The Court of Justice of the European Union (CJEU) has published its decision on the scope of the data retention powers under the UK’s Data Retention and Investigatory Powers Act 2014 ("DRIPA"), which could have profound implications on the piece of legislation that has replaced DRIPA, the Investigatory Powers Act 2016. The case examined whether the Investigatory Powers Act could be used to require telecommunication service providers to retain its customers’ communications for 12 months without prior review by a court.
In a significant ruling, the CJEU held that national legislation cannot permit the carrying out of mass surveillance programmes that provide for the “general and indiscriminate retention” of communication and location data of a telecommunication provider customers’. Furthermore, the CJEU found that where data is retained, national security agencies cannot access such data unless such access is:
- restricted to fighting serious crime
- subject to prior review by a court or an independent administrative body
- subject to the requirement that the data concerned should be retained within the European Union.
This decision will likely have an impact on the implementation of the Investigatory Powers Act and provide further arguments to challengers of the Act.