The Watson Judgment David Anderson Q.C. Independent Reviewer of Terrorism Legislation ECLA (UK) IALS 7 February 2016 The Watson Judgment

The data retention power Power to require CSP to retain CD for 12 months: Sender/recipient of communication Time/duration of communication Type/method/pattern/fact of communication Location (fixed or mobile) Authorised access By 600 public authorities Nat sec, crime, public health, tax collection, preventing death/injury in an emergency

Utility (EU Commission, 2014) "Data retention enables the construction of trails of evidence leading up to an offence. It also helps to discern or corroborate other forms of evidence on the activities of and links between suspects and victims.  In the absence of forensic or eye witness evidence, data retention is often the only way to start a criminal investigation.  Generally, data retention appears to play a central role in criminal investigation even if it is not always possible to isolate and quantify the impact of a particular form of evidence in a given case."

Examples of utility Linking a subscriber to a number Tracing a conspiracy Catching the big fish Time lapse between incident and suspect See “A Question of Trust” (June 2015) Annex 10

Other “bulk” powers Internet connection records (CSPs) Previously secret power to collect similar types of data in one place (SIA only) Bulk interception Bulk equipment interference Bulk personal datasets

For more detail Reports of Interception of Communications Commissioner “A Question of Trust”, June 2015 (D. Anderson) “Bulk Powers Review”, August 2016 (D. Anderson) Judgments of Investigatory Powers Tribunal

History of the data retention power Provided for in RIPA 2000 UK promoted EU Data Retention Directive (2006/24) C-293/12 Digital Rights Ireland EU:C:2014:238 Courts in 6 MStt struck down national powers DRIPA 2014, sunsetting end 2016 Investigatory Powers Act 2016

Digital Rights Ireland, paras 59-65 “Directive 2006/24 .. is not restricted to a retention in relation (i) to data pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime, or (ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offences (para 59) Insufficient safeguards on access (paras 60-64) It must therefore be held that Directive 2006/24 entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary.(para 65)

Watson – High Court July 2015 Followed the submissions of Dinah Rose QC for Watson and Davis Access to data should have been: for serious crime purposes only subject to prior independent authorisation DRIPA 2014 disapplied with effect from 31 March 2016

Watson – Court of Appeal Nov 2016 Provisional view: “CJEU was not laying down definitive mandatory requirements in relation to retained communications data” Asked CJEU: Whether it intended to lay down mandatory requirements of EU law for national rules Whether it intended to expand effect of Arts 7, 8 Charter of Fundamental Rights beyond Art 8 ECHR

ECtHR: Strasbourg “[I]t is a natural consequence of the forms taken by present-day terrorism that governments resort to cutting-edge technologies in pre-empting such attacks, including the massive monitoring of communications susceptible to containing indications of impending incidents. … In the face of this progress the Court must scrutinise the question as to whether the development of surveillance methods resulting in masses of data collected has been accompanied by a simultaneous development of legal safeguards securing respect for citizens’ Convention rights.” Szabó and Vissy v Hungary, Jan 2016, para 68

Watson – AG’s Opinion July 2016 General data retention obligations not excluded from the scope of EU law by Art 1(3) of Directive 2002/58 General data retention obligations in principle consistent with EU law But safeguards needed

Watson – Judgment Dec 2016 EU law precludes national legislation which provides for the general and indiscriminate retention of traffic and location data But not so where limited to geographical areas where there is a high crime risk Full range of safeguards needed: serious crime, prior review, store data in EU

Watson para 100 “The fact that the data is retained without the subscriber or registered user being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance.”

Watson – issues for the future Impact on IP Act 2016 regime Impact on other bulk powers (nat sec carve-out; essence of the right) Post-Brexit adequacy: Hotel California?

The Watson Judgment David Anderson Q.C. Independent Reviewer of Terrorism Legislation ECLA (UK) IALS 7 February 2016 The Watson Judgment