DRIPA 2014—what are the most noteworthy changes?

How far does the controversial new Data Retention and Investigatory Powers Act 2014 go? Graham Smith , partner at Bird & Bird LLP and expert in internet law considers the new provisions and changes to the existing law.

What is the context of DRIPA 2014 and what does it seek to achieve?

The immediate spur for the legislation was the decision of the EU Court of Justice (CJEU) decision on 8 April 2014 in the Digital Rights Ireland case (Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources C-293/12, [2014] All ER (D) 66 (Apr)), invalidating the EU Data Retention Directive 2006/24/EC (the Directive) on grounds of non-compliance with the EU Charter of Fundamental Rights and Liberties. The Directive was implemented in the UK by the Data Retention (EC Directive) Regulations 2009, SI 2009/859 (the Regulations). As secondary legislation under the European Communities Act 1972 those regulations were vulnerable to judicial review. The government decided to replace them with new primary legislation. It also took the opportunity to make amendments to RIPA 2000. It pushed both through Parliament as emergency legislation, going from first reading to Royal Assent in the space of four days. DRIPA 2014 is subject to a sunset clause, repealing it at the end of 2016.

How successful do you think DRIPA 2014 will be in achieving its aims?

The government has succeeded in obtaining new primary legislation. If the aim was to put an end to litigation challenges, that has not succeeded. Liberty has announced that MPs David Davis and Tom Watson will launch a judicial review challenging the data retention aspect of DRIPA 2014.

How effectively does DRIPA 2014 address the CJEU’s specific grounds for invalidating the Directive?

The legislation does not purport to address fully every separate ground identified by the CJEU. Various documents issued by the government claim only to address the CJEU judgment ‘where possible’ and ‘to the extent practicable’, or to address ‘elements’ of the judgment. The impact assessment also acknowledges the ‘risk of being perceived as ignoring the CJEU judgment’. To address every separate point in the CJEU judgment would have meant abandoning blanket mandatory data retention, which the government has stated that it will not do. There will no doubt be dispute about whether the objections listed in the CJEU judgment should be read to some extent cumulatively or as a list of self-standing separate objections, any one of which is sufficient to found non-compliance with the EU Charter.

Will there be any change in the current retention period requirements?

The fixed 12 months is replaced by a maximum 12 months. It is for the Secretary of State to consider necessity and proportionality and decide what periods of 12 months or less to specify in notices to operators.

What is the impact of DRIPA 2014 on the provisions in the RIPA 2000 dealing with interception warrants, interception capability and communications data access?

The supplemented definition of telecommunications services appears to be capable of being interpreted more broadly than the previous definition. It applies to RIPA 2000 generally. DRIPA 2014 also applies the supplemented RIPA 2000 definition to the data retention aspects, in substitution for the Communications Act 2003 definition previously used in the Regulations.

What impact will the provisions of DRIPA 2014 have on extra-territoriality under RIPA 2000 or other relevant legislation and how will this be applied in practice?

DRIPA 2014 makes three amendments—according to the government ‘clarifications’—to the existing provisions concerning interception capability notices, interception warrants and communications data acquisition notices. These amendments are designed to ensure that non-UK providers are within the scope of these provisions.

The amendments state in terms that the notice or warrant may relate to conduct outside the UK. They state that the duty on a person to assist or comply with warrants or notices applies whether or not the person is in the UK. And, they provide three different schemes for serving warrants or notices within the UK on operators located outside the UK, graduated according to (presumably) the perceived intrusiveness of the warrant or notice. They also provide that, when considering under RIPA the reasonable practicability of a person outside the UK taking steps in a country outside the UK to give effect to a warrant, regard is to be had to any relevant requirements or restrictions under the law of that country and the extent to which it is reasonably practicable to give effect to the warrant without breaching them. DRIPA 2014 provides no specific mechanism for giving data retention notices (as opposed to interception capability notices, interception warrants and communications data acquisition notices) to operators located outside the UK.

Was the whole process sufficiently transparent?

The use of the emergency procedure was widely criticised, since the CJEU decision had been issued at the beginning of April and the circumstances that lent urgency to the RIPA 2000 amendments were opaque. The compressed timetable let to various supporting materials becoming available only at the last minute or during the expedited passage of the Bill.

Does DRIPA 2014 go further than just restating the law?

This is a contentious area. A number of UK academics certainly think that it does—see the open letter signed by 15 academics which describes the government’s position that DRIP does not contain new powers as ‘false’ (http://www.slideshare.net/EXCCELessex/open-letter-uk-legal-academics-drip).

Area of Interest