrature du Net & Ors v Commission (Case T-738/16); La Quadrature du Net & Ors and French Data Network & Ors (Cases C-511-12/18); and Ordre des barreaux francophones et germanophone, Académie Fiscale ASBL, UA,  Liga voor Mensenrechten ASBL, Ligue des Droits de l’Homme ASBL, VZ, WY,  XX v Conseil des ministres (Case C-520/18). Further Advocates-General opinions in several of these cases are set for January.

Barnard & Peers: chapter 9

Photo credit: Forbes

The CJEU rules on consent to cookies under data protection law

Lorna Woods, Professor of Internet Law, University of Essex

Last week’s CJEU ruling in Planet49 is an important Grand Chamber decision concerning the use of cookies and the meaning of consent under the e-Privacy Directive in the light of the Data Protection Directive but also the General Data Protection Regulation (Regulation 2016/679)(GDPR). The judgment is therefore relevant for understanding the cookie obligations in the new regime as well as the old.

Judgment

The case concerned an online lottery. To participate, users had to enter their name and address and were shown two checkboxes in relation to consent for data processing before they could participate in the lottery.  The first consent pertained to users being contacted by third parties for promotional offers. The second consent pertained to cookies being dropped on users’ browsers in connection with participation in the online lottery. While Planet49 sought consent for the third-party promotional offers through the use of an unticked box, box for the use of cookies was pre-ticked.  Two questions were referred: whether the use of pre-ticked boxes gave consent; and what information needed to be supplied to provide clear and comprehensive information to the user.

The e-Privacy Directive provides that users must consent to the use of cookies, and the meaning of consent has the same meaning as in the Data Protection Directive (Recital 17 and Article 2f e-Privacy Directive) and now the GDPR.  The Data Protection Directive required an ‘indication’ of the user’s consent which, as the Advocate General pointed out ([AG60], cited by the Court [para 52]) requires the user to do something active to signal consent rather than remain passive. Further, only active behaviour can satisfy the requirement that consent must be unambiguous [para 54].

The Court also referred to the ‘legislative origins’ of the cookie provision (Article 5(3) e-Privacy Directive), noting that before the provision’s amendment in 2009, the provision gave the user the right to refuse cookies [para 56]. The Court concluded that consent was not valid if pre-ticked boxes were used.  If that was the case under the Data Protection Directive, it remained so under the GDPR, given that its definition of consent is more stringent than that under the Data Protection Directive.  The Court noted that:

according to recital 32 [GDPR], giving consent could include ticking a box when visiting an internet website. On the other hand, that recital expressly precludes ‘silence, pre-ticked boxes or inactivity’ from constituting consent [para 62].

The Court noted that the referring court did not asked the question as to whether making consent to such processing a precondition for participation in the lottery satisfied the requirement for consent to be ‘freely given’ and therefore the ECJ did not answer that question.

Given that the e-Privacy Directive is not just about personal data, the referring court asked if the meaning of consent was the same should data other than personal data be in issue. While it was accepted that the data in issue constituted personal data, in line with the approach of the Advocate General and relying on Recital 24 of the e-Privacy Directive, the Court commented:

that Article 5(3) of Directive 2002/58 refers to ‘the storing of information’ and ‘the gaining of access to information already stored’, without characterising that information or specifying that it must be personal data [para 68].

In response to the questions of the referring court as to the nature of the information the use must be given as to the duration of the use of cookies and whether or not third parties may have access to those cookies, the Court referred to the general obligation that the use be given ‘clear and comprehensive information’ [para 73].  The Data Protection Directive and now the GDPR list certain information that must be given; this does not include duration. The Court noted that these lists were not exhaustive and that a long duration of operation for cookies would mean that a lot of data would be collected. In support of the argument that information on duration should be given the Court noted that the GDPR requires the controller to provide information about how long personal data will be stored.

Comment

The ruling will have significant implications for those who obtain data relying on cookies, as the Court has confirmed that ‘active consent’ is required. While this is clear on the face of the GDPR it was less so under the Data Protection Directive. Given that the Data Protection Directive has already been repealed and the GDPR is now in force the consequences – save for those already legally embroiled on this point – might be thought to be limited.  Nonetheless, this is a clear affirmation of the fact that the GDPR definition of consent applies in the e-Privacy Directive.

