CJEU Bulk Challenge

Court of Justice of the European Union (CJEU)

Case number: C-623/17

Status: Closed - for next steps see Bulk Personal Datasets & Bulk Communications Data challenge

On 8 September 2017, the Investigatory Powers Tribunal (IPT) referred questions concerning the collection of bulk communications data (BCD) by the Security and Intelligence Agencies (SIAs) from mobile network operators (or electronic communications network) to the Court of Justice of the European Union (CJEU).

The initial case was brought by Privacy International before the IPT on 8 June 2015. In this case, Privacy International challenges the acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets (BPDs) and bulk communications data (BCDs) by the UK Security and Intelligence Agencies (SIAs) – specifically Government Communications Headquarters (GCHQ), Security Service and Secret Intelligence Service.

In the course of this case, Privacy International claimed that the regime was unlawful under EU law because it failed to provide various safeguards identified as required in the CJEU judgment in Tele2/Watson case. The Government argued that the regime was outside the scope of the EU given that it related to national security (and not serious crime purposes at issue in Tele2/Watson) and alternatively that Article 8 of the European Convention on Human Rights, provided sufficient safeguards and the implementation of Watson safeguards would cripple the SIAs ability to operate the BCDs and should not apply. The IPT referred both topics (in relation to the BCD regime only not BPD) to the CJEU. The documents containing legal arguments from the relevant hearing are listed below.

The CJEU is now asked to decide, first, whether requiring an electronic communications network to process data for the SIAs of a member state falls within the scope of Union law and of the e-Privacy Directive. Second, if the answer to the first question is yes, how should the Tele2/Watson judgment apply in this context.

The CJEU decided to hold a joint hearing with two other cases, the joined cases C-511/18 and C-512/18 (La Quadrature du Net and Others) from France, where Privacy International is also a party, as well as case C-520/18 (Ordre des barreaux francophones et germanophone and others) from Belgium. On 15 January 2020, the CJEU Advocate General issued his opinion on how he believes the Court should rule and suggested that the UK bulk data retention regime is incompatible with EU law.

The CJEU issued its judgment on 6 October 2020. It, first, ruled that EU law applies every time a national government forces telecommunications providers to process data, including when it is done for the purposes of national security. Second, it concluded that EU law sets out privacy safeguards regarding the collection of data by national governments, which countries must follow. On the same day, the Court issued its judgment on the above mentioned joint-cases against France and Belgium.

After CJEU judgment, the UK Investigatory Powers Tribunal issued a declaration in our challenge to the bulk communications data regime, finding UK legislation to be incompatible with EU law. 

* Image by Transparency International EU Office