Last Thurday Access received a response from the European Commission acknowledging a notification of infringement sent two weeks ago in a letter to Michel Barnier, Commissioner in charge for Enterprise and Industry. The complaint addresses the United Kingdom’s breach of E.U. law through its adoption of the Data Retention and Investigatory Powers (DRIP) on 18 July 2014.
This bill, which was rushed through in only 4 days leaving next to no room for public or parliamentary debate, dramatically expands the government’s surveillance powers, treating all citizens, in the U.K. and abroad, as surveillance targets.
The passing of the DRIP contravenes an EU procedure called TRIS (Technical Regulations information System). Under this law, whenever an E.U. Member State wants to pass a national law concerning Information Society services, the State must notify the Commission when the legislation is being drafted, which is intended to allow companies the opportunity to protest laws that would be detrimental to the European internal market. The United Kingdom only notified the Commission on the day the House of Commons voted through the law, bypassing this procedure and violating E.U. law.
The Commission will now look into Access’ complaint and decide whether or not it will launch infringement proceedings, which according to the letter should take up to 10 weeks. If the Commission decides to pursue charges against the UK government, the DRIP could be suspended. This would create room for a public discussion about the law, and allow ISPs for instance, to voice concerns on the administrative and/or financial burdens that compliance with DRIP would entail.
DRIP under fire on multiple fronts
A second letter, signed by 21 digital rights organisations — including Access, EDRi, Privacy International, FIPR, Article 19, Bits of Freedom, and EFF — addressed to Commissioner Michel Barnier and Commissioner Cecilia Malmström, should receive a response next week. That letter outlines the procedural violation of E.U. law under the TRIS procedure and underlines that the DRIP is not in line with the Court of Justice of the E.U. (CJEU) ruling of April. It also asserts that the UK government’s claim for an “emergency procedure,” used to justify the late notification to the Commission, was neither legal nor logical. Indeed, the CJEU ruling was released more than 3 months prior to the adoption of DRIP.
Meanwhile, the DRIP is also being challenged in UK national courts. Liberty, an NGO promoting civil liberties, will represent two members of Parliament who argue that the new legislation is incompatible with Article 8 of the European Convention on Human Rights (ECHR) (the right to respect for private and family life), and Articles 7 & 8 of the EU Charter of Fundamental Rights (respect for private and family life and protection of personal data). This argument is based in the decision by the CJEU, which invalidated the Data Retention Directive due to its egregious interference with individual privacy rights. This ruling made clear that existing UK law — the Regulation of Investigatory Powers Act (RIPA) of 2000 — required urgent reconsideration. However, an expansion of surveillance powers, amplifying the potential impact on privacy rights, is clearly not consistent with this ruling.
Access wholeheartedly believes that the DRIP is inconsistent with the ECHR and the EU Charter of Fundamental Rights. This intrusive surveillance law is a threat to fundamental rights, and furthermore is not in line with the recent decision of the CJEU. We renew our call to the Commission to uphold its role as Guardian of the treaties and bring an end to these blatant infringements of E.U. law.
Find the letter from the European Commission here (and for the record, Raegan is a Ms, not a Sir!).