(Image Credit: iStockPhoto/BrianAJackson)
Several countries have tried to expand surveillance powers, but the European Court of Justice has intervened to curb what could have been one of the most intrusive uses of personal data by a Western government.
Under the pretense of protecting citizens from terrorism, Theresa May, while Home Secretary, championed the Investigatory Powers Act. Supporters argued the law was necessary because terrorists increasingly use digital, encrypted channels to coordinate and spread propaganda, making it harder for authorities to identify suspects and dismantle networks.
Most people accept that targeted surveillance, backed by proper oversight and judicial warrants, is sometimes necessary. However, the Investigatory Powers Act went further: it granted a broad range of public bodies wide powers to collect emails, text messages, and other data, including users’ browsing histories, often without clear limits.
Judges ruled that authorities should not be allowed to authorize their own access to retained data. Instead, independent courts or oversight bodies must assess and approve requests. The court emphasized the risk to privacy when officials both hold and grant access to sensitive information.
The court explained that retained data, taken as a whole, allows very precise conclusions about the private lives of the people whose data is stored. The fact that data can be kept without users being informed creates a feeling of constant surveillance, the court said.
Some of the organizations granted access to citizens’ data—such as the Gambling Commission and the Food Standards Agency—have limited or questionable reasons to need such detailed information. That breadth of access worried privacy advocates, who feared retained personal data could be used for purposes beyond public safety.
The court also stressed the need for safeguards around retention. Given the volume and sensitivity of the data and the risk of unlawful access, national legislation must require that retained data remain within the EU and be irreversibly destroyed at the end of the retention period. These protections aim to reduce the risk of misuse or unwarranted exposure.
Public concern about mass surveillance intensified after disclosures about the extent of the NSA’s programs. Leaked documents revealed that even intelligence officials worried that collecting too much data could produce information overload and undermine effective analysis. Former NSA official William Binney warned that the problem exists across other agencies as well, including the FBI, CIA, and Drug Enforcement Administration.
The legal challenge to the Investigatory Powers Act was brought to EU courts by David Davis, who later became Brexit Secretary. That fact is likely to provoke a range of reactions inside government, from discomfort to bemusement.
The Home Office is appealing the ruling. If the decision stands, its continuing application after the UK’s departure from the EU will depend on negotiations over data-sharing agreements with the bloc. Intelligence services and national security considerations will be important bargaining chips in those talks, and the government will likely seek to preserve robust capabilities for the UK’s security agencies.
Do you agree with the EU court’s ruling on the surveillance bill? Share your thoughts in the comments.