EU law forbids governments compelling private companies to engage in mass surveillance, says EU advocate general

European Union law prohibits governments from forcing private companies to engage in bulk, indiscriminate surveillance, according to a legal opinion from the advocate general (AG) to the European Court of Justice (CJEU).

A “win for privacy”

Responding to the publication of the report on 15 January, Privacy International wrote:

We all benefit when robust rights schemes, like the EU Charter of Fundamental Rights, are applied and followed. If the Court agrees with the AG’s opinion, then unlawful bulk surveillance schemes, including one operated by the UK, will be reined in.

AG Manuel Campos Sánchez-Bordona determined that the 2002 EU Directive on privacy and electronic communications applies to all situations where governments force telecommunications companies to participate in mass surveillance programmes, in a legal opinion hailed by Privacy International as a “win for privacy”.

UK, French, and Belgian surveillance regimes violate EU law

The CJEU will be considering several related cases pertaining to the legality of certain mass surveillance regimes in France, Belgium, and the UK later in the year. Although the legal opinion of AG Sánchez-Bordona is not binding on the CJEU, it is likely to be persuasive as his job is to assist the court with independent legal advice.

Privacy International summarises the AG’s advice this way:

• The UK’s collection of bulk communications data violates EU law.
• The French and Belgium data retention schemes also violate EU law.

According to a summary from the CJEU, the EU Directive applies in situations where:

providers of electronic services are required by law to retain data belonging to their subscribers and to are required by law to retain data belonging to their subscribers and to allow the public authorities to have access to such data

This is irrespective of whether the obligations imposed by government on private companies are done so “for reasons of national security” or fighting crime.

The EU Directive:

excludes from its application activities that are aimed at safeguarding national security and are carried out by the public authorities on their own account, without requiring the cooperation of private parties and not, therefore, imposing obligations on the latter in relation to the management of their businesses.

In other words, this law doesn’t stop governments from engaging in mass surveillance directly, as long as they aren’t forcing a private company to help them.

The AG also endorsed EU court rulings from the joined cases of Tele2 Sverige and Watson and Others which said that parties affected by state surveillance must be informed unless this would compromise an ongoing investigation.

In 2018, British intelligence service MI5 admitted to breaking the law by spying on Privacy International as part of an “investigation”, the details of which are still unknown.

The CJEU gets the final say

One of the four cases which the AG considers in his opinion, and which will be considered by the CJEU, is Investigatory Powers Tribunal (UK) (Case C-623/17, Privacy International). The Investigatory Powers Tribunal, a secretive court which considers national security cases, is awaiting a final decision from the CJEU.

The European Court of Human Rights (ECtHR) has already declared parts of these spying powers to be unlawful. The ECtHR ruled that Britain’s spying powers violate the right to a private and family life and secure communications and freedom of expression. These rights are enshrined in Articles 8 and 10 of the European Convention on Human Rights, as well as in the UK Human Rights Act of 1998.

Featured image via GCHQ/Flickr