EU court rejects mass data retention by govts

The European Union's highest court has ruled that member states cannot routinely collect internet and mobile phone data on citizens, in a setback for governments looking to monitor usage.

The European Court of Justice ruled that although it was permissible in some moments of genuine threat to national security, demanding that telecoms companies get involved in "general and indiscriminate transmission or retention of traffic data and location data" was contrary to EU law.

Several civil rights groups had brought the case, highlighting surveillance operations in the United Kingdom, France and Belgium that they believed overstepped the mark.

The specific legislation they were challenging was the UK's Investigatory Powers Act, commonly referred to as the Snooper's Charter, which became law in 2016, a law passed in Belgium in the same year about data retention, and a decree from the previous year in France relating to the intelligence services.

There was an exception to the rule when "a member state is facing a serious threat to national security that proves to be genuine and present or foreseeable, that member state may derogate from the obligation to ensure the confidentiality of data relating to electronic communications," the court said.

But even then, safeguards must be in place, subject to legal or independent review.

"In these turbulent times, (the ruling) serves as a reminder that no government should be above the law," said Caroline Wilson Palow, legal director of Privacy International, one of the organizations that brought the case.

Limits needed

"Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.

"While (they)... play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power."

The ruling has also come as a blow to the UK government in Brexit negotiations, as it attempts to build a post-Brexit relationship with the EU.

The UK is hoping to secure a so-called adequacy decision covering data transfer with the bloc, similar to the arrangements the EU has with countries including Japan, Israel and Switzerland.

Brussels compares individual countries' data privacy regulations with its own, before deciding if it is happy to share data without additional safeguards, and certain standards must be met for this to happen.