The highly controversial EU Data Retention Directive compelled all ISPs and telecommunications service providers operating in Europe to collect and retain a subscriber's incoming and outgoing phone numbers, IP addresses, location data, and other key telecom and Internet traffic data for a period of six months to two years. An Irish constitutional challenge brought by Digital Rights Ireland (DRI) against its 2009 data retention law was referred to the European Court of Justice (ECJ). In 2014, the ECJ declared the Directive invalid.
Digital Rights Ireland (DRI), a digital rights lobbying and advocacy NGO.
Ireland
The EU Data Retention Directive (DRD), adopted by the European Union in 2006, is the most prominent example of a mandatory data retention framework. The highly controversial Directive compelled all ISPs and telecommunications service providers operating in Europe to collect and retain a subscriber's incoming and outgoing phone numbers, IP addresses, location data, and other key telecom and Internet traffic data for a period of six months to two years. Since its passage, the EU Data Retention Directive has faced intense criticism. The Directive lacked safeguards that limit government collection and access to individuals' data. It also omitted controls over what the data can be used for.
Government-mandated data retention impacts millions of ordinary users by compromising online anonymity which is crucial for whistleblowers, investigators, journalists, and those engaging in political speech. Data retention laws are invasive, costly, and damage the right to privacy and free expression. Privacy risks increase as these databases become vulnerable to theft and accidental disclosure. Service providers must absorb the expense of storing and maintaining these large databases and often pass these costs on to consumers.
Ireland has been one of the earliest and most determined proponents of data retention in Europe. In 2001, it was revealed by Karlin Lillington of the Irish Times that Irish telephone companies retained data for up to six years. When this practice was challenged by Ireland’s Data Protection Commissioner, the government stepped in and gave a secret directive to telecommunications operators to retain all traffic data (including mobile phone location data) for three years. The subsequent scandal led to the then Minister of Justice introducing stand-alone legislation. Criticisms that the Irish data retention regime violated existing EU regulations on telecommunications privacy led to Ireland proposing the EU-wide initiative that eventually became the Data Retention Directive. Ireland itself passed its implementation of the EU directive in 2011. Digital Rights Ireland was formed in the middle of this national and EU battle, and from its inception, made one of its primary goals fighting data retention. As part of this mission, DRI began an EU legal challenge to Ireland’s data retention implementation law in 2006.
It should be noted that there is a political as well as a legal dimension in these cases. Even if a law is declared invalid, there may be pressure to adopt a similar law in the future. It is important to prepare the ground to make sure that the effect of a legal victory isn't undone by later legislation which may be just as bad.
DRI runs off a modest budget, but included among the founders are working lawyers. This allows them to include legal action as a potential means of achieving change. Right off the bat, they set out to garner media attention through press releases and blogging to establish a reputation as domain experts. They leveraged give-and-take relationships with journalists by putting them in touch with academics who provided the inquiring journalists with background knowledge. They also sought meetings with various members of parliament, in order to brief them or their advisors on the issues.
The Irish government did its’ best to use every procedural road block against Digital Rights Irelands’ court challenge to the law. As frustrating as it was, the group accepted that the litigation was going to take a long time. It did—the fight went on for eight years, but luckily DRI kept their spirits high and had the support of the European Digital Rights coalition (EDRi). After the Snowden revelations, the political climate changed drastically and the court was very clearly against the directive. DRI may have won in any event, but the disclosures meant that they were no longer fighting an uphill battle.
On April 8, 2014, the European Court of Justice declared the Data Retention Directive invalid. The Data Retention is now gone in every member state, but the challenge of implementing that decision in the individual states still remains.
While organizations like the Electronic Frontier Foundation have pursued public impact litigation in the United States in the pursuit of privacy and free expression issues online, this strategy is traditionally more difficult in other jurisdictions. Litigation, in general, can be very expensive, in particular in countries like Ireland where the losers of a lawsuit generally have to pay the other side’s legal costs as well as their own. Additionally, it can be hard to establish precedents that operate more broadly than the outcome of a single case. Although it was a contested issue, Digital Rights Ireland was ultimately able to convince the Irish courts to agree to a proceeding in actio popularis, meaning that DRI brought the case on behalf of the privacy rights of all individuals and not just their own corporate rights. Since DRI’s action, other digital rights groups in Europe began using similar strategies, including the UK’s Open Rights Group, which has appointed a legal director to conduct such cases, and Privacy International, which, along with a coalition of other groups, in 2014 challenged GCHQ in Britain’s Investigatory Powers Tribunal.
Coalition matters: DRI benefited greatly from their EDRI membership and their ability to share information with other groups in Europe. DRI’s data retention case was ultimately merged with a similar one from Austria, which helped signal to the ECJ that this was a matter of importance throughout Europe.
It is helpful to develop alliances with other domestic civil rights groups, even if they don't have any special knowledge in the digital rights space, they still have vital knowledge about the wider political and legal issues.
- Educate and share knowledge with the public in order to garner support and make people care about your cause.
- Journalists are key allies; They are the most critical audience since they are the ones disseminating news to the public.
- Work with a mix of specialists; Having relationships with academics as well as practicing lawyers is crucial since academics often have additional background information that the practitioners don’t always have.
- Prior to bringing a case, formulate your arguments and prepare the groundwork for the case.
- Court of Justice of the European Union. The Court of Justice declares the Data Retention Directive to be invalid.
- Digital Rights Ireland
- ECJ says: EU-mandated mass surveillance “entails an interference with the fundamental rights of practically the entire European population.”
- Data Retention in Ireland: Privacy, Policy and Proportionality, TJ McIntyre.
