The mass electronic surveillance of all citizens? Not on my watch! confirms the ECJ

Par Vinciane Gillet, Lawyer at the Brussels Bar and Chair of INCUEBRUX and Jean-François Henrotte, Lawyer at the Liege and Brussels Bar

To catch thieves and murderers, Hercule Poirot, the famous fictional Belgian detective created by Agatha Christie, relied only on his ‘little grey cells’ and ‘order and method’. Decades later, police force, national security and intelligence authorities rely heavily on the exploitation of electronic communications

Wiretapping and the likes have been employed for years in criminal investigations. These are legal ways to access and monitor electronic communications of persons suspected of criminal activity.

However, electronic communications being ubiquitous in our everyday life, there has been, for years, a growing temptation for governments to preventively gather and retain the data relating to electronic communication of all citizens, regardless of whether they are suspect in a criminal investigation or not, ‘just in case’ these data could be useful in possible future inquiries. So far, the content of the electronic communication has not been concerned per se. Only the metadata, notably data exploited to trace and pinpoint the source and destination of a communication, data on the location of the device generated in the context of supplying electronic communications services, and the date, time, duration and the type of communication are to be retained. One does not need to be a famous detective to understand that metadata is a trove of intelligence and can be as revealing as the content of the transmission. This is particularly problematic for professions, such as ours, subject to professional secrecy or legal privilege.

In the aftermath of gruesome terrorists’ attacks in Spain and in the UK, the Data Retention Directive (Directive 2006/24/EC) meant to harmonize Member States’ stipulations concerning the retention of metadata, providing that the electronic communication providers had to retain traffic data, location data and related data necessary to identify the subscriber or user. Two preliminary rulings were referred to the ECJ by the Irish High Court and the Austrian Constitutional Court. In the judgement of 8 April 2014, Digital Rights Ireland and Others (C-293/12 and C-594/12), the Court declared Directive 2006/24/EC invalid ‘on the ground that the interference with the rights to respect for private

life and to the protection of personal data which resulted from the general obligation to retain traffic data and location data laid down by that directive was not limited to what was strictly necessary’. In the judgement of 21 December 2016, Tele2 Sverige and Watson and Others (C-203/15 and C-698/15), the ECJ confirmed its case law.

In the wake of this case law, various national courts invalidated legislations, which were based on the Data Retention Directive. As an example, in June 2015, the Belgian Constitutional Court adopted the same reasoning as the ECJ to quash the Belgian Data Retention Act.

Concerned by the loss of a tool that they deem necessary to safeguard national security and fight serious crime, Members States such as the UK, France and Belgium, have reintroduced similar legal texts, amended in an attempt to take account of the remarks of the Court of Justice in its previous verdicts. In Belgium, this new version of the Data Retention Act was challenged again before the Constitutional Court, which referred a preliminary ruling to the ECJ.

By two Grand Chamber judgements delivered on 6 October 2020 Privacy International, C-623/17)?–?La Quadrature du Net and Others, Joined-Case C-511/18 and C-512/18, (Ordre des barreaux francophones et germanophone and Others, C-520/18) the ECJ mostly confirms that such general and indiscriminate retention of metadata is disproportionate, and constitutes especially severe interferences with fundamental rights such as freedom of expression or right to privacy.

In a succinct but cloudless sentence, the ECJ recognizes that ‘such deterrence may affect, in particular, persons whose communications are subject, according to national rules, to the obligation of professional secrecy’.

These judgements from the ECJ contain many valuable insights on the contours of electronic surveillance of citizens. But, beyond these conclusions, the Court let the door ajar. Indeed, the judgements provide clarification, and some guidance, for States wishing to implement targeted, or even general, data retention complying with the principle of proportionality, and the fundamental rights guaranteed by the Charter.

The ECJ holds that national law may allow the recourse to a general and indiscriminate metadata retention?–?and, even further, the automated analysis of the data?–?if the following conditions are met: The Member State has to be under a genuine, present or foreseeable serious threat to its national security, the retention order may be given only for a period that is limited in time to what is strictly necessary and this order has to be subject to effective review, either by a court or by an independent administrative body whose decision is binding. Indiscriminate retention of the metadata of all citizens could therefore be valid if it is limited in time, justified by national security and subject to effective review.

For the other claims raised by the Member States, as combating serious crime, the ECJ holds, inter alia, that ‘targeted retention of traffic and location data which is limited, on the basis of objective and non-discriminatory factors, according to the categories of persons concerned or using a geographical criterion, for a period that is limited in time to what is strictly necessary, but which may be extended’ would not be contrary to the Union law.

In conclusions, electronic surveillance is here to stay. Modern Hercule Poirot wants to feed a mountain of data to his ‘little grey cells’. And, to a certain extent, this matches expectations of citizens. Who would not want to live a safer life after all? If there is little doubt that these judgements will have dire consequences for the contested national legislation, there is less doubt that new legislation, crafted following a rigorous analysis of the Court’s jurisprudence, will replace the invalidated laws, jeopardizing again fundamental rights and, notably, the professional secrecy. It will be our duty to ensure that these laws, and the application that will be made of them, correspond in all respects to the criteria laid down by the Court and, beyond that, to the principles of the Union law.

[supsystic-social-sharing id="1"]