Christmas comes but once a year
Previously on surveillance versus the Court of Justice of the European Union...
...in a case brought by Digital Rights Ireland, the CJEU ruled that the EU's Data Retention Directive was invalid, thereby voiding the supporting national laws across 27 member countries...
...some of which reacted by dropping their data retention programs...but...
...the UK waited three months and then enacted the Data Retention and Investigatory Powers Act in a crazed seven-day squish before disassembling for summer vacation...after which...
...the MPs Tom Watson (Labour, West Bromwich East) and David Davis (Conservative, Haltemprice and Howden) filed a legal challenge with the Court of Appeals, which in turn was referred to the CJEU...
...and while that was pending, the UK voted to leave the EU and David Davis was appointed the minister of charge of leaving and therefore had to withdraw from the suit...
...on December 8 the passed the Investigatory Powers Act became law...
...and on December 31 DRIPA will automatically be repealed.
Two weeks after the Investigatory Powers Act received Royal Assent, the CJEU has ruled in the Watson case, which was backed by the Open Rights Group, Privacy International, Liberty, and the Law Society. The court struck down the UK's approach again. ORG has a helpful summary of the key points of the ruling, but if you've been following all this you already know the gist. Blanket retention of mass communications data is disproportionate; surveillance should be targeted at the subjects of investigations; individuals should be told after their surveillance ends; independent authorization is essential; access should be allowed only for purposes of investigating serious crime. The court also noted that data retention impinges upon freedom of expression and that retained data must remain within the EU. Chris Pounder explains that the "serious crime" bit is because "national security" is not within the CJEU's competence, but the security agencies do (legally) assist law enforcement. Pounder suggests that if a similar case found its way to the European Court of Human Rights, that court would follow CJEU's analysis.
An optimist looks at this ruling and thinks, Surely the UK must be getting it by now.
A pessimist wonders if the present government figures it can just run out the "Brexit" [ugh] clock. Let's say everyone gears up in January to file a fresh legal challenge to the IPA. Based on our admittedly small sample of rulings, it appears that it takes a case two years to get from filing to CJEU ruling, about the length of time allotted between triggering Article 50 and completed EU exit.
The realist...doesn't know. David Anderson, the Independent Reviewer of Terrorism Legislation, sees the judgement as one of a series of "marked and consistent differences of opinion between the European Courts and the British judges", calling both sides of that difference "equally legitimate". Anderson does, however, say that exiting the EU wouldn't resolve the problem of the requirement in the General Data Protection Regulation, which passed this spring and will come into force in early 2018, definitely before Britain's two Article 50 years are up. Britain won't be able to ignore the new law, which is stringent about banning data-sharing with third-party countries lacking comparable protection, unless it wants to ensure British businesses can't trade with the EU. Pounder takes a slightly different view: he thinks the Investigatory Powers Act can conform with the right textual changes to codes of practice and the Judicial Commissioner procedures. However, he, too, points out the problem posed by GDPR: with the UK outside the EU, GCHQ can't monitor French communications in bulk for the French intelligence services or share bulk data on Europeans with US authorities (his examples).
Like so many other things in contemporary public life, the two sides of this issue seem increasingly polarized. Anderson notes that all three reviews of the draft Investigatory Powers bill - the Intelligence and Security Committee of Parliament, the Joint Committee, and Anderson's own - agreed that bulk data retention was proportionate. The Home Office has said it will continue making those arguments to the UK's Court of Appeal (the one that referred the case to the CJEU for clarification in the first place). Neither the European Courts nor civil society will accept this claim.
In an otherwise obnoxious New Yorker piece arguing that Edward Snowden doesn't belong in a class with 1960s Pentagon Papers whistleblower Daniel Ellsberg (despite Ellsberg's own frequently stated opinion is that he does), Malcolm Gladwell unearths two illuminating quotes from Ellsberg's 2002 autobiography. In them, Ellsberg talks about the wealth of information that becomes available to those entering government once they've obtained the necessary security clearance. For about two weeks, Ellsberg wrote, you will feel foolish about everything you said and thought before you had this access; after that, "it will have become very hard for you to learn from anybody who doesn't have these clearances".
To me, this explains a lot, particularly why these back-and-forth law-and-practice versus constitution-and-principles disputes will never stop. Still: it's nice to end 2016 with a good note.
Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.