Given that the Court interpreted the meaning of consent through the lens of the GDPR as well as the Data Protection Directive, it is also the first ruling on consent under the GDPR.  Further, the ruling might be seen as part of a more general push-back against ‘surveillance capitalism’ techniques constituted by a number of investigations currently ongoing in various Member States (and note the recent guidance from the ICO on use of cookies). 

As an aside, it is also worth noting the broader scope of the e-Privacy Directive: it is not limited to personal data but the ‘private sphere of individuals’, that private sphere encompassing users’ ‘terminal equipment’. This means that national rules should not be less strict if no personal data is in issue.  The Court reminds us also that the protection in the e-Privacy Directive is not limited to to cookies but to ‘hidden identifiers and other similar devices’ [para 70].  Presumably then these techniques also require active consent.  Of course, this ruling relates to the e-Privacy Directive; it remains to be seen what the position will be should the proposed ePrivacy Regulation ever be agreed. 

The final point to note is the issue surrounding ‘freely given’. The German court did not raise the question of whether requiring consent as a pre-condition for accessing the service would be permissible and the Court did not answer it of its own volition. This presumably will come before the Court another day.

Photo credit: pcmag

Anonymity in CJEU cases: privacy at the expense of transparency?

Peter Oliver, Barrister, Monckton Chambers; Visiting Professor, Université Libre de Bruxelles

Juliet famously asked: “Romeo, Romeo wherefore art thou Romeo?”  And then adds: “What's in a name? That which we call a rose by any other word would smell as sweet.”  Having an unfortunate name (like Montague, if you have the misfortune to fall in love with a Capulet) can be challenging.  But what about having no name?  That can be decidedly problematic too.  That is why both the Strasbourg and the Luxembourg courts have recognised a person’s fundamental right to the use of their own name.

The long-standing practice of the Court of Justice has been to replace the names of asylum seekers, children and other individuals in sensitive litigation by initials, while using the actual names of natural persons in other contexts.  Then, in late June, the Court announced out of the blue that this long-standing policy was to partially be reversed: since 1 July, the default position is that, where preliminary references are made in cases to which individuals are party, their names will be replaced by initials which do not correspond to their actual initials. 

Needless to say, the impetus behind this change was the Court’s own case law on the fundamental right to data protection, the recent entry into force of the GDPR and the proposed (and subsequently adopted) Regulation to replace Regulation 45/2001 on the processing of personal data by the Union’s institutions. 

Of course, data protection is not merely commendable, but absolutely indispensable in the digital age.  But this fundamental right, which is enshrined in Article 8 of the Charter, is not absolute, as is plain from the language of that provision itself and Article 52(1) of the Charter.

Consequently, this right must be balanced against an individual’s right to the use of his or her first name and surname.   It is settled law that, because this is an essential element of a person’s identity, it falls within the right to private and family life under Article 8 ECHR.  Over twenty-five years ago, in his seminal Opinion in Konstantinidis, AG Jacobs introduced the same principle into EU law; and it now undoubtedly falls within Article 7 of the Charter.

In addition, the freedom of expression enshrined in Article 11 of the Charter must be borne in mind.  Article 85 of the GDPR specifically requires the Member States to balance data protection with the “freedom of expression and information”, including processing for the purposes of journalism.

As one would expect, the Court’s announcement makes it clear that the Court “may” depart from this new rule “in the event of an express request from a party or if the particular circumstances of the case so justify”.   Unfortunately, this phrase is so nebulous as to give no guidance as to the circumstances in which the Court will consider that the “particular circumstances” will justify this.

In the well-known case of Wightman (discussed here), the Court has set out the full names of all the applicants: that is scarcely surprising since they are all politicians or activists.   Frequently, however, litigants who do not – initially, at least – fall into either category are proud to have their names attached to a leading case.  Will individuals always be informed of their right to have their names used in the proceedings in time to inform the Court of their wish before it is too late? 

Rumour has it that the Court is contemplating informing the senior judiciary of the Member States of each new preliminary reference more speedily than in the past so as to deter other national courts from posing the same preliminary questions.  That seems an excellent idea, but it should not work to the detriment of the fundamental rights of litigants.  In any case, there is nothing to preclude the Court from withholding their names when first making the existence of a new preliminary reference known, and revealing them shortly afterwards if it is appropriate to do so.

The Court was able to effect this radical and abrupt change of policy without seeking any amendment of the Rules of Procedure, which would have required the approval of the Council by virtue of Article 253 TFEU.  The stage was already set for the Court to do so by Article 95 of the Rules of Procedure, which reads:

1. Where anonymity has been granted by the referring court or tribunal, the Court shall respect that anonymity in the proceedings pending before it.

