Home Office tender suggests Government has accepted CJEU ruling on independent authorisation for retained data

The Home Office appears to have acknowledged that it will have to make changes to its surveillance capabilities by posting a tender on the UK Government Digital Marketplace, which calls on businesses to help develop a new “independent communications data authorising body”.

The invitation acknowledges a 2016 judgment by the Court of Justice of the European Union (CJEU or ECJ), stating that:

“The ECJ has recently upheld an appeal which challenges the current UK communications data retention and acquisition regime.”

The judgment set criteria for data retention in national law, requiring independent authorisation. The judgment also stated that blanket data retention is not permissible, and that those whose data had been accessed should be notified.

Executive Director Jim Killock said:

“The Government is still silent on what it expects to do after the CJEU ruling explained that limits must be placed on the retention of our phone and email records.

“The government now needs to explain what changes it proposes. The Home Office must be fairly clear about what it thinks it needs to do, as it is busy lining up IT firms to move authorisation from the police to a new independent body.

“This change would be welcome, but we would expect this to be a matter for Parliament to hear about first, rather than IT contractors.

“Perhaps the government is embarrassed about admitting its years of errors in allowing internal police sign off for people’s phone and email records, however, MPs and the public need to hear exactly what is proposed and why it is needed.”

The CJEU set several criteria for access to communications data data: independent authorisation, circumscribed to serious crime, notification to those affected and restrictions on data being sent outside the EU.

The CJEU also said that there should be notifications to people whose data has been accessed after an investigation is completed.

More fundamentally, the court set out that blanket generalised data retention is unlawful, and should be targeted, possibly to particular time periods, geographical areas or groups likely to be involved in serious crime. The Government must explain how it plans to ensure that UK legislation meets all of these criteria.

Notes to Editors

More information about the CJEU ruling is available here:

https://ukconstitutionallaw.org/2017/01/16/thomas-raine-the-cjeu-and-data-retention-a-critical-take-on-the-watson-case/

http://curia.europa.eu/juris/document/document.jsf?text=&docid=186492&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=311633

http://curia.europa.eu/jcms/upload/docs/application/pdf/2016-12/cp160145en.pdf

The Home Office tender is available here:

https://www.digitalmarketplace.service.gov.uk/digital-outcomes-and-specialists/opportunities/2169