THE EUROPEAN Council of Justice (ECJ) has ruled that the UK Data Retention Directive 2006, which looks to haul in user data, is invalid.
The directive has been opposed for some time, and the decision has been widely welcomed by people from Viviane Reding to Rick Falkvinge, and civil rights groups including the European Digital Rights group EDRi and Digital Rights Ireland, which brought the case before the ECJ along with the Austrian Working Group on Data Retention.
The ECJ looked at the directive and considered whether it strikes the proper balance between human rights and the desire to increase security.
The balance is not adequately struck, it said, and it cannot back the directive as it is.
"The Court takes the view that, by requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data," it said in its decision.
"Furthermore, the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the persons concerned a feeling that their private lives are the subject of constant surveillance."
A lack of proportion in the directive is the issue and the ECJ said that the European Union's supported directive "exceeds limits".
"The directive covers, in a generalised manner, all individuals, all means of electronic communication and all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime," it added. On top of this the directive does not do enough to protect individuals' data. The whole thing, it seems, is a mess.
The decision was welcomed by the Open Rights Group, which campaigns in support of privacy. Executive director Jim Killock said that the end of indiscriminate collection is a big plus for privacy.
"Today's ruling recognises that blanket data collection interferes with our privacy rights. We must now see the repeal of national legislation that obliges telecoms companies to collect data about our personal phone calls, text messages, emails and internet usage," he said. "This collection is indiscriminate and reverses the presumption of innocent until proven guilty."
The ECJ decision supported the challenge submitted by Digital Rights Ireland, and the group also welcomed the announcement.
"This is the first assessment of mass surveillance by a supreme court since the Snowden revelations," said chairman TJ McIntyre. "The ECJ's judgement finds that untargeted monitoring of the entire population is unacceptable in a democratic society."
Digital Rights Ireland said that the decision will have a positive impact on 500 million citizens, and its legal representatives said that it is now up to European member states to implement data retention laws fairly. µ
Plus the cost of ambition as moonshots eat into the coffers
Spoiler alert: it's probably VeriSign
Did we say cuts off? We meant traps them inside their own home