1. The Watson Judgment David Anderson Q.C.
Independent Reviewer of Terrorism Legislation
ECLA (UK)
IALS
7 February 2016
The Watson Judgment

2. The data retention power
Power to require CSP to retain CD for 12 months:
Sender/recipient of communication
Time/duration of communication
Type/method/pattern/fact of communication
Location (fixed or mobile)
Authorised access
By 600 public authorities
Nat sec, crime, public health, tax collection, preventing death/injury in an emergency

3. Utility (EU Commission, 2014)
"Data retention enables the construction of trails of evidence leading up to an offence. It also helps to discern or corroborate other forms of evidence on the activities of and links between suspects and victims.  In the absence of forensic or eye witness evidence, data retention is often the only way to start a criminal investigation.  Generally, data retention appears to play a central role in criminal investigation even if it is not always possible to isolate and quantify the impact of a particular form of evidence in a given case."

4. Examples of utility Linking a subscriber to a number
Tracing a conspiracy
Catching the big fish
Time lapse between incident and suspect
See “A Question of Trust” (June 2015) Annex 10

5. Other “bulk” powers Internet connection records (CSPs)
Previously secret power to collect similar types of data in one place (SIA only)
Bulk interception
Bulk equipment interference
Bulk personal datasets

6. For more detail Reports of Interception of Communications Commissioner
“A Question of Trust”, June 2015 (D. Anderson)
“Bulk Powers Review”, August 2016 (D. Anderson)
Judgments of Investigatory Powers Tribunal

7. History of the data retention power
Provided for in RIPA 2000
UK promoted EU Data Retention Directive (2006/24)
C-293/12 Digital Rights Ireland EU:C:2014:238
Courts in 6 MStt struck down national powers
DRIPA 2014, sunsetting end 2016
Investigatory Powers Act 2016

8. Digital Rights Ireland, paras 59-65
“Directive 2006/24 .. is not restricted to a retention in relation (i) to data pertaining to a particular time period and/or a particular geographical zone and/or to a circle of particular persons likely to be involved, in one way or another, in a serious crime, or (ii) to persons who could, for other reasons, contribute, by the retention of their data, to the prevention, detection or prosecution of serious offences (para 59)
Insufficient safeguards on access (paras 60-64)
It must therefore be held that Directive 2006/24 entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary.(para 65)

9. Watson – High Court July 2015
Followed the submissions of Dinah Rose QC for Watson and Davis
Access to data should have been:
for serious crime purposes only
subject to prior independent authorisation
DRIPA 2014 disapplied with effect from 31 March 2016

10. Watson – Court of Appeal Nov 2016
Provisional view: “CJEU was not laying down definitive mandatory requirements in relation to retained communications data”
Asked CJEU:
Whether it intended to lay down mandatory requirements of EU law for national rules
Whether it intended to expand effect of Arts 7, 8 Charter of Fundamental Rights beyond Art 8 ECHR

11. ECtHR: Strasbourg
“[I]t is a natural consequence of the forms taken by present-day terrorism that governments resort to cutting-edge technologies in pre-empting such attacks, including the massive monitoring of communications susceptible to containing indications of impending incidents. … In the face of this progress the Court must scrutinise the question as to whether the development of surveillance methods resulting in masses of data collected has been accompanied by a simultaneous development of legal safeguards securing respect for citizens’ Convention rights.”
Szabó and Vissy v Hungary, Jan 2016, para 68

12. Watson – AG’s Opinion July 2016
General data retention obligations not excluded from the scope of EU law by Art 1(3) of Directive 2002/58
General data retention obligations in principle consistent with EU law
But safeguards needed

13. Watson – Judgment Dec 2016
EU law precludes national legislation which provides for the general and indiscriminate retention of traffic and location data
But not so where limited to geographical areas where there is a high crime risk
Full range of safeguards needed: serious crime, prior review, store data in EU

14. Watson para 100
“The fact that the data is retained without the subscriber or registered user being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance.”

15. Watson – issues for the future
Impact on IP Act 2016 regime
Impact on other bulk powers (nat sec carve-out; essence of the right)
Post-Brexit adequacy: Hotel California?

16. The Watson Judgment David Anderson Q.C.
Independent Reviewer of Terrorism Legislation
ECLA (UK)
IALS
7 February 2016
The Watson Judgment