2. At the request of the referring court or tribunal, at the duly reasoned request of a party to the main proceedings or of its own motion, the Court may also, if it considers it necessary, render anonymous one or more persons or entities concerned by the case.

All the Court had to do was to announce that it was altering its practice as to when it would anonymise parties’ names “of its own motion” in future.  What is more, it is not clear whether, in keeping with normal rules of good governance, the Court took to the trouble to consult any other institutions or bodies such as the other EU institutions, the Member States or the CCBE before taking this important step.

Article 95 applies only to preliminary rulings.  However, it is supplemented by Article 190(3), which provides:

Article 95 shall apply, mutatis mutandis, to the procedure before the Court of Justice on an appeal against decisions of the General Court.

Nevertheless, as already mentioned, according to the Court’s announcement, its new policy is confined to preliminary rulings.  Why?   The most plausible explanation is that it did not wish to interfere with the decisions of the General Court in this regard, or realised the futility of doing so. (Article 66 of the General Court’s Rules of Procedure broadly corresponds to Article 95(2) of the Rules of Procedure of the Court of Justice.  Since the Court changed its practice in June, the GC has not followed suit so far.)

What is striking is the disparity between the Court’s apparent willingness to accept the GC’s judgement on matters of anonymity and its determination to impose its will with respect to preliminary references, regardless of the practice of the referring court.  The Court’s new practice is puzzling on two counts: first, it appears to run counter to the Court’s own mantra that preliminary rulings involve cooperation between itself and national courts; and imposing anonymity makes no sense when the national courts are unwilling to follow suit once a case is remitted to them after the Court’s preliminary ruling has been delivered. 

The Court has no power to prohibit the courts of the Member States from continuing to use a litigant’s real name, nor is the Court in any way empowered to stop journalists or others from doing so. This is graphically illustrated by the high profile case known as Celmer in Ireland, which became LM in Luxembourg (on this judgment, see discussion here) but went back to the Irish High Court as Celmer (see for instance the High Court’s final ruling in the case); and Artur Celmer’s name been mentioned frequently in the Irish press (see here and here).

Following the Court’s announcement, it published a new recommendation to national courts on preliminary references in which it called on national courts to remove the names of natural persons from those references; but that is purely aspirational, on the Court’s part except where anonymisation is required by the GDPR or Article 8 of the Charter. 

Needless to say, this absurd situation does little to enhance the Court’s standing or authority.  Of course, in the common law tradition, parties’ actual names are used in the overwhelming majority of court proceedings.  But, even after Brexit, Ireland is not likely to be the only Member State which is at odds with the Court’s new approach, since the use of parties’ names is very widespread in several national legal systems.

What is more, the Court’s website is not up to its new task of finding random initials – which is highly problematic for those users who lack the gift of memorising large quantities of case numbers.  My search for “LM” yielded just one reference – to an eponymous staff case.  Only after a further five or ten minutes of frantic searching did I unearth what I will continue to call the Celmer case.  Had it not been a very recent case, my efforts would no doubt have taken longer, as I would have had to sift through more cases.

In future cases, names such as Bosman, Coman and Klohn - which enable lawyers to find cases on the website in a trice – will simply disappear. This will make research into the case law far harder, and could even make it more likely that relevant judgments are omitted from submissions to the Court itself.  What is more, students of EU law will inevitably suffer, as will their professors.

Adding key words to case names, as the Court has promised to do in its announcement in certain cases, will help but it will not be as effective as using the litigant’s actual name, unless the key words are very rarely found in the case law – which is not always feasible.  In the subsequent cases, LM is referred to as Minister for Justice and Equality (Deficiencies in the System of Justice); the letters “LM” have disappeared.  Unless you remember the precise name of the Ministry or search for “deficiencies”, you are likely to lose a good deal of time.  Unlike Google, the Court’s website does not look for words with a similar spelling or meaning to those requested.

In short, this new practice will make the Court’s case law less accessible to practitioners, academics and students alike.

At the very least, the Court should respect the practice of the referring court in each case so as to avoid a repetition of the Celmer debacle, unless there are quite exceptionally strong reasons to do otherwise.  No doubt, other mechanisms can be devised to mitigate the effects of this hastily introduced new policy, including an improvement of the Court’s website.

Barnard & Peers: chapter 10

Photo credit: Inforrm’s